Missing Referrer-Policy

The fix for your stack

// next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }],
      },
    ];
  },
};

export default nextConfig;

What the referrer reveals

Every time a browser loads a resource or follows a link from your page to another site, it can send a Referer header with the address of the page it came from. If that address includes a path or a query string, the other site, and every analytics or ad tool on it, learns it. Addresses sometimes carry things they should not: a password-reset token, an order number, a search term, or the name of a client's internal page.

The Referrer-Policy header lets you decide. The value strict-origin-when-cross-origin, which current browsers use by default, sends the full address to your own pages, only the site name to other sites, and nothing at all when going from HTTPS to plain HTTP. Setting it yourself makes the behaviour the same in every browser, including older ones whose defaults were looser, and records your decision.

How Skewcheck detects it

Skewcheck reads the response headers of the page. If a referrer-policy header is present, the check passes, whatever its value. If it is absent, the check fails with low severity and removes 2 points from the score. Skewcheck does not grade the value, so no-referrer-when-downgrade, which is looser, would pass, and the choice remains yours.

The check reads the header on the page's response only. A policy set in a <meta name="referrer"> tag works in browsers but is not a header, so it is not counted here. Individual links can also carry their own rel and referrerpolicy attributes, which Skewcheck does not look at.

curl -sI https://example.com | grep -i referrer-policy

Adding it

Send the header on every response. The tabs above give the exact lines for nginx, Apache, Netlify, Cloudflare, Next.js, Webflow, Framer and WordPress. If your plan on a site builder does not allow custom response headers, the snippets describe the alternatives, such as placing Cloudflare in front of the site and setting the header as a response rule there.

Choose a stricter value, such as no-referrer or same-origin, only if you know that you do not need referrer data. Analytics that attribute traffic to your site on other platforms, and affiliate programmes that check the referring site, rely on the origin being sent. After deploying, check one external link with the network panel open to see the Referer value that actually goes out.

Before and after

HTTP/2 200
content-type: text/html; charset=utf-8

HTTP/2 200
content-type: text/html; charset=utf-8
referrer-policy: strict-origin-when-cross-origin