app.py

@@ -637,6 +637,11 @@ def require_system_password():
 def start_timer():
     request._start_time = time.time()
 
+@app.after_request
+def remove_default_referrer_policy(response):
+    if not app.config.get("REFERRER_POLICY"):
+        response.headers.pop("Referrer-Policy", None)
+    return response
 
 @app.after_request
 def log_request(response):