Referrer-Policy
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
strict-origin-when-cross-originProduction Server Implementation
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Directives & Syntax Breakdown
Sends full URL for same-origin, domain-only for HTTPS cross-origin, and zero referrer when downgrading to HTTP.
Never sends the Referer header under any circumstances for maximum privacy.
Sends full path for same-origin requests, but only domain origin for third-party requests.
Common Security Hazards & Pitfalls
- •Sensitive tokens, session IDs, or password reset parameters in URL query strings can leak to third parties if Referrer-Policy is permissive.
Referrer-Policy - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
Chrome, Firefox, and Safari default to "strict-origin-when-cross-origin" if the header is not specified.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.