What the Referrer-Policy does

How it works

When a visitor follows a link, or your page loads an image, script or video from another server, the browser sends the referrer along: the address of the page the request comes from. Addresses often contain more than the page name, such as ?search=…, an order number or a token from a password reset link.

With the Referrer-Policy header you decide what goes along. The main values:

• strict-origin-when-cross-origin: the full address within your site, only the domain to other sites, nothing when moving from HTTPS to HTTP.
• same-origin: the full address within your site, nothing to other sites.
• strict-origin and origin: only ever the domain.
• no-referrer: never anything.
• no-referrer-when-downgrade and unsafe-url: the full address, to other sites too.

What matters

• Never the full address to other sites. unsafe-url and no-referrer-when-downgrade give it away and should not be used.
• Set the header yourself. Without it, current browsers usually behave like strict-origin-when-cross-origin already; older ones send the full address. The header fixes the behaviour for all of them.
• Valid values. The browser ignores an unknown value, and the header then has no effect. If the header holds a list, the last value the browser knows applies.
• Analytics still work. With strict-origin-when-cross-origin, linked sites and analytics tools still see which domain visitors come from, just not the exact page.

How to set it up

The recommended header:

Referrer-Policy: strict-origin-when-cross-origin

If other sites don't even need your domain, use same-origin or no-referrer. The header is set in the web server, the application or through a header rule at your hosting provider or CDN.

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Many CMS security plugins offer the setting as well.