Skip to main content
All fixes

SSL, TLS, security headers

Set Referrer-Policy to control outbound Referer leakage

Without Referrer-Policy, Chrome leaks full URLs (including query strings) to third parties. Set strict-origin-when-cross-origin to keep paths private.

What's happening

The Referer header (yes, misspelled in the original RFC) is sent automatically by browsers on most outbound navigation and subresource requests, telling the destination which page linked to it. Without an explicit Referrer-Policy, the browser falls back to its default, which until recently leaked full URLs across origins. Chrome's default since 2020 is strict-origin-when-cross-origin — but other browsers and embedded WebViews have different defaults.

The leak matters when URLs contain sensitive data: session tokens in query strings, password-reset links, internal admin paths, or simply private content URLs that should not be tracked across the open web. Setting an explicit Referrer-Policy header makes the behavior predictable and tightens it where needed.

The fix is to set Referrer-Policy on every response. The right value for almost every site is strict-origin-when-cross-origin, which sends the full URL on same-origin requests, the origin only on cross-origin HTTPS-to-HTTPS requests, and nothing on HTTPS-to-HTTP downgrades.

Why it matters

Outbound clicks leak full URLs to ad networks, social embeds, and any third-party logo. If your URLs encode user identity (or include reset tokens) those tokens flow to third parties.

Marketing analytics that rely on Referer (Google Search Console, paid-attribution tools) work correctly because origin-level information is still sent. Tightening to no-referrer is a different tradeoff.

OWASP ASVS Level 2, ISO 27001, and most security scorecards (Mozilla Observatory, SecurityHeaders.com) require an explicit Referrer-Policy header.

Common causes

  • Web server has never set the header and relies on browser defaults.
  • A meta-tag in HTML sets Referrer-Policy but the response header version is missing, leading to inconsistent behavior on non-HTML resources.
  • Header is set to the loose unsafe-url, leaking full URLs even cross-origin.
  • A reverse proxy strips the header.
  • An older CDN configuration overwrote it with no-referrer-when-downgrade, the deprecated default.

Detect this on your site

Run a quick scan with the Full Site Audit. The tool surfaces this exact issue with the records and context needed to apply the fix below.

Open Full Site Audit

How to fix it

  1. 1

    Audit the current header value

    Run curl -sI https://example.com | grep -i referrer-policy. Note the value if present. Common bad values: no-referrer-when-downgrade (default in older specs, leaks too much), unsafe-url (always leaks). Good values: strict-origin-when-cross-origin, same-origin, no-referrer.

  2. 2

    Pick the right policy

    Most sites should use strict-origin-when-cross-origin. Sites with sensitive URLs (admin tools, internal apps, reset links) should use same-origin or no-referrer. Marketing-heavy sites that rely on click attribution can use strict-origin. Avoid unsafe-url.

  3. 3

    Set the header in nginx

    Add add_header Referrer-Policy "strict-origin-when-cross-origin" always;. Reload nginx with sudo nginx -t && sudo systemctl reload nginx. The header applies to every response that nginx serves.

  4. 4

    Set the header in Apache

    Add Header always set Referrer-Policy "strict-origin-when-cross-origin" in the VirtualHost or.htaccess. Confirm mod_headers is enabled. Reload with sudo systemctl reload apache2.

  5. 5

    Apply per-route policy where needed

    On password-reset and email-verification routes, set Referrer-Policy: no-referrer to avoid leaking tokens. In Express: res.setHeader('Referrer-Policy', 'no-referrer'). In Next.js, set it via middleware on the matching path.

  6. 6

    Verify across navigation types

    Test with Chrome DevTools: visit a page, click an outbound link, and inspect the Network panel for the Referer header value sent. Confirm the policy behavior matches your declared value.

Example

Referrer-Policy: strict-origin-when-cross-origin

Recommended default Referrer-Policy header

Frequently asked

strict-origin-when-cross-origin sends origin-only data to cross-origin destinations which is enough for marketing tools to attribute traffic to your domain but not to specific landing pages. For deeper attribution use UTM parameters rather than relying on the Referer header.

The response header. Meta tags only apply to HTML documents and not to images JavaScript CSS or fetch requests. The HTTP header covers everything. Use meta only as a fallback or for static documents that cannot set headers.

Related fixes

SSL, TLS, security headers

Deploy a Content-Security-Policy to mitigate XSS attacks

SSL, TLS, security headers

Add X-Content-Type-Options nosniff to block MIME sniffing

SSL, TLS, security headers

Block clickjacking with X-Frame-Options or CSP frame-ancestors

SSL, TLS, security headers

Set Permissions-Policy to restrict browser feature access