devkult_
tools29converters34
home/headers/referrer-policy

Referrer-Policy

response headersecurity

Controls how much of the current URL is sent in the Referer header when users follow links or load resources.

When a page loads an image or a user follows a link, the browser can tell the destination where the request came from. Full URLs can leak private paths and query strings — reset tokens, search terms, internal ids. Referrer-Policy decides how much to share.

Syntax

Referrer-Policy: <policy>

Defined in W3C — Referrer Policy.

Values

no-referrernever send a Referer
originsend only the origin, never the path
same-originfull URL to your own origin; nothing to others
strict-originorigin only, and nothing on HTTPS → HTTP
strict-origin-when-cross-originfull URL same-origin, origin cross-origin, nothing on downgrade (the browser default)
no-referrer-when-downgradefull URL except on HTTPS → HTTP
unsafe-urlalways the full URL — leaks paths and queries

Examples

Referrer-Policy: strict-origin-when-cross-origin

the modern default, explicit

Referrer-Policy: no-referrer

share nothing

Referrer-Policy: same-origin

full URL internally, nothing to other sites

Good to know

  • Modern browsers already default to strict-origin-when-cross-origin, which suits most sites.
  • Keep secrets out of URLs regardless — they also end up in logs and browser history.
  • You can also set it per link: <a href="…" referrerpolicy="no-referrer">.

Further reading: Security headers checklist · Security headers generator

How to set Referrer-Policy

Express
res.set("Referrer-Policy", "strict-origin-when-cross-origin");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }],
      },
    ];
  },
};
nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Apache (.htaccess)
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Check it

Fetch only the response headers and filter for Referrer-Policy. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^referrer-policy:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why is the header 'Referer' but the policy 'Referrer'?

The original HTTP specification misspelled Referer and the misspelling stuck. The newer Referrer-Policy header uses the correct spelling.

Related headers