# Referer Header — Syntax, Values & Examples

> The address of the page that linked to or loaded the requested resource.

When you follow a link or a page loads an image, the browser can tell the destination where the request came from. How much of the URL it shares is set by `Referrer-Policy`; with the default policy, other sites see only your origin, and HTTPS pages share nothing with HTTP ones.

- Type: Request header
- Category: Routing & context
- Defined in: [RFC 9110 §10.1.3 — Referer](https://www.rfc-editor.org/rfc/rfc9110.html#section-10.1.3)

## Syntax

```http
Referer: <url>
```

## Examples

```http
Referer: https://www.example.com/
```

a cross-origin request under the default policy: origin only

```http
Referer: https://www.example.com/blog/post?id=7
```

a same-origin request: the full URL

## Good to know

- It's spelled 'Referer' — a typo in the original HTTP specification, kept for compatibility.
- It can be missing (privacy settings, policies, direct visits) or forged by non-browser clients, so don't rely on it for access control.
- Analytics tools read it to attribute traffic sources.

## Who sets Referer

Browsers set Referer according to the page's Referrer-Policy — configure that header, or `referrerpolicy` on individual links, rather than Referer itself. curl sends one with `-e`: `curl -e https://www.example.com/ https://example.org/`.

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### Why is Referer empty in my logs?

The visitor came directly, the linking page used Referrer-Policy: no-referrer, the link had rel="noreferrer", or the request went from HTTPS to HTTP.

## Related headers

- [Referrer-Policy](https://www.devkult.com/headers/referrer-policy.md): Controls how much of the current URL is sent in the Referer header when users follow links or load resources.
- [Origin](https://www.devkult.com/headers/origin.md): Sent by browsers to say which origin — scheme, host and port — a request comes from.
- [User-Agent](https://www.devkult.com/headers/user-agent.md): Identifies the client software making the request — browser, bot, library or command-line tool.

Open the interactive page: https://www.devkult.com/headers/referer