diff --git a/src/middleware/headers.js b/src/middleware/headers.js
index 035608eab6..d63f163d7c 100644
--- a/src/middleware/headers.js
+++ b/src/middleware/headers.js
@@ -11,6 +11,7 @@ module.exports = function (middleware) {
 			'X-Frame-Options': meta.config['allow-from-uri'] ? 'ALLOW-FROM ' + encodeURI(meta.config['allow-from-uri']) : 'SAMEORIGIN',
 			'Access-Control-Allow-Methods': encodeURI(meta.config['access-control-allow-methods'] || ''),
 			'Access-Control-Allow-Headers': encodeURI(meta.config['access-control-allow-headers'] || ''),
+			'Referrer-Policy': 'strict-origin-when-cross-origin',	// consider using helmet?
 		};
 
 		if (meta.config['access-control-allow-origin']) {