Referrer-Policy Header
Controls how much of your page's URL is sent in the Referer header when a user clicks a link away from it.
Last updated August 9, 2026.
Severity when missing: Low — see how Nivaronix reports this on the security headers checker.
What it does
Referrer-Policy tells the browser what to include in the `Referer` header on outgoing requests and navigations: the full URL, just the origin, nothing at all, or something in between depending on whether the destination is as secure as the source.
Why it matters
URLs often carry more than a path — session identifiers, search terms, internal document IDs, password-reset tokens in query strings. Without a policy, browsers may send the full referring URL to every link a user clicks, including third-party sites and analytics tools, leaking that information off your domain. `strict-origin-when-cross-origin` (the current browser default, but worth setting explicitly) sends the full URL only to same-origin requests and just the origin to cross-origin ones, dropping it entirely on an HTTPS-to-HTTP downgrade.
Example header
Example only — this is not evidence from a live scan.
Referrer-Policy: strict-origin-when-cross-originHow to test for it
- Run `curl -sI https://example.com` and check for a `Referrer-Policy` header.
- Open DevTools → Network, click through to an external link, and inspect the `Referer` header the browser actually sent on that outgoing request.
How to add it
Nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"Cloudflare
Rules → Transform Rules → Modify Response Header → set `Referrer-Policy` to `strict-origin-when-cross-origin`.Verify the fix
After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.
Standards reference
MDN — Referrer-Policy. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.