Security · Response header

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

What is Referrer-Policy?

Balances privacy (don't leak URLs to third parties) against analytics needs. Common values: `no-referrer`, `strict-origin-when-cross-origin`, `same-origin`.

Typical usage

Set on all responses. `strict-origin-when-cross-origin` is a good default.

Examples

Referrer-Policy: strict-origin-when-cross-origin

Specification

W3C Referrer Policy

Related headers

Referer

The URL of the previous page that led to this request.

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

X-Frame-Options

Prevents clickjacking by controlling framing.

X-Content-Type-Options

Disables MIME-type sniffing.

Permissions-Policy

Controls which browser features and APIs pages can use.