# Security: "\_\_Host-Prefix", how to fix? **URL:** \ **Category:** ℹ️ Support\ **Created:** [April 27, 2018, 2:31am UTC](https://help.nextcloud.com/t/security-host-prefix-how-to-fix/30956 "2018-04-27T02:31:27Z")\ **Posts on this page:** 1\ **Showing post:** 20
**Author:** ![citlee](https://help.nextcloud.com/letter_avatar/citlee/32/6_22734026db12803ebb3e059622ac3534.png) [@citlee](https://help.nextcloud.com/u/citlee)\ **Post date:** [November 19, 2019, 9:09pm UTC](https://help.nextcloud.com/t/security-host-prefix-how-to-fix/30956/20 "2019-11-19T21:09:03Z")
> [@Kresimir\_Sutalo](#): > > After setting my Referrer Policy to: > Header always set Referrer-Policy “no-referrer” > and running the scan again, I got the A+ rating and the \_\_Host-Prefix issue was cleared. Thanks! This is almost what I was looking for to resolve the `__Host-Prefix` complaint in the security scanner. The [solution](https://www.blackhillsinfosec.com/fix-missing-referrer-policy-website/) for me was as described in that article, adding `Header set Referrer-Policy "no-referrer-when-downgrade"` to the Apache config file for the Nextcloud virtualhost. My Nextcloud install has always been [as described here](https://help.nextcloud.com/t/security---host-prefix-cookie-setting/9740/5), but was failing the \_\_Host-Prefix check. I don’t understand why - looking at the cookies in the Firefox console, with or without the above change, I’m sent cookies with ` __Host-nc_sameSiteCookielax` and `__ Host-nc_sameSiteCookiestrict` with `domain` set to `mycloud.example.com` and `path` set to `/`. Also with that change, now I am sending two sets of `Referrer-Policy` headers in the same request, first `no-referrer` then `no-referrer-when-downgrade` (and just `no-referrer` without the line in the config file). Wish I understood why this worked and what’s actually changing! --- _[View the full topic](https://help.nextcloud.com/t/security-host-prefix-how-to-fix/30956)._