Referrer-Policy in Drupal konfigurieren

# seckit: /admin/config/system/seckit → Tab "Various"
# Referrer-Policy Dropdown:
Auswahl: strict-origin-when-cross-origin

# Speichern → drush cr

<?php
// modules/custom/security_headers/src/EventSubscriber/ReferrerPolicySubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class ReferrerPolicySubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();
    $response->headers->set('Referrer-Policy',
      'strict-origin-when-cross-origin');
  }
}

# .htaccess — Referrer-Policy
<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>