Skip to main content
Checks for Referrer-Policy header
Rule IDsecurity/referrer-policy
CategorySecurity
ScopePer-page
Severityinfo
Weight3/10

​
Solution

Referrer-Policy controls what referrer information is sent with requests. Recommended: ‘strict-origin-when-cross-origin’ (default in modern browsers) sends origin only cross-site. ‘no-referrer’ for maximum privacy, ‘same-origin’ to only send referrer to same origin. Avoid ‘unsafe-url’ which leaks full URLs including paths.

​
Enable / Disable

​
Disable this rule

squirrel.toml
[rules]
disable = ["security/referrer-policy"]

​
Disable all Security rules

squirrel.toml
[rules]
disable = ["security/*"]

​
Enable only this rule

squirrel.toml
[rules]
enable = ["security/referrer-policy"]
disable = ["*"]