Cybersecurity glossary
What is Referrer Policy?
Learn what Referrer Policy is, how it controls the Referer header browsers send, which policy values balance analytics and privacy, and how to reduce token leakage in URLs.
Definition
Referrer Policy is a web security and privacy mechanism—commonly set via an HTTP header or meta/referrerpolicy attributes—that controls how much referrer information the browser includes when navigating or loading resources.
Why Referrer Policy matters
Browsers often tell the next site where the user came from via the Referer header. That helps analytics and debugging—and can accidentally ship password-reset URLs, invitation tokens, or internal path structures to third-party CDNs and ads.
Referrer Policy gives developers deliberate control over that leakage. Combined with not putting secrets in URLs, it is a practical privacy and security header for modern sites.
How referrer data flows
User navigates or loads a subresource
A link click, redirect, or third-party script/image request is initiated.
Browser evaluates policy
Document policy, element attributes, and destination context determine what to send.
Referer header is set or omitted
Full URL, origin-only, or empty referrer is applied to the request.
Recipient may log it
Analytics, CDNs, and partner sites store referrer values in their logs.
Secrets can leak cross-origin
If a sensitive URL was the referrer, tokens may leave your origin.
Tighten policy and URL design
Use stricter policies and move secrets out of query strings.
Common policy values
no-referrer
Sends no referrer. Highest privacy; may affect analytics that rely on referrers.
same-origin
Full referrer only for same-origin requests; none cross-origin.
strict-origin-when-cross-origin
A popular default-like balance of utility and cross-origin minimization.
unsafe-url
Always sends full URL when possible—including cross-origin. Usually too leaky.
Security and privacy checklist
| Practice | Why |
|---|---|
| Set Referrer-Policy globally | Establishes a site-wide baseline without relying on each page author |
| Avoid secrets in URLs | Policy reduces but does not eliminate all leakage paths (history, logs, screenshots) |
| Review third-party tags | Cross-origin loads are common referrer recipients |
| Use stricter attributes on sensitive pages | Password reset and account pages may need no-referrer |
- Deploy Referrer-Policy on all HTML responses via header.
- Prefer strict-origin-when-cross-origin or stricter unless analytics prove a need.
- Audit flows that put tokens in query strings; redesign them.
- Set no-referrer on especially sensitive pages if product allows.
- Verify partner/CDN logging does not retain unexpected full referrers.
- Test navigations from HTTPS pages to HTTP destinations (downgrade cases).
- Document policy choice so marketing tags do not silently demand unsafe-url.
- Remember CSP referrer directives can interact—keep configuration consistent.
The practical takeaway
Referrer Policy controls how much previous-URL context browsers share with the next request. It is a small header with outsized privacy impact when URLs contain sensitive data.
Pick a strict default, harden sensitive pages further, and stop putting secrets in query strings. Policy reduces leakage; good URL design prevents the secret from existing in the referrer in the first place.
Related security terms
Content Security Policy (CSP)
Another HTTP security header; CSP can also influence referrer behavior via directives.
Permissions Policy
A different policy header controlling powerful browser features.
Open Redirect
Redirect chains can interact with referrer leakage and phishing flows.
Cross-Origin Resource Sharing (CORS)
Cross-origin requests where referrer data may still be relevant to servers.
Frequently asked questions
What is Referrer Policy in simple terms?
Referrer Policy tells the browser how much of the previous page’s URL to send in the Referer header when you open a new link or load an image/script. Stricter policies leak less information.
Why is it spelled Referer in HTTP?
The HTTP header historically misspelled “referrer” as Referer. The policy feature uses the correct English spelling: Referrer-Policy.
What is a good default policy?
Many sites use strict-origin-when-cross-origin: full URL for same-origin requests, origin-only for HTTPS→HTTPS cross-origin, and no referrer on downgrade. Adjust for privacy and analytics needs.
Can referrers leak secrets?
Yes. Tokens, reset codes, or personal IDs in query strings can appear in Referer headers sent to third parties if policy is too permissive.
Does Referrer Policy stop CSRF?
No. Some apps use Origin/Referer as extra CSRF signals, but Referrer Policy is not a CSRF control by itself and referrers can be absent.
How do you set Referrer Policy?
Send a Referrer-Policy HTTP header, and/or use meta referrer tags and element referrerpolicy attributes for finer control.
What does no-referrer do?
It suppresses the Referer header entirely for requests governed by that policy, maximizing privacy and minimizing URL leakage.
References
Explore authoritative guidance and frameworks related to referrer policy.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.