Referrer-Policy
SecurityActiveReferrer-Policy controls how much referrer information is included in the Referer request header when following links or loading resources. The default browser behavior sends the full URL as a referrer, which can leak sensitive path segments and query parameters to third parties.
Description
When a user navigates from one page to another, the browser sends the originating URL in the Referer header. Without a Referrer-Policy, this exposes full URLs including query parameters – leaking session tokens, user IDs, search terms, and other sensitive data to analytics scripts, CDNs, and linked sites. strict-origin-when-cross-origin is the recommended default: it sends the full URL for same-origin requests, only the origin for cross-origin requests, and nothing when navigating from HTTPS to HTTP. The no-referrer value suppresses the Referer header entirely. The policy can be set at the HTTP response header level, via <meta name="referrer"> in HTML, or per-link with the referrerpolicy attribute.
Directives
| Directive | Description |
|---|---|
| no-referrer | Never send a Referer header. Maximum privacy. |
| no-referrer-when-downgrade | Send full URL to HTTPS origins; nothing to HTTP. Browser default before this header was standardized. |
| origin | Send only the origin (scheme + host + port), never the path or query. |
| origin-when-cross-origin | Full URL for same-origin requests; only origin for cross-origin. |
| same-origin | Send full URL for same-origin requests; nothing for cross-origin. |
| strict-origin | Send only origin for same-origin and HTTPS cross-origin; nothing for HTTP. |
| strict-origin-when-cross-origin | Recommended default. Full URL same-origin; origin cross-origin HTTPS; nothing cross-origin HTTP. |
| unsafe-url | Always send full URL including path and query. Never use this – leaks sensitive URL parameters. |
Examples
Referrer-Policy: strict-origin-when-cross-originReferrer-Policy: no-referrerReferrer-Policy: same-origin<a href="https://external.example" referrerpolicy="no-referrer">Link</a>