The HTTP 1.1 protocol specification warns the source of a link [URI] might be private information or might reveal an otherwise private information source and advises that “[c]lients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.”8 In simpler terms, Web pages that include third-party elements, but do not use secure HTTP requests, risk leaking sensitive data via the Referer field. Of the pages analyzed, only 3.24% used secure HTTP, the rest used non-encrypted HTTP connections and thereby potentially transmitted sensitive information to third parties. Unsurprisingly, a significant amount of