OneTaskBy Tim King · Updated
Referrer Policy Explainer
Referer Sent by Each of the 8 Values, Including strict-origin-when-cross-origin
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Referrer Policy Explainer works
This referrer policy explainer takes one of your page URLs and shows the exact Referer header that each Referrer-Policy value would send to another page on your site, to another HTTPS site and to a plain HTTP site. Paste your own header to see which policy browsers actually apply.
How the referrer policy explainer works
When a user clicks a link or a page loads an image, the browser sends a Referer header naming the page
the request came from. That URL can include paths and query strings with search terms, order numbers
or reset tokens. Referrer-Policy controls how much of it leaves your site.
The eight values trade detail for privacy. no-referrer sends nothing. origin sends only the scheme
and host. same-origin sends the full URL within your site and nothing elsewhere. The strict
variants also send nothing when an HTTPS page links to HTTP, and unsafe-url sends the full URL
everywhere. Browsers default to strict-origin-when-cross-origin.
Browsers always strip the fragment and any user name or password from the URL. A header may list several values separated by commas, and the browser uses the last one it recognises, so older browsers can fall back to an earlier value.
FAQ
Which referrer policy should I use?
strict-origin-when-cross-origin suits most sites, because your own analytics still see full paths while other sites only learn your domain. Use no-referrer or same-origin on pages whose URLs carry private data, such as password reset or account pages.
Can a single link override the page policy?
Yes. A link, image or iframe can set its own referrerpolicy attribute, and a link with rel="noreferrer" sends no Referer at all. A meta name="referrer" tag in the page head sets the policy for the whole document too.
Why is Referer spelled differently from Referrer-Policy?
The original HTTP specification misspelled referrer as Referer, and the header name stuck because changing it would break every server. The later Referrer-Policy header and the document.referrer property use the correct spelling.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Security Headers Generator
Generate HTTP security headers for nginx, Apache, Netlify and Express.
Security Headers Checker
Check pasted response headers for missing, weak and leaky security headers.
URL Query Parser
Split a URL into a readable table of parameters.
HTTP Header Inspector
Parse pasted HTTP headers, explain each one and audit security.
Permissions-Policy Builder
Build a Permissions-Policy header feature by feature, with server config.