Thanks for your answer. It made me think about what I should have done from the start. Check all plugins one by one and after finding the culprit, checking all the code that is in there.
Where things go wrong is here:
In the action hook send_headers I do:
$rp = 'origin';
header("Referrer-Policy: " . $rp );
This is causing the problems.
If I specify ‘no-referrer’ things are alright. Leaving this header out altogether is also OK.
The only problem I now have is why this is working out as it does. Anybody here that knows why?
For now I’ll see what other options are there that fit what I want and that work out nicely while deleting posts.
Thanks so far.
]]>It does leave me with the uneasy feeling that things go wrong in certain conditions, and I don’t know why.
So, if someone knows more about this, feel free to post it here. If nothing new comes up in the coming days, I’ll close this thread.
Thanks @tobifjellner!
]]>As I understand https://web.dev/same-site-same-origin/#origin the “origin” parameter means that the referrer field from the browser will ONLY include the base URL of your site. So when this action is received and handled, if the handler forwards to whatever URL was in the “referer” field, then you’ll end up on the public side of your site.
]]>Thanks!
??
]]>