Skip to content
FixSecurityHeadersScan a site

How to add Referrer-Policy on Netlify

Last updated · Reviewed by a CISSP-certified security practitioner

To add Referrer-Policy on Netlify, set the header in _headers (in publish directory) with the value strict-origin-when-cross-origin. Limits how much of your URLs leak to other sites. Redeploy; check Deploy summary → Headers rules processed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Referrer-Policy do?

Referrer-Policy controls what URL information the browser sends to other sites when users click links or load resources.

Risk if missing: Full URLs — including reset tokens, search terms or internal paths — can leak to third parties.

What is the Netlify configuration?

Add this to _headers (in publish directory):

_headers (in publish directory)
/*
  Referrer-Policy: strict-origin-when-cross-origin

How do I add it step by step?

  1. Open _headers (in publish directory).
  2. Paste the Referrer-Policy configuration shown below.
  3. Redeploy; check Deploy summary → Headers rules processed.
  4. Run curl -I https://yourdomain.com and look for the referrer-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "referrer-policy"
# expected:
# referrer-policy: strict-origin-when-cross-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • no-referrer is stricter but can break analytics attribution and some payment flows.
  • The _headers file must end up in your publish directory (e.g. public/).
  • Indent header lines under the path pattern.

Quick reference

HeaderReferrer-Policy
Recommended valuestrict-origin-when-cross-origin
StackNetlify
Where_headers (in publish directory)
ComplianceOWASP ASVS V14.4.6, SOC 2 CC6.7

FAQ

What value should I use for Referrer-Policy?

A safe default is strict-origin-when-cross-origin. no-referrer is stricter but can break analytics attribution and some payment flows.

Why isn't Referrer-Policy showing up on Netlify?

The _headers file must end up in your publish directory (e.g. public/). Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Referrer-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Referrer-Policy?

OWASP ASVS V14.4.6, SOC 2 CC6.7.

Related guides