Referrer-Policy explained
Last updated · Reviewed by a CISSP-certified security practitioner
Referrer-Policy: Referrer-Policy controls what URL information the browser sends to other sites when users click links or load resources. Recommended value: strict-origin-when-cross-origin.
What risk does it prevent?
Full URLs — including reset tokens, search terms or internal paths — can leak to third parties.
What is the safe recommended value?
Referrer-Policy: strict-origin-when-cross-origin
What are the gotchas?
- no-referrer is stricter but can break analytics attribution and some payment flows.
Which compliance controls reference it?
- OWASP ASVS V14.4.6
- SOC 2 CC6.7
How do I add it on my stack?
- Referrer-Policy on Nginx
- Referrer-Policy on Apache
- Referrer-Policy on IIS
- Referrer-Policy on Cloudflare
- Referrer-Policy on Vercel
- Referrer-Policy on Netlify
- Referrer-Policy on AWS CloudFront
- Referrer-Policy on Express / Node
- Referrer-Policy on Next.js
- Referrer-Policy on WordPress
- Referrer-Policy on Lovable / static hosting
Check your site now
Free scan, instant grade, exact fixes for your stack.
Other security headers
- Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
- Content-Security-Policy — Controls which scripts, styles and frames a page may load.
- X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
- X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
- Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
- Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
- Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
- Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).