Skip to content
RU Sign In
RU
← All HTTP Headers
Security

Referrer-Policy

Controls how much referrer information is included with requests, balancing privacy with analytics needs.

Syntax

Referrer-Policy: no-referrer | same-origin | strict-origin-when-cross-origin

Example

Referrer-Policy: strict-origin-when-cross-origin

Description

The Referrer-Policy header controls what referrer information is sent in the Referer header. Important for privacy and security.

Common values: no-referrer, same-origin, strict-origin-when-cross-origin, no-referrer-when-downgrade.

Recommended: strict-origin-when-cross-origin — prevents leaking URL paths to third-party sites while keeping analytics data.

How real sites send this header

Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.

32.0% (161 of 503) send Referrer-Policy.

Most common values:

  • strict-origin-when-cross-origin — 66 sites
  • no-referrer-when-downgrade — 34 sites
  • same-origin — 33 sites

See it on: yandex.ru, github.com, cloudflare.com, beget.com, auto.ru

Check if your website sends this header correctly

Check your headers →

Related Articles

Build a Website with AI: 9-Point Pre-Launch Checklist
How to build a website with AI, then check it before launch: HTTPS, security headers, image weight, soft 404s, leftover noindex, forms and leaked API keys.
The .htaccess File: Redirects, Access and Caching
What .htaccess is, where the file lives and how it works: directive syntax, HTTPS and www redirects, IP and password access, caching headers and 500 error fixes.
Website Security Check: The Complete Checklist
Website security check: the complete checklist. How to test any website online in 5 minutes — HTTPS, security headers, CSP, cookies, malware — plus a full owner's checklist with curl examples and a layer-by-layer summary table.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.

Related guides

Longer-form reading on this topic from the knowledge base.

Automate this check

Set up continuous monitoring and get an alert when something breaks. No manual runs to remember.

Start free

Related Articles

HTTP

How to Fix 404 Not Found Errors: Visitors, nginx, Apache, CDN

19 min · Read → HTTP

HTTP Methods Explained: GET, POST, PUT, DELETE and Beyond

6 min · Read → HTTP

Server-Sent Events vs WebSockets: Which to Use for Realtime

5 min · Read →
All articles →

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation