Referrer-Policy Header

Controls how much of your page's URL is sent in the Referer header when a user clicks a link away from it.

Last updated August 9, 2026.

Severity when missing: Low — see the missing-header finding on the security headers checker.

What it does

Referrer-Policy tells the browser what to include in the `Referer` header on outgoing requests and navigations: the full URL, just the origin, nothing at all, or something in between depending on whether the destination is as secure as the source.

Why it matters

URLs often carry more than a path — session identifiers, search terms, internal document IDs, password-reset tokens in query strings. Without a policy, browsers may send the full referring URL to every link a user clicks, including third-party sites and analytics tools, leaking that information off your domain. `strict-origin-when-cross-origin` (the current browser default, but worth setting explicitly) sends the full URL only to same-origin requests and just the origin to cross-origin ones, dropping it entirely on an HTTPS-to-HTTP downgrade.

Example header

Example only — this is not evidence from a live scan.

Referrer-Policy: strict-origin-when-cross-origin

How to test for it

Run `curl -sI https://example.com` and check for a `Referrer-Policy` header.
Open DevTools → Network, click through to an external link, and inspect the `Referer` header the browser actually sent on that outgoing request.

How to add it

Nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `Referrer-Policy` to `strict-origin-when-cross-origin`.

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guides Website security scanner

FAQ

What does Referrer-Policy protect against?

It controls what URL, if any, gets sent in the Referer header when a browser follows a link or loads a resource off your page. Without it, a full URL — including query strings, which can contain session tokens, password-reset codes, or search terms — can leak to whatever third-party site or resource the browser navigates to next.

What's the difference between no-referrer and strict-origin-when-cross-origin?

no-referrer sends nothing, ever, which is the strictest option but breaks any analytics or attribution that depends on referrer data. strict-origin-when-cross-origin — the current browser default and Nivaronix's recommended baseline — sends the full URL on same-origin requests, only the origin (no path or query) cross-origin over HTTPS, and nothing at all downgrading from HTTPS to HTTP.

Is Referrer-Policy needed if URLs don't contain sensitive data?

It still narrows what any given page reveals about a visitor's browsing path to third parties it links to or loads resources from, which matters for privacy even when no single URL looks sensitive on its own. The header costs nothing to send and has no functional downside for a typical site, so there's little reason to leave it unset.

Does setting Referrer-Policy break outbound analytics?

strict-origin-when-cross-origin — the setting Nivaronix recommends — still sends the origin cross-origin, which covers most standard attribution use cases. Only the strictest settings (no-referrer, same-origin) remove cross-origin referrer data entirely, and those should be tested against any analytics or affiliate tracking that depends on it before deploying.

Standards reference

MDN — Referrer-Policy. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.