# How to set a Referrer-Policy

> The referrer tells other sites which page a visitor came from — sometimes including private URLs. strict-origin-when-cross-origin is the safe default.

Security · HTML version: https://getreport.app/learn/referrer-policy

## Referrer-Policy header

Passing looks like: Referrer-Policy header is set.

**Why it matters.** The referrer tells the next site which page of yours a visitor came from, including URL parameters such as search terms or tokens. A policy limits what leaves your site. Modern browsers already default to strict-origin-when-cross-origin; setting it explicitly covers older browsers and documents your choice.

**How to fix it.**

1. Send the header: Referrer-Policy: strict-origin-when-cross-origin.
2. Use no-referrer or same-origin if URLs on your site can carry anything private.

Check your own page: https://getreport.app/