Referrer-Policy

The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.


Syntax

Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url


Directives

  • no-referrer - The Referrer header will be omitted: sent requests do not include any referrer information.
  • no-referrer-when-downgrade - Send the origin, path, and query string in Referrer when the protocol security level stays the same or improves (HTTP → HTTP, HTTP → HTTPS, HTTPS → HTTPS). Don't send the Referrer header for requests to less secure destinations (HTTPS → HTTP, HTTPS → file).
  • origin - Send only the origin in the Referrer header. For example, a document at https://example.com/page.html will send the referrer https://example.com/.
  • origin-when-cross-origin - When performing a same-origin request to the same protocol level (HTTP → HTTP, HTTPS → HTTPS), send the origin, path, and query string. Send only the origin for cross origin requests and requests to less secure destinations (HTTPS → HTTP).
  • same-origin - Send the origin, path, and query string for same-origin requests. Don't send the Referrer header for cross-origin requests.
  • strict-origin - Send only the origin when the protocol security level stays the same (HTTPS → HTTPS). Don't send the Referrer header to less secure destinations (HTTPS → HTTP).
  • strict-origin-when-cross-origin (default) - Send the origin, path, and query string when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS → HTTPS). Don't send the Referrer header to less secure destinations (HTTPS → HTTP).


Integration with HTML

You can also set referrer policies inside HTML. For example, you can set the referrer policy for the entire document with a <meta> element with a name of referrer:

<meta name="referrer" content="origin" />


You can specify the referrerpolicy attribute on <a>, <area>, <img>, <iframe>, <script>, or <link> elements to set referrer policies for individual requests:

<a href="http://example.com" referrerpolicy="origin">…</a>


Alternatively, you can set a noreferrer link relation on an a, area, or link elements:

<a href="http://example.com" rel="noreferrer">…</a>