Referer
request headerrouting & context
The address of the page that linked to or loaded the requested resource.
When you follow a link or a page loads an image, the browser can tell the destination where the request came from. How much of the URL it shares is set by Referrer-Policy; with the default policy, other sites see only your origin, and HTTPS pages share nothing with HTTP ones.
Syntax
Referer: <url>
Defined in RFC 9110 §10.1.3 — Referer.
Examples
Referer: https://www.example.com/
a cross-origin request under the default policy: origin only
Referer: https://www.example.com/blog/post?id=7
a same-origin request: the full URL
Good to know
- It's spelled 'Referer' — a typo in the original HTTP specification, kept for compatibility.
- It can be missing (privacy settings, policies, direct visits) or forged by non-browser clients, so don't rely on it for access control.
- Analytics tools read it to attribute traffic sources.
Who sets Referer
Browsers set Referer according to the page's Referrer-Policy — configure that header, or referrerpolicy on individual links, rather than Referer itself. curl sends one with -e: curl -e https://www.example.com/ https://example.org/.
Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
Why is Referer empty in my logs?
The visitor came directly, the linking page used Referrer-Policy: no-referrer, the link had rel="noreferrer", or the request went from HTTPS to HTTP.