Why it matters
When a visitor clicks an outside link, the other site can see the exact URL they came from, including any IDs or tokens in it. A referrer policy trims that down.
How to check it yourself
Look for referrer-policy in your page's Response Headers, or a meta tag named referrer in the source. Without one, outside sites your visitors click through to can see the full address they came from.
What the fix involves
Send Referrer-Policy: strict-origin-when-cross-origin. Other sites then see only your domain, not the path or any IDs in the URL.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.