How to set a Referrer-Policy
The referrer tells other sites which page a visitor came from: sometimes including private URLs. strict-origin-when-cross-origin is the safe default.
Step by step, with screenshots: strict-origin-when-cross-origin: Referrer-Policy and Permissions-Policy →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Security headers checker.
What it is
Referrer-Policy is a response header that controls how much of a page's address the browser passes on, in the Referer header, when a visitor follows a link or the page loads something from another site. Without limits, the full URL can leave your site, including paths and query strings with search terms, order numbers or reset tokens.
Modern browsers already default to strict-origin-when-cross-origin: the full URL for requests within your site, only the domain for other HTTPS sites, and nothing when going from HTTPS to HTTP. getReport flags a missing header or an open value such as unsafe-url or no-referrer-when-downgrade. Referrer-Policy: strict-origin-when-cross-origin, or a stricter value, is OK and documents your choice for older browsers.
What a passing site looks like
- Referrer-Policy header is setwarning · −1.5 ptseffort S
Referrer-Policy header is missing or too open
Why it matters. The referrer tells the next site which page of yours a visitor came from, including URL parameters such as search terms or tokens. A policy limits what leaves your site. Modern browsers already default to strict-origin-when-cross-origin; setting it explicitly covers older browsers and documents your choice.
- Send the header: Referrer-Policy: strict-origin-when-cross-origin.
- Use no-referrer or same-origin if URLs on your site can carry anything private.
Questions people ask
What does strict-origin-when-cross-origin mean?
It is a Referrer-Policy value that sends the full URL with requests to your own site, only the origin, such as https://example.com/, to other sites over HTTPS, and no referrer at all when a link leads from HTTPS to HTTP. It keeps analytics working, since other sites still see which domain sent the visit, while hiding paths and query strings.
What is the recommended Referrer-Policy?
strict-origin-when-cross-origin suits most sites, as it balances privacy with working analytics and affiliate attribution. Use same-origin or no-referrer for pages whose URLs carry private data, such as account areas or password reset links. Avoid unsafe-url, which sends the full address everywhere, including to plain HTTP sites.
Is strict-origin-when-cross-origin causing my request to fail?
Almost never. Chrome DevTools shows the referrer policy next to every request, so it appears beside failed ones too, but a 403 or CORS error usually has another cause. It matters only when a server checks the Referer for a full path, such as some hotlink protection or payment callbacks; then set a less strict policy for that page or link.
What does "missing Referrer-Policy header" mean?
It is a scanner finding that your responses do not send a Referrer-Policy header. Current browsers still apply their own safe default, so the practical risk is small, but older browsers may send full URLs to other sites. Adding Referrer-Policy: strict-origin-when-cross-origin at the web server or CDN resolves it and makes the behaviour the same everywhere.