Evidence review
What to inspect before changing anything
Start with the delivered website and the real user journey. Record the current state so the team can distinguish an observed problem from an assumption and compare the same surface after deployment.
- 01Inspect the Referrer-Policy response header
- 02Identify URLs that may contain sensitive parameters
- 03Review analytics and partner attribution requirements
Implementation
A practical improvement plan
Make the smallest coherent change that solves the observed problem. Keep normal code review, accessibility, security and product checks in the loop instead of optimizing for the scan alone.
- 01Prefer a modern restrictive default
- 02Move secrets and personal data out of URLs
- 03Set tighter policies on especially sensitive pages when needed
Verification
How to verify the result
Verification should test the intended outcome and the most likely regression. Use the production delivery path whenever headers, caching, rendering or third-party services affect the result.
- 01Follow links across same-site and cross-site boundaries
- 02Inspect outgoing Referer values in developer tools
- 03Confirm analytics still receives intended attribution
Common pitfall
A shortcut to avoid
Choosing a policy only for privacy optics can remove business-critical attribution while leaving sensitive data in URLs.
Further reading
Primary guidance and references
These sources provide standards, security guidance or the interpretation framework used to keep this guide bounded. Product-specific implementation still requires review in the actual codebase.