# Cis Apache24 5.17

> Ensure HTTP Header Referrer-Policy is set appropriately

- Skill: `cyberstrikeus/cis-apache24-5-17` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-apache24-5-17`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-apache24-5-17/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-apache24-5-17

---


# Ensure HTTP Header Referrer-Policy is set appropriately (Manual)

## Profile Applicability

Level 2

## Description

The server now allows for controlling the amount of "referrer" information being sent with requests. Limiting information to only what is needed is security best practice.

## Rationale

HTTP/S traffic is vulnerabe to attack - limiting what is sent in a request to only what is needed will limit the threat vector.

## Impact

You must only limit the header information to what is needed to support the request. Limiting it to much may disrupt the ability to get a proper/expected response.

## Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

- Ensure a Header directive for Referrer-Policy is present in the Apache configuration and has the condition Header Set 'Referrer-Policy' shown below:
  ```
  # grep -I Referrer-Policy $APACHE_PREFIX/conf/httpd.conf
  ```
  ```
  Header set Referrer-Policy "<Directive>"
  ```

If header Referrer-Policy configuration is present and has as a compliant value, then the server is compliant.

## Remediation

Perform the following to implement the recommended state:

Add or modify the Header directive for the Referrer-Policy header in the Apache configuration to have the appropriate condition as shown below.

```
Header set Referrer-Policy "<Directive>"
```

## Default Value

Referrer-Policy Policy is not set by Default

## References

1. https://httpd.apache.org/docs/2.4/mod/mod_headers.html#header
2. https://owasp.org/www-project-cheat-sheets/cheatsheets/Content_Security_Policy_Cheat_Sheet
3. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
4. https://en.wikipedia.org/wiki/Clickjacking

## CIS Controls

**v8:**

- 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
  - Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and add-on applications.

- 13.10 Perform Application Layer Filtering
  - Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.

**v7:**

- 9.4 Apply Host-based Firewalls or Port Filtering
  - Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.

- 18.2 Ensure Explicit Error Checking is Performed for All In-house Developed Software
  - For in-house developed software, ensure that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats.