Skip to content
Pricing RU Sign In
RU
← All HTTP Headers
Security

Referrer-Policy

Controls how much referrer information is included with requests, balancing privacy with analytics needs.

Syntax

Referrer-Policy: no-referrer | same-origin | strict-origin-when-cross-origin

Example

Referrer-Policy: strict-origin-when-cross-origin

Description

The Referrer-Policy header controls what referrer information is sent in the Referer header. Important for privacy and security.

Common values: no-referrer, same-origin, strict-origin-when-cross-origin, no-referrer-when-downgrade.

Recommended: strict-origin-when-cross-origin — prevents leaking URL paths to third-party sites while keeping analytics data.

Check if your website sends this header correctly

Check your headers →

Related Articles

Web Server Security Hardening Checklist: Nginx and Apache
Complete web server hardening checklist for nginx and Apache. File permissions, security headers, TLS configuration, access control, and monitoring.
Security Headers: The Complete Guide
Complete guide to HTTP security headers: CSP, HSTS, X-Frame-Options, Permissions-Policy, CORP, COEP. Configuration and examples.
Analyzing Server Response Headers: What They Reveal About a Website
A detailed guide to HTTP headers: Cache-Control, ETag, Server, CORS, and security headers. How to read and optimize response headers.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.

Related guides

Longer-form reading on this topic from the knowledge base.

Automate this check

Set up continuous monitoring and get an alert when something breaks. No manual runs to remember.

Start free

Related Articles

HTTP

Server-Sent Events vs WebSockets: Choosing Real-Time Communication

9 min · Read → HTTP

HTTP 404 Not Found Error: 7 Causes and How to Fix

8 min · Read → HTTP

The Complete HTTP Request Lifecycle: From URL to Rendered Page

10 min · Read →
All articles →

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation