Header Security

Referrer-Policy Header Check

Learn how to configure the Referrer-Policy header to limit sensitive data leaks and protect user privacy while optimising your SEO.

What this test checks

This test checks for the presence and configuration of the Referrer-Policy header. It controls the referrer information sent during HTTP requests. A misconfigured policy can expose sensitive data (full URLs, parameters, etc.) to third‑party sites, harming privacy and security.

Our recommendation

Set a strict Referrer-Policy, e.g., 'strict-origin-when-cross-origin' (default in modern browsers) or 'same-origin'. Avoid values like 'unsafe-url' or 'no-referrer-when-downgrade' that expose too much information. Configure via your server (Apache/Nginx) or directly in HTML tags.

Security tests

View all tests

CMS Security

Referrer-Policy Header Check

What this test checks

Our recommendation

Read more

admin-ajax.php Accessibility Check

X-Content-Type-Options: nosniff Header Check

CNIL Mention in Privacy Policy Check

WordPress Version Check

Shopify Password Reset CAPTCHA Protection Check

Email Address Exposure Check

Development File Exposure Check

Joomla configuration.php Exposure Check

Privacy Policy Page Presence Check

Login Attempt Limiting Check

Shopify HSTS Header Check

Shopify Registration CAPTCHA Protection Check

Shopify SSL/TLS Configuration Check

Shopify phpinfo Exposure Check

PrestaShop parameters.php File Access Check

Database Backup File Exposure Check

Joomla Cron Access Check

Information Leak via HTTP Headers Check

Magento Git File Exposure Check

Shopify XSS Protection Check

Directory Indexing Check

Cookie Policy Page Presence Check

WordPress Theme Editor Access Check

PrestaShop Log File Exposure Check

Index File Presence in Upload Folders Check

Cross-Origin-Embedder-Policy Header Check

CAPTCHA Presence on Password Reset Form Check

Shopify API Key Exposure Check

PrestaShop Version Check

CMS Vulnerability Check

Cache Policy Check (Cache-Control, Pragma, Expires)

Magento Admin Access Restriction Check

Server Status Pages Access Check

WordPress Debug Log Exposure Check

PrestaShop Admin Access Check

HSTS Header Check (HTTP Strict Transport Security)

WordPress Backup File Exposure Check

Drupal Log File Exposure Check

Magento Backup File Exposure Check

Shopify Referrer-Policy Header Check

Drupal Temporary Folder (tmp/) Access Check

Clear-Site-Data Header Check

Shopify Upload Folder Security Check

Shopify Environment Information Exposure Check

PrestaShop Admin Access Restriction Check

WordPress Admin Access Check

PrestaShop Upload Folder Indexing Check

Joomla Log File Exposure Check

PrestaShop Session Cookie Security Check

Shopify Admin CAPTCHA Protection Check

Content-Security-Policy Header Check

Shopify Cart Endpoint Exposure Check

Known CVE Vulnerability Check on Used Technologies

Upload Folder Indexing Check

xmlrpc.php Access Check

Shopify REST API Exposure Check

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

Drupal settings.php File Access Check

Installation Log File Exposure Check

SQL Query Exposure Check

API Key Exposure Check

Shopify HTTP Security Headers Check

Joomla Admin Login Page Protection Check

Shopify Password Protection Check

Cross-Origin-Resource-Policy Header Check

Shopify Admin Access Restriction Check

Joomla Administrator Interface Access Check

Upload Folder Protection Check (.htaccess, index.html files)

PHP Error Display on Magento Check

PHP Error Display on WordPress Check

Database Administration Tools Access Check

PHP Error Display on PrestaShop Check

PHP Error Display in Production Check

Shopify Version Check

Joomla Temporary Folder (/tmp/) Access Check

Shopify SQL Injection Protection Check