Skip to content

How to set a Referrer-Policy

Security1 min readFixes check referrer-policy

The referrer tells other sites which page a visitor came from — sometimes including private URLs. strict-origin-when-cross-origin is the safe default.

Step by step, with screenshots: Referrer-Policy: what leaks in the Referer header and how to stop it →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • Referrer-Policy header is setwarning · −1.5 ptseffort S

Referrer-Policy header is missing or too open

Why it matters. The referrer tells the next site which page of yours a visitor came from, including URL parameters such as search terms or tokens. A policy limits what leaves your site. Modern browsers already default to strict-origin-when-cross-origin; setting it explicitly covers older browsers and documents your choice.

How to fix it.
  1. Send the header: Referrer-Policy: strict-origin-when-cross-origin.
  2. Use no-referrer or same-origin if URLs on your site can carry anything private.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.