diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf7abc58779e..6a19c1fb50f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+# 1.8
+* SECURITY: improve referrer policy so that Etherpad addresses aren't leaked when links are clicked (see https://github.com/ether/etherpad-lite/pull/3636)
+
 # 1.8-beta.1
 * FEATURE: code was migrated to `async`/`await`, getting rid of a lot of callbacks (see https://github.com/ether/etherpad-lite/issues/3540)
 * FEATURE: support configuration via environment variables
diff --git a/src/node/hooks/express.js b/src/node/hooks/express.js
index 702214ec85aa..6394ffbfc15f 100644
--- a/src/node/hooks/express.js
+++ b/src/node/hooks/express.js
@@ -76,6 +76,15 @@ exports.restartServer = function () {
     // https://github.com/ether/etherpad-lite/issues/2547
     res.header("X-UA-Compatible", "IE=Edge,chrome=1");
 
+    // Enable a strong referrer policy. Same-origin won't drop Referers when
+    // loading local resources, but it will drop them when loading foreign resources.
+    // It's still a last bastion of referrer security. External URLs should be
+    // already marked with rel="noreferer" and user-generated content pages are already
+    // marked with <meta name="referrer" content="no-referrer">
+    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+    // https://github.com/ether/etherpad-lite/pull/3636
+    res.header("Referrer-Policy", "same-origin");
+
     // send git version in the Server response header if exposeVersion is true.
     if (settings.exposeVersion) {
       res.header("Server", serverName);
diff --git a/src/node/utils/ExportHtml.js b/src/node/utils/ExportHtml.js
index 086ec89e9eec..aa7b0abcc4c1 100644
--- a/src/node/utils/ExportHtml.js
+++ b/src/node/utils/ExportHtml.js
@@ -287,8 +287,12 @@ function getHTMLFromAtext(pad, atext, authorColors)
         processNextChars(startIndex - idx);
         // Using rel="noreferrer" stops leaking the URL/location of the exported HTML when clicking links in the document.
         // Not all browsers understand this attribute, but it's part of the HTML5 standard.
-        // http://www.w3.org/TR/html5/links.html#link-type-noreferrer
-        assem.append('<a href="' + Security.escapeHTMLAttribute(url) + '" rel="noreferrer">');
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
+        // Additionally, we do rel="noopener" to ensure a higher level of referrer security.
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
+        // https://mathiasbynens.github.io/rel-noopener/
+        // https://github.com/ether/etherpad-lite/pull/3636
+        assem.append('<a href="' + Security.escapeHTMLAttribute(url) + '" rel="noreferrer noopener">');
         processNextChars(urlLength);
         assem.append('</a>');
       });
diff --git a/src/static/js/domline.js b/src/static/js/domline.js
index 7904029bddd8..0ae46b29946d 100644
--- a/src/static/js/domline.js
+++ b/src/static/js/domline.js
@@ -200,8 +200,12 @@ domline.createDomLine = function(nonEmpty, doesWrap, optBrowser, optDocument)
         }
         // Using rel="noreferrer" stops leaking the URL/location of the pad when clicking links in the document.
         // Not all browsers understand this attribute, but it's part of the HTML5 standard.
-        // http://www.w3.org/TR/html5/links.html#link-type-noreferrer
-        extraOpenTags = extraOpenTags + '<a href="' + Security.escapeHTMLAttribute(href) + '" rel="noreferrer">';
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
+        // Additionally, we do rel="noopener" to ensure a higher level of referrer security.
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
+        // https://mathiasbynens.github.io/rel-noopener/
+        // https://github.com/ether/etherpad-lite/pull/3636
+        extraOpenTags = extraOpenTags + '<a href="' + Security.escapeHTMLAttribute(href) + '" rel="noreferrer noopener">';
         extraCloseTags = '</a>' + extraCloseTags;
       }
       if (simpleTags)
diff --git a/src/static/js/pad_utils.js b/src/static/js/pad_utils.js
index 855dd82b12b1..d42cbb022425 100644
--- a/src/static/js/pad_utils.js
+++ b/src/static/js/pad_utils.js
@@ -225,8 +225,12 @@ var padutils = {
         advanceTo(startIndex);
         // Using rel="noreferrer" stops leaking the URL/location of the pad when clicking links in the document.
         // Not all browsers understand this attribute, but it's part of the HTML5 standard.
-        // http://www.w3.org/TR/html5/links.html#link-type-noreferrer
-        pieces.push('<a ', (target ? 'target="' + Security.escapeHTMLAttribute(target) + '" ' : ''), 'href="', Security.escapeHTMLAttribute(href), '" rel="noreferrer">');
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
+        // Additionally, we do rel="noopener" to ensure a higher level of referrer security.
+        // https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
+        // https://mathiasbynens.github.io/rel-noopener/
+        // https://github.com/ether/etherpad-lite/pull/3636
+        pieces.push('<a ', (target ? 'target="' + Security.escapeHTMLAttribute(target) + '" ' : ''), 'href="', Security.escapeHTMLAttribute(href), '" rel="noreferrer noopener">');
         advanceTo(startIndex + href.length);
         pieces.push('</a>');
       }