What this Referrer-Policy checker tests
Every time a visitor follows a link off your site, the browser can attach a Referer header that tells the destination which page the visitor came from. By default that header can include the full URL, not just the domain. The Referrer-Policy header is how a site decides how much of that URL gets shared, and this checker fetches the live response from the URL you enter so you can see the exact policy a site sends.
The risk is real because URLs are not always harmless. Plenty of sites put sensitive values in the query string, things like password reset tokens, magic login links, search terms, or account identifiers. With a leaky policy, all of that travels to whatever site the visitor clicks through to, and to the third party scripts and ad networks loaded on the page they land on. The worst offender is unsafe-url, which sends the complete URL including path and query to every destination, even when moving from HTTPS to HTTP.
The recommended policy and how to set it
For almost every site the right value is strict-origin-when-cross-origin. It keeps the full URL for navigations within your own origin, so your analytics still work, but it strips the path and query down to just the origin when a request crosses to another site, and it sends nothing at all on an HTTPS to HTTP downgrade. That balance protects sensitive URLs without breaking same origin tooling.
Setting it takes one header. In Nginx, add add_header Referrer-Policy "strict-origin-when-cross-origin" always; to your server block. In Apache, use Header set Referrer-Policy "strict-origin-when-cross-origin". To go deeper on how each policy value behaves, read the Referrer Policy guide.