Home / Knowledge hub / Referrer-Policy
Knowledge hub
Referrer-Policy
A header controlling how much of your page address is sent to other sites.
What it means
When a browser follows a link or loads an image from another site, it can send a Referer header saying where the visitor came from. Referrer-Policy is the response header that decides how much of that address is included: the full URL, only the origin, or nothing at all.
The common safe choices are strict-origin-when-cross-origin, which is the default in current browsers, and no-referrer. The strictest value shares nothing at all.
Why it matters
URLs often carry things that should stay private: reset tokens, invite codes, search terms, document ids, account numbers. If a page links to or loads anything from another site, the full address can travel with the request and end up in someone else's logs.
That is a quiet data leak with no attacker needed. It is also an old cause of account takeover, where a password-reset link is opened and then a click on a third-party link sends the token away. Weak handling can feed account takeover.
How it shows up
You meet it as a response header or a meta tag, and per link through rel="noreferrer". It matters on any page whose address contains a secret, and on pages with third-party scripts, ads, analytics or embedded widgets.
The mistakes repeat. Relying on the browser default for pages with tokens in the URL. Setting unsafe-url to fix an analytics report. Putting sensitive data in query strings at all, which is the real problem. Move secrets out of URLs, then set the policy. See also security headers.
Questions people ask
Referrer-Policy, answered
What is the best Referrer-Policy value?
For most sites, strict-origin-when-cross-origin or stricter. Use no-referrer on pages with sensitive addresses.
Avoid unsafe-url, which sends the full address everywhere.
Is the header spelled Referer or Referrer?
Both appear. The request header is spelled Referer, from an old spelling mistake in the HTTP standard. The policy header is spelled correctly as Referrer-Policy.
It is a common typo source.
Does Referrer-Policy hide the visitor's identity?
No. It limits the page address shared, nothing more. The visitor's IP address and other request data are still sent.
For privacy, it is one control among several.
Can it break analytics?
It can reduce the detail reported about where visitors came from, for example the exact page rather than the site.
The origin alone is usually enough for traffic reports.
How do we check for leaks?
Look at the network requests a sensitive page makes to other domains and read the Referer header sent.
A pentest looks for tokens in URLs and for pages that send them onwards.
Sources
Where this comes from
Related
Terms that sit next to this one
Security headers
Response headers that switch on browser protections against common web attacks.
Open redirect
A page that forwards visitors to any address handed to it in the URL.
PII
Any data that points at a specific human being.
Permissions-Policy
A header that turns off browser features like camera or location for your pages.
SameSite cookie
A cookie setting that limits when a browser sends it on requests from other sites.
What does your URL give away?
Tokens and identifiers in addresses, and pages that pass them to other sites, are things we look for in the running app, with the request shown as proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.