Home /Tools /Referrer-Policy Generator

Referrer Policy

Control the referrer information sent with cross-origin requests.

strict-origin-when-cross-origin

Recommended

Send a full URL for same-origin requests. Only send the origin for cross-origin requests, and only when the protocol security level stays the same (HTTPS->HTTPS).

no-referrer

The Referer header will be omitted entirely. No referrer information is sent along with requests.

no-referrer-when-downgrade

Send a full URL when security stays the same or improves (HTTP->HTTPS), but send no referrer for downgraded requests (HTTPS->HTTP).

origin

Send only the origin of the document in all cases. The document https://example.com/page.html will send the referrer https://example.com/.

origin-when-cross-origin

Send a full URL when performing a same-origin request, but only send the origin of the document for cross-origin requests.

same-origin

A referrer will be sent for same-origin requests, but cross-origin requests will contain no referrer information.

strict-origin

Send only the origin when security stays the same (HTTPS->HTTPS). Don't send the Referer header to less secure destinations.

unsafe-url

Send a full URL for all requests. Warning: This leaks origins and paths from TLS-protected resources to insecure origins.

Generated Snippets

HTTP Header (Preferred)

Referrer-Policy: strict-origin-when-cross-origin

HTML Meta Tag

<meta name="referrer" content="strict-origin-when-cross-origin">

What does this do?

When a user clicks a link on your site to navigate to another site, the browser typically sends a Referer HTTP header to the new site, containing the URL of your site.

The Referrer-Policy lets you control exactly what gets sent. For privacy, it's highly recommended to use strict-origin-when-cross-origin. This protects paths (like /user/123/profile) from leaking to third parties.

Why use a Referrer-Policy?

Whenever a user clicks a link, makes an API request, or loads an image, the browser sends an HTTP Referer header (yes, it's misspelled in the spec) to the destination server. This header tells the receiving server exactly which URL the user just came from.

This can be a privacy concern. For example, if a user is on https://yoursite.com/password-reset?token=12345 and clicks an external link to Twitter, Twitter would receive the full URL, including the secret token, in the Referer header!

Best Practices

Modern browsers (Chrome, Firefox, Safari) now default to strict-origin-when-cross-origin if no policy is specified. This is a great baseline because it only sends the domain name (not the full path or query parameters) when linking to other sites.

You can explicitly set this via an HTTP header (Referrer-Policy: strict-origin-when-cross-origin) or an HTML meta tag (<meta name="referrer" content="strict-origin-when-cross-origin">) to ensure consistent behavior across all older and newer browsers.

Related Guides

Deepen your understanding with our expert articles.

The Ultimate Guide to Meta Tags for SEORead guide →