DevToolsmith

Referrer-Policy Header

The Referrer-Policy response header controls how much of the current URL is sent in the Referer header when users follow links or load resources.

Type
Response header
Category
Security
Defined in
Referrer Policy (W3C)

Syntax

Referrer-Policy: <policy>[, <fallback policy>]

How Referrer-Policy works

URLs can contain private data such as reset tokens or search terms. Browsers default to strict-origin-when-cross-origin: the full URL to your own site, only the origin to other sites, and nothing when going from HTTPS to HTTP. It can also be set per link with rel="noreferrer" or referrerpolicy.

Directives

Value Meaning
no-referrer Never send a Referer.
same-origin Full URL to your own origin, nothing elsewhere.
strict-origin Only the origin, and nothing on HTTPS→HTTP.
strict-origin-when-cross-origin The default: full URL same-origin, origin only cross-origin, nothing on downgrade.
no-referrer-when-downgrade The old default: full URL everywhere except HTTPS→HTTP.
unsafe-url Always the full URL, even to HTTP. Leaks paths and query strings.

Examples

Recommended
Referrer-Policy: strict-origin-when-cross-origin

Common mistakes

  • The request header is spelled Referer (a historical typo), the policy header Referrer-Policy.

Check it

curl -sI https://example.com | grep -i '^referrer-policy:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Origin: tells the server which origin (scheme, host and port) a request comes from.
  • Content-Security-Policy: restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
  • Permissions-Policy: turns browser features such as camera, microphone, geolocation and payment on or off for a page and its iframes.

More security headers

Strict-Transport-Security , X-Content-Type-Options , X-Frame-Options , Cross-Origin-Opener-Policy , Cross-Origin-Embedder-Policy , Cross-Origin-Resource-Policy .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Referrer-Policy header do?

The Referrer-Policy response header controls how much of the current URL is sent in the Referer header when users follow links or load resources. URLs can contain private data such as reset tokens or search terms. Browsers default to strict-origin-when-cross-origin: the full URL to your own site, only the origin to other sites, and nothing when going from HTTPS to HTTP. It can also be set per link with rel="noreferrer" or referrerpolicy.

How do I see the Referrer-Policy header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.