lowSeverity: lowRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Netlify headers (netlify.toml / _headers)Where it livesImplementationThis fix is applied in: Netlify headers (netlify.toml / _headers). That's the surface you'll edit, DNS, response headers, or a static file.~3 minTime to fixEffortRoughly 3 minutes of hands-on work, propagation aside. Most of these are copy-paste.+4 posture+4 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Referrer-Policy: stop leaking full page URLs to third parties

One Referrer-Policy header keeps your page paths and query strings from leaking to other sites

The threat

Our scanner saw your responses come back with no Referrer-Policy. When a visitor clicks a link off your site, or one of your pages loads a third-party ad, font, map, or analytics script, the browser attaches a Referer header naming the exact page they came from: full path and query string included.

That URL sometimes carries more than you would hand a stranger on purpose: a search term, a share or password-reset token sitting in the query, an internal path that quietly maps your site. Without a policy, every third party your pages touch collects it. Setting Referrer-Policy: strict-origin-when-cross-origin trims what leaves your origin down to just the bare domain (no path, no query) the moment a request crosses to another site, while still sending the full referrer within your own site so your analytics keep working.

The exact fix

Send Referrer-Policy: strict-origin-when-cross-origin. On Netlify, add it in netlify.toml:

# netlify.toml
[[headers]]
  for = "/*"
  [headers.values]
    Referrer-Policy = "strict-origin-when-cross-origin"

Or the Netlify _headers form:

/*
  Referrer-Policy: strict-origin-when-cross-origin

On nginx:

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

On Apache:

Header always set Referrer-Policy "strict-origin-when-cross-origin"

What the value does: on same-origin navigation the full path is still sent; when you link or load across origins only the origin (scheme and host, no path or query) goes out; and nothing at all is sent when a secure page hands off to an insecure one.

Want to send nothing, ever? Use no-referrer for a stricter posture. Recent browsers have started defaulting to strict-origin-when-cross-origin, but older ones and some embedded contexts still send the full URL, so setting the header explicitly is what guarantees the behavior everywhere.

Verify it

curl -sI https://yourdomain.com | grep -i referrer-policy

A correct result is a single line: referrer-policy: strict-origin-when-cross-origin.

Proof

apecyber.com sends this header on every response as part of the hardened header set behind its A / 100 grade on Netlify. The ApeCyber scanner flags the missing header passively on every scan, from the outside, touching nothing. Adding it is a clean −4 off the posture score, and it takes about three minutes.