Referrer-Policy Header: Control What URLs You Leak
Referrer-Policy controls how much of the current URL is sent in the Referer header on navigations and requests. Learn practical values and privacy trade-offs.
The Referrer-Policy header tells browsers how much of the current page URL to include in the Referer header (note the spelling) when users navigate away or when the page makes subresource requests. Without a policy, sensitive path segments or query tokens can leak to third-party hosts.
This guide covers the values teams actually ship, a safe default for most product sites, and how to verify the header with a security scan.
Practical policy values
- `no-referrer` - never send a referrer; breaks some analytics that rely on it.
- `same-origin` - send full referrer only to same-origin requests.
- `strict-origin` - send only the origin cross-origin, and only over HTTPS to HTTPS.
- `strict-origin-when-cross-origin` - full URL same-origin; origin-only on cross-origin HTTPS; strip on downgrade. A strong default for many sites.
- `no-referrer-when-downgrade` - legacy default behaviour in older browsers; weaker privacy.
Referrer-Policy: strict-origin-when-cross-origin
Why query strings matter
Password-reset links, invite tokens, and search queries sometimes appear in URLs. If a user clicks from that page to an external site, a loose referrer policy can forward those secrets. Prefer policies that strip paths on cross-origin navigations, and avoid putting secrets in URLs whenever you can.
Individual links may set rel="noreferrer" or a referrerpolicy attribute. Use the response header as the site-wide baseline, then tighten exceptional links.
Analytics and affiliate trade-offs
Some partners expect a full referrer path. If you must support them, isolate those exit links rather than weakening the global header. Document the exception so a future security pass does not "fix" it without notice.
Verification steps
- 1Confirm
Referrer-Policyon HTML document responses. - 2Click an external link and inspect the outbound
Refererin DevTools. - 3Re-check after adding a CDN or edge worker that might inject a different policy.
- 4Grade headers with PatchPings features or a free scan.
Referrer-Policy is one of the simplest privacy headers to deploy. Set strict-origin-when-cross-origin unless you have a documented reason not to, and keep it alongside Permissions-Policy and COOP in your baseline hardening set.
