Referrer-Policy
Send `Referrer-Policy: strict-origin-when-cross-origin` — full URL within your own site, origin only to others, nothing when downgrading to HTTP.
Send this header. There is no meaningful downside for a typical site.
What it does
Every time a browser follows a link or loads a resource it may send a `Referer` header naming the page the request came from. When that page is `https://app.example.com/invoices/8842?token=abc`, the destination now has your internal URL structure, a customer identifier and possibly a credential — sent to an analytics pixel, an embedded font, or whatever the user clicked through to.
Referrer-Policy decides how much of that URL travels. The useful middle ground is `strict-origin-when-cross-origin`: your own pages receive the full URL, which is what analytics and internal attribution need, while anyone else receives only `https://app.example.com`, and a request downgrading to HTTP receives nothing at all.
Current browsers already default to exactly that, which is a genuine improvement over the old `no-referrer-when-downgrade` behaviour. Setting it explicitly still matters: it removes the dependency on browser version, it documents the decision, and it stops a framework or CDN further down the chain quietly choosing something looser.
The subtlety worth internalising is that the policy applies to subresource loads, not only to links a user clicks. Every font, script, image, stylesheet and analytics beacon your page loads from another origin carries a referrer too, and those requests happen on every page view rather than only when someone navigates away. A site with no outbound links at all can still be leaking its URL structure to half a dozen third parties on every request, which is why a sitewide header beats a per-page one.
What to send
Referrer-Policy: strict-origin-when-cross-originIt keeps same-origin analytics working while denying third parties your path and query string, and it fails closed on protocol downgrade. Choose `no-referrer` instead if the origin itself is sensitive — a support or admin hostname can be worth withholding — and avoid `unsafe-url`, which sends the full URL to everyone including over plain HTTP.
Directives and values
Never send the header. Maximum privacy; breaks any analytics or CSRF check that reads it.
Always send only the scheme, host and port — never the path or query. Consistent, but sends the origin even on downgrade to HTTP.
Full URL to your own origin, nothing at all to anyone else.
Origin only, and nothing when the request downgrades from HTTPS to HTTP.
Full URL same-origin, origin only cross-origin, nothing on downgrade. The current browser default and the recommended explicit value.
Full URL everywhere except on downgrade. The old browser default — it hands your full path and query to every third party you link to or embed.
Full URL to everyone, always, including over plain HTTP. Named for what it is; there is essentially no case where it is the right answer.
Common mistakes
- Leaving it unset and assuming the browser default is safe. It is, in current browsers. It was not in older ones, and it is not guaranteed in embedded webviews or a proxy that rewrites headers. An explicit value is one line and removes the question.
- Putting tokens in query strings and relying on this header. Referrer-Policy narrows one leak path. A session or reset token in a URL still ends up in server logs, browser history, and any bookmark or shared link. Move it to a header or a POST body.
- Using no-referrer sitewide without checking what reads it. Some payment providers, embedded widgets and legacy CSRF defences validate the referrer. `no-referrer` is the strongest value and occasionally the one that breaks checkout.
- Setting it per-page and forgetting subresources. The policy applies to resource loads as well as navigations, so images, fonts and scripts on third-party origins are also carriers. A sitewide header covers them; a `<meta>` tag partway down the document may not.
Browser support
All values are supported across current browsers. Older clients that do not recognise a value fall back to their default, which is why a policy list such as `no-referrer, strict-origin-when-cross-origin` is sometimes sent — browsers take the last value they understand.
Frequently asked questions
What is the best Referrer-Policy value?
`strict-origin-when-cross-origin` for most sites. It preserves full-URL referrers within your own origin for analytics, sends only the origin to third parties, and sends nothing when a request downgrades to HTTP. Use `no-referrer` where even the hostname is sensitive.
What is the default Referrer-Policy if I set nothing?
Current browsers default to `strict-origin-when-cross-origin`. Older browsers used `no-referrer-when-downgrade`, which sends the full URL including path and query to every third-party origin. Setting the value explicitly removes the dependency on browser version.
Does Referrer-Policy affect analytics?
Same-origin analytics are unaffected by `strict-origin-when-cross-origin`, since your own pages still receive the full URL. Third-party analytics will see only your origin rather than the full page URL, which is usually the intended outcome — if a vendor needs more, that is a decision to make deliberately.
Why is unsafe-url dangerous?
It sends the complete URL — path, query string and all — to every destination, including over unencrypted HTTP. Any identifier or token in a URL is then exposed to third parties and to anyone on the network path.
The free Security Headers Checker reads Referrer-Policy from a live response and grades it alongside every other header on this reference — no account needed.
For the longer treatment, read Advanced HTTP Security Headers: A Deep Dive in the Learning Center.
Related headers
Declares which browser features your page and its frames may use. Syntax changed from Feature-Policy; most copy-pasted examples are wrong.
Forces HTTPS for a fixed period. The one header where a careless value can take a domain offline for months.
Severs the link between your page and windows that opened it. Required for cross-origin isolation — and it breaks popup flows.