Security · Response header
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.
What is Referrer-Policy?
Balances privacy (don't leak URLs to third parties) against analytics needs. Common values: `no-referrer`, `strict-origin-when-cross-origin`, `same-origin`.
Typical usage
Set on all responses. `strict-origin-when-cross-origin` is a good default.
Examples
Referrer-Policy: strict-origin-when-cross-originSpecification
W3C Referrer Policy
Frequently asked questions
What is the Referrer-Policy HTTP header?
Balances privacy (don't leak URLs to third parties) against analytics needs. Common values: `no-referrer`, `strict-origin-when-cross-origin`, `same-origin`.
Is Referrer-Policy a request or response header?
Referrer-Policy is a response header — the server sends it to the client. Set on all responses. `strict-origin-when-cross-origin` is a good default.
What does a Referrer-Policy header look like?
A typical Referrer-Policy header looks like: Referrer-Policy: strict-origin-when-cross-origin.
Related headers
Referer
The URL of the previous page that led to this request.
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Permissions-Policy
Controls which browser features and APIs pages can use.