ERT-CONFIG-005
Missing Referrer-Policy
LowA02:2025CWE-200
Why it matters
Security headers, TLS, email spoofing, takeovers. This check looks specifically for: missing referrer-policy.
How to fix it
Send Referrer-Policy: strict-origin-when-cross-origin.
How we test it
Passive — runs in the free check, looks only at what a browser can see.