Referrer-Policy
Controls how much of your page's URL is leaked to the next site when a user clicks an outbound link.
What it does
When a user follows a link from your site to another, the browser normally sends your page's full URL in the Referer request header (note the header itself is spelled with a historic typo). Referrer-Policy lets you dial back how much of that URL is shared: the full URL, just the origin, or nothing at all.
Why it matters
URLs often contain more than you'd want a third party to see: search terms, session identifiers in query strings, internal page paths, or account details embedded in the path. A loose referrer policy leaks that data to every external link, image, and script your page loads, including analytics and ad scripts on the destination site.
Recommended value
This is the current browser default and a solid balance: it sends the full URL for same-origin requests (useful for your own analytics), but only the origin (e.g. https://example.com, no path) when navigating to a different site, and nothing at all when downgrading from HTTPS to HTTP.
For pages with especially sensitive URLs, consider the stricter no-referrer, which sends nothing under any circumstance.