Security Headers Checker / Headers
Referrer-Policy: what your pages tell other sites
When a visitor follows a link or loads a resource, the browser may tell the other site which page they came from. Referrer-Policy limits that: a full URL can leak search terms, account or reset tokens in the query string.
What to send
Referrer-Policy: strict-origin-when-cross-origin
strict-origin-when-cross-origin sends only your origin to other sites and nothing over HTTP; it is the browsers' default, and sending it explicitly protects older browsers. no-referrer sends nothing at all.
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Will this break anything?
- Referrer-Policy: sites you link to see less about where visitors came from. strict-origin-when-cross-origin still sends your origin, which most referral reports need; no-referrer sends nothing.
How our grade counts it
- Coverage, up to 5 points: a private value (no-referrer, same-origin, strict-origin, strict-origin-when-cross-origin); the last valid token counts; not counted when the header is absent or has no valid value, because the browser then applies strict-origin-when-cross-origin by itself
Common mistakes
- unsafe-url: sends the full URL, query string included, everywhere.
- no-referrer-when-downgrade: the old default, which leaks full URLs to every HTTPS site.
Check your site
The checker reads Referrer-Policy the way a browser applies it, alongside every other security header.
Open the Security Headers Checker