Sensitive data in URLs

Why it matters

Tokens or emails in URLs end up in logs, analytics and Referer headers.

How to fix it

Send sensitive values in POST bodies or headers instead of query strings.

How we test it

Passive — runs in the free check, looks only at what a browser can see.