The fix, in one snippet
1. Type about:config in the address bar and press Enter
2. Accept "Accept the Risk and Continue"
3. Search for: Network.http.referer.XOriginPolicy
4. Set the value to 2 (send a referrer only to the same site)
Value 0 sends it always, 1 sends it to the same base domain,
2 sends it only to the exact same host.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan page has a URL with a distinctive path and query parameter. It loads a resource from a second Scan.now domain and the probe endpoint records the Referer header it received; inside a cross-origin frame we also read document.referrer. Our page sends no Referrer-Policy header, so what arrives is the browser's default. The check passes when only the origin (https://scan.now/) is sent, which is the strict-origin-when-cross-origin default in Chrome 85+, Edge, Firefox 87+ and Safari. It fails when the full URL crosses the site boundary, which happens on old browsers or when the default has been changed to no-referrer-when-downgrade.
Why it matters
URLs carry more than people expect: search terms, document identifiers, e-mail addresses in query strings, password-reset and unsubscribe tokens. With a full referrer, every third-party script, image and advert embedded in a page receives that URL, and the next site you click through to receives it as well. Health portals have leaked condition names to advertising networks this way, and reset tokens have leaked to analytics providers. Users of outdated browsers and anyone who changed the referrer preference to the old permissive value are affected.
How to fix it
Update the browser first; every current browser trims cross-site referrers by default. Firefox lets you go further in about:config: network.http.referer.XOriginTrimmingPolicy = 2 sends only the origin cross-site, and network.http.referer.XOriginPolicy = 2 sends nothing at all cross-origin (some sites that check referrers for hot-linking will break). Enhanced Tracking Protection in Strict mode also trims referrers sent to known trackers. Chrome, Edge and Safari expose no user setting beyond the default. Site owners control this from the other side with a Referrer-Policy header; see the Referrer-Policy check and HTTP security headers explained. Background: how online tracking works.
Where this fits
Full referrer sent cross-site is check 10 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Canvas fingerprinting exposure (low), where your browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result can serve as a stable tracking signal. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Full referrer sent cross-site closes one route in. Immediately below it: Global Privacy Control signal, where your browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs will not receive yours automatically; WebGL renderer exposure, where scripts can read your graphics card model and driver details through WebGL, a strong and long-lived identifying signal; Do Not Track signal, where your browser is not sending the DNT: 1 header.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Full referrer sent cross-site (low severity)
Scanner check id: referrer-leak
What this check tests: When you follow a link to another site, your browser sends the full address of the page you came from, including its path and query string.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
9 min read · Updated Sep 15, 2026
HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It
Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...
Read the guide
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide