Referrer-Policy

Referrer-Policy is an HTTP response header that controls how much of the current page's URL the browser includes in the Referer header when navigating to another page or making a subresource request. Without a restrictive explicit policy, browsers may send referrer information to third-party servers — and under older browser defaults, could leak full URLs including query strings with tokens or personal identifiers.

What the Referer Header Leaks

When a user follows a link from https://example.com/account?token=abc123, the browser sends the full URL as the Referer header to the destination server. That destination server — a CDN, analytics provider, third-party embed, or attacker-controlled site — receives the full URL including any sensitive query parameters. Password reset links, session tokens, and search terms embedded in URLs are all at risk.

The same applies to subresource requests. An image or script loaded from a third-party domain receives a Referer header showing exactly which page of your site the user was on when the request was made.

The Directive Ladder

Directives range from most restrictive to most permissive:

• no-referrer — never send a Referer header under any circumstances.
• no-referrer-when-downgrade — send the full URL for same-protocol and protocol upgrades, but omit it when navigating from HTTPS to HTTP. This was the historical browser default before it was changed.
• same-origin — send the full URL only to same-origin destinations; send nothing cross-origin.
• origin — send only the origin (scheme + host + port), never the path or query string, to any destination.
• strict-origin — send only the origin, but suppress it entirely when navigating from HTTPS to HTTP.
• origin-when-cross-origin — send the full URL to same-origin destinations; send only the origin to cross-origin destinations.
• strict-origin-when-cross-origin — send the full URL same-origin, send only the origin cross-origin, and suppress entirely on HTTPS-to-HTTP downgrades. This is the current default in modern browsers.
• unsafe-url — always send the full URL, even from HTTPS to HTTP. Never use this.

The Modern Browser Default

Modern browsers default to strict-origin-when-cross-origin when no Referrer-Policy header is present. This means full URLs go to same-origin destinations (useful for server-side analytics), only the origin goes cross-origin (limiting third-party data exposure), and nothing is sent on HTTPS-to-HTTP downgrades. Setting an explicit header with this value is still recommended so the policy is declared rather than relied upon implicitly.

Downgrade Protection

The strict- prefix in directive names denotes downgrade protection: the browser will not send any referrer information when navigating from an HTTPS page to an HTTP page. This matters because HTTP is unencrypted, meaning any server or network observer along the path can read the Referer header. Sending a full HTTPS URL — possibly containing session data — over plaintext is a confidentiality failure.

Analytics Implications

Stricter policies affect what analytics systems can attribute. Under no-referrer, all external traffic arrives with no source information and is counted as direct. Under strict-origin-when-cross-origin, external referrers provide origin-level attribution (you know traffic came from example.com, not which specific page). If you rely on full referrer paths for campaign attribution, verify your analytics setup works with the policy you intend to deploy before switching.

Audit your Referrer-Policy with the headers tool →