# Referrer-Policy Header — Syntax, Values & Examples

> Controls how much of the current URL is sent in the Referer header when users follow links or load resources.

When a page loads an image or a user follows a link, the browser can tell the destination where the request came from. Full URLs can leak private paths and query strings — reset tokens, search terms, internal ids. Referrer-Policy decides how much to share.

- Type: Response header
- Category: Security
- Defined in: [W3C — Referrer Policy](https://www.w3.org/TR/referrer-policy/)

## Syntax

```http
Referrer-Policy: <policy>
```

## Values

| Value | Meaning |
|---|---|
| `no-referrer` | never send a Referer |
| `origin` | send only the origin, never the path |
| `same-origin` | full URL to your own origin; nothing to others |
| `strict-origin` | origin only, and nothing on HTTPS → HTTP |
| `strict-origin-when-cross-origin` | full URL same-origin, origin cross-origin, nothing on downgrade (the browser default) |
| `no-referrer-when-downgrade` | full URL except on HTTPS → HTTP |
| `unsafe-url` | always the full URL — leaks paths and queries |

## Examples

```http
Referrer-Policy: strict-origin-when-cross-origin
```

the modern default, explicit

```http
Referrer-Policy: no-referrer
```

share nothing

```http
Referrer-Policy: same-origin
```

full URL internally, nothing to other sites

## Good to know

- Modern browsers already default to `strict-origin-when-cross-origin`, which suits most sites.
- Keep secrets out of URLs regardless — they also end up in logs and browser history.
- You can also set it per link: `<a href="…" referrerpolicy="no-referrer">`.

## How to set Referrer-Policy

### Express

```
res.set("Referrer-Policy", "strict-origin-when-cross-origin");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }],
      },
    ];
  },
};
```

### nginx

```
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

### Apache (.htaccess)

```
Header always set Referrer-Policy "strict-origin-when-cross-origin"
```

## Check it

Fetch only the response headers and filter for Referrer-Policy. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^referrer-policy:'
```

## FAQ

### Why is the header 'Referer' but the policy 'Referrer'?

The original HTTP specification misspelled Referer and the misspelling stuck. The newer Referrer-Policy header uses the correct spelling.

## Related headers

- [Referer](https://www.devkult.com/headers/referer.md): The address of the page that linked to or loaded the requested resource.
- [Permissions-Policy](https://www.devkult.com/headers/permissions-policy.md): Turns browser features such as the camera, microphone and geolocation on or off for a page and its iframes.
- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.

## Further reading

- [Security headers checklist](https://www.devkult.com/blog/security-headers-checklist.md)
- [Security headers generator](https://www.devkult.com/tools/security/security-headers-generator.md)

Open the interactive page: https://www.devkult.com/headers/referrer-policy