Skip to content
DomainGrade

What we checkSecurity headersHD-04

Referrer-Policy

Controls how much of your URL is sent to sites your visitors click through to.

Area
Security headers
Check
HD-04
Included
Free in every scan

What we check

We read the Referrer-Policy header and check the token is one browsers understand.

Why it matters

By default a browser sends the full URL of the page a visitor is leaving. If your URLs contain account numbers, reset tokens or search terms, they go to whoever they clicked.

unsafe-url sends the full path even to plain-HTTP destinations, which is the worst available option and worth its own warning.

It also affects what your own analytics and your partners can see. A full-URL referrer sent cross-origin hands the whole path to whoever received the click, including anything you put in a query string.

How to fix it

  1. 1

    Send strict-origin-when-cross-origin, which is also the modern browser default.

  2. 2

    Set it at the server or CDN so it applies to every response, not only the pages someone remembered.

  3. 3

    Set it at the server or CDN so it applies to every response, not only the pages someone remembered.

  4. 4

    If a specific page needs a stricter policy — a password reset, say — no-referrer can be set on that response alone.

A response header
Referrer-Policy: strict-origin-when-cross-origin

Common questions

Browsers already default to this. Why set it?
Older ones do not, and the explicit header states your intent rather than inheriting whatever the browser decides next.
Will it break analytics?
Cross-origin referrers become the origin rather than the full URL. Same-origin navigation is unaffected, so internal funnels still work.
What if I want no referrer at all?
no-referrer is available, and fine if you do not need it. It removes attribution for sites you link to.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other security headers checks