Referrer-Policy
Referrer-Policy governs how much of the current URL is sent in the Referer header when users navigate away or your page loads third-party resources. A good policy prevents leaking paths, query strings, and tokens to external sites and analytics.
Why it matters
Controls how much referrer information is sent with requests, preventing data leaks to third parties.
How to add Referrer-Policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Recommended value
strict-origin-when-cross-originAvoid
unsafe-url (sends the full URL everywhere, including over HTTP)Frequently asked questions
What is the best Referrer-Policy value?
strict-origin-when-cross-origin is the balanced default most browsers now use: it sends the full URL to same-origin requests, only the origin to cross-origin HTTPS requests, and nothing when downgrading to HTTP.
Will a strict Referrer-Policy break analytics?
Origin-level referrers are still sent cross-origin, so most analytics keep working. Only tools that need the full referring URL path are affected — and those are exactly the ones you usually do not want leaking your URLs.
Related reading
Other header guides
What the HSTS header does, how to configure max-age, includeSubDomains and preload, and how to add it in Nginx, Apache, and Cloudflare.
Why the X-Content-Type-Options: nosniff header matters, what MIME sniffing is, and how to set it in Nginx, Apache, and Cloudflare.
How X-Frame-Options prevents clickjacking, DENY vs SAMEORIGIN, why frame-ancestors supersedes it, and how to set it in Nginx, Apache, and Cloudflare.
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
Is Referrer-Policy set on your site?
Scan any URL free to check Referrer-Policy and every other security header.
Scan Now - Free