Referrer-Policy
Definition
Every time a browser leaves one page for another, it may announce where it came from in a request header spelled Referer, a misspelling preserved from 1996. Referrer-Policy decides how much of that address is sent. The useful values are no-referrer, which sends nothing; same-origin, which sends the full URL to your own origin and nothing to others; origin, which sends only the scheme and host; origin-when-cross-origin, which sends the full URL internally and just the origin externally; and strict-origin-when-cross-origin, which does the same but also stops sending anything when moving from HTTPS to HTTP. That last value is now the default in every major browser when no header is set. A policy can also be set per element with a referrerpolicy attribute on a link or an image.
Why It Matters
The referrer is the main reason a private URL stops being private. Publish a document at a long unguessable address, and the first time a reader clicks an outbound link in it, that full address is handed to a site you do not control — and often into their analytics, their logs and their support tickets. Anything in the path or query string travels with it: a client name, a project code, a token. On the other side of the trade, sending nothing breaks referral reporting, so you lose the ability to see which newsletter or forum actually sent you traffic. Most sites want a middle setting; the default strict-origin-when-cross-origin is that middle setting, and is a reasonable place to stop.
How It Works
The server sends Referrer-Policy with the response, and the browser applies it to every navigation and subresource request originating from that page. With origin-when-cross-origin, a visitor moving from https://report.99helpers.site/q3/summary.html to an external site sends only https://report.99helpers.site as the Referer. With no-referrer, the header is omitted entirely. Downgrades from HTTPS to HTTP suppress the referrer under the strict variants regardless of the rest of the policy. A UTM parameter in the outbound link is unaffected — those live in the destination URL, not the referrer — so campaign tracking still works when the referrer is stripped. If several policies apply, the element attribute wins over the page header.
Real-World Example
A recruiter shares a candidate shortlist at a private-looking address on 99helpers, with a path naming the hiring company. Each outbound link to a portfolio site is leaking that path into the portfolio owner's web analytics. Setting Referrer-Policy to strict-origin gives those sites only the hostname, so they can see traffic arrived from a hosted page but not which shortlist it was.
Common Mistakes
- ✕Treating an unguessable URL as private while sending full referrers — the first outbound click publishes it to a third party
- ✕Setting no-referrer across a whole site and then reporting that referral traffic has fallen to zero, which is the policy working as written
- ✕Assuming the header is spelled the same in both places — the policy is Referrer-Policy with two r's, the request header is Referer with one
- ✕Putting tokens or identifiers in the query string of a page that links outwards, where any referrer setting short of no-referrer may carry them along
Related Terms
Security Header
An HTTP response header that instructs the browser to enforce a restriction on a page — what it may load, who may frame it, how much of its URL leaks. The server states the rule; the browser applies it.
Referral Traffic
Visits that arrived by following a link on another site, identified by the address the browser reports as the previous page. Anything the browser will not name lands in a separate bucket called direct.
UTM Parameter
A tag added to the end of a URL to record where a visit came from. Analytics tools read the tag and group the visit under the campaign you named.
Personal Data
Any information relating to a person who can be identified, directly or indirectly. The definition is broader than most people expect — an IP address counts, and so does an identifier that only becomes a name when combined with something else.
Web Analytics
Measuring who visits a site and what they look at. The two methods — a script running in the visitor's browser, or counting each request as it is served — produce different numbers, and neither of them is wrong.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →