Skip to content
FixSecurityHeadersScan a site

How to add Referrer-Policy on Nginx

Last updated · Reviewed by a CISSP-certified security practitioner

To add Referrer-Policy on Nginx, set the header in nginx.conf (server block) with the value strict-origin-when-cross-origin. Limits how much of your URLs leak to other sites. Run nginx -t, then systemctl reload nginx. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Referrer-Policy do?

Referrer-Policy controls what URL information the browser sends to other sites when users click links or load resources.

Risk if missing: Full URLs — including reset tokens, search terms or internal paths — can leak to third parties.

What is the Nginx configuration?

Add this to nginx.conf (server block):

nginx.conf (server block)
# Inside your server { } block
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

How do I add it step by step?

  1. Open nginx.conf (server block).
  2. Paste the Referrer-Policy configuration shown below.
  3. Run nginx -t, then systemctl reload nginx.
  4. Run curl -I https://yourdomain.com and look for the referrer-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "referrer-policy"
# expected:
# referrer-policy: strict-origin-when-cross-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • no-referrer is stricter but can break analytics attribution and some payment flows.
  • Always add the always flag so headers are sent on error responses too.
  • add_header in a location block replaces all add_header directives inherited from server — repeat them or use an include file.

Quick reference

HeaderReferrer-Policy
Recommended valuestrict-origin-when-cross-origin
StackNginx
Wherenginx.conf (server block)
ComplianceOWASP ASVS V14.4.6, SOC 2 CC6.7

FAQ

What value should I use for Referrer-Policy?

A safe default is strict-origin-when-cross-origin. no-referrer is stricter but can break analytics attribution and some payment flows.

Why isn't Referrer-Policy showing up on Nginx?

Always add the always flag so headers are sent on error responses too. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Referrer-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Referrer-Policy?

OWASP ASVS V14.4.6, SOC 2 CC6.7.

Related guides