Referrer Policy

Referrer Policy controls how much URL detail a browser leaks in the Referer header on outbound navigations and subresource requests, from full URLs to origin-only to none.

http

Definition

Referrer Policy is a header and meta element that constrains the Referer header sent with requests leaving the page. Policies range from no-referrer through same-origin and strict-origin to unsafe-url, and strict-origin-when-cross-origin is the modern default, sending a full URL same-origin but only the origin cross-origin.

Context and scope

Configured to stop leaking URLs with tokens, user IDs, or one-time links to third-party analytics, CDNs, and linked sites. Especially relevant on pages whose URLs contain secrets in query strings.

Common misconceptions

Disabling Referer entirely is the only protection — strict-origin-when-cross-origin already strips paths cross-origin
The policy only affects links — it governs navigations, subresources, fetches, and prefetches alike
Referer leaks only the hostname — the default policy can still leak full paths to same-origin and historically to lax cross-origin cases

Anti-patterns

Putting session tokens or capability URLs in query strings and relying on downstream sites to be polite
Setting no-referrer globally and breaking same-origin analytics and anti-CSRF patterns that read the header
Forgetting the strict-origin downgrade rule: HTTPS to HTTP sends no Referer regardless of policy

Related concepts

Related examples

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy

What it is

Every outbound request may carry the URL of the page that caused it. That URL often contains usernames, tokens, or capability links. Referrer Policy decides which requests carry how much: full URL, origin only, or nothing, with separate behavior for same-origin versus cross-origin and secure to insecure transitions.

How it works

The policy can be delivered as a response header, a meta tag, or per-element referrerpolicy attributes. Downgrade rules always apply: a secure page never leaks Referer to an insecure origin. The default strict-origin-when-cross-origin sends the full URL only when the target shares the origin.

When to use it

Any site where URLs embed state: password-reset links, filtered admin views, share links with tokens. A strict policy also reduces cross-site tracking surface without breaking same-origin analytics that only need the origin.

Pitfalls

Per-element attributes override the page policy, so an embed can reintroduce leakage. Older browsers implemented legacy keywords differently; test the effective policy. Capability URLs should be single-use regardless of header hygiene, since history and logs also retain them.