Skip to content
Skip to content
API Pricing RU Sign In
← All HTTP Headers
Security

Referrer-Policy

Controls how much referrer information is included with requests, balancing privacy with analytics needs.

Syntax

Referrer-Policy: no-referrer | same-origin | strict-origin-when-cross-origin

Example

Referrer-Policy: strict-origin-when-cross-origin

Description

The Referrer-Policy header controls what referrer information is sent in the Referer header. Important for privacy and security.

Common values: no-referrer, same-origin, strict-origin-when-cross-origin, no-referrer-when-downgrade.

Recommended: strict-origin-when-cross-origin — prevents leaking URL paths to third-party sites while keeping analytics data.

Check if your website sends this header correctly

Check your headers →

Related Articles

Web Server Security Hardening Checklist: Nginx and Apache
Complete web server hardening checklist for nginx and Apache. File permissions, security headers, TLS configuration, access control, and monitoring.
Security Headers: The Complete Guide
Complete guide to HTTP security headers: CSP, HSTS, X-Frame-Options, Permissions-Policy, CORP, COEP. Configuration and examples.
Analyzing Server Response Headers: What They Reveal About a Website
A detailed guide to HTTP headers: Cache-Control, ETag, Server, CORS, and security headers. How to read and optimize response headers.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation