When visiting https://plausible.io/plausible.io/sources, favicons are fetched from https://icons.duckduckgo.com, and the current page URL is sent to their servers in the Referer header, which could be undesirable when Plausible is self-hosted.
The issue can be solved by setting the referrerpolicy attribute for image elements that point to other origins.
<img referrerpolicy="no-referrer" src="https://icons.duckduckgo.com/ip3/news.ycombinator.com.ico">
When visiting https://plausible.io/plausible.io/sources, favicons are fetched from https://icons.duckduckgo.com, and the current page URL is sent to their servers in the
Refererheader, which could be undesirable when Plausible is self-hosted.The issue can be solved by setting the referrerpolicy attribute for image elements that point to other origins.