Glossary · Security

Referrer-Policy

Referrer-Policy is a response header that controls how much of the originating page's URL browsers send in the Referer header.

Updated October 6, 2026

Referrer-Policy is an HTTP header that sets how much referrer information the browser sends in the Referer request header when a user follows a link or a page loads an image, script or API call. The header name is spelled correctly, while the request header it controls keeps the historic misspelling.

Why it matters

Full URLs can contain sensitive details such as search terms, document identifiers or tokens in query strings. Sending them to every third party leaks that data and helps tracking. A stricter policy limits what is shared while still giving analytics enough to work, for example only the origin.

Example

Referrer-Policy: strict-origin-when-cross-origin

On the same site the full path is sent. To another site, only the origin such as https://example.com/ is sent, and nothing is sent when moving from HTTPS to HTTP. Browsers commonly default to this value now. Other values include no-referrer and same-origin.

Common mistakes

  • Using no-referrer and then losing legitimate analytics or partner attribution.
  • Putting secrets in URLs and relying on the policy to hide them.
  • Setting unsafe-url, which sends full URLs everywhere.
  • Forgetting that link attributes can override the page policy.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Glossary · SecurityCORS Preflight RequestA CORS preflight is an automatic OPTIONS request a browser sends to check whether a cross-origin request is allowed before sending it.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · Web BasicsHow to Read HTTP Headers for Beginners (What Each Line Tells You)Learn to view and read HTTP response headers with a free tool or curl, and what status, server, cache, redirect and security headers mean for your website.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.