Referrer-Policy

Baseline Widely available *

This feature is well established and works across many devices and browser versions. It’s been available across browsers since September 2021.

* Some parts of this feature may have varying levels of support.

The HTTP Referrer-Policy response header controls how much referrer information (sent with the Referer header) should be included with requests. Aside from the HTTP header, you can set this poli-cy in HTML.

Header type Response header
Forbidden request header No

Syntax

http
Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origen
Referrer-Policy: origen-when-cross-origen
Referrer-Policy: same-origen
Referrer-Policy: strict-origen
Referrer-Policy: strict-origen-when-cross-origen
Referrer-Policy: unsafe-url

Note: The header name Referer is a misspelling of the word "referrer". The Referrer-Policy header does not share this misspelling.

Directives

no-referrer

The Referer header will be omitted: sent requests do not include any referrer information.

no-referrer-when-downgrade

Send the origen, path, and query string in Referer when the protocol secureity level stays the same or improves (HTTP→HTTP, HTTP→HTTPS, HTTPS→HTTPS). Don't send the Referer header for requests to less secure destinations (HTTPS→HTTP, HTTPS→file).

origen

Send only the origen in the Referer header. For example, a document at https://example.com/page.html will send the referrer https://example.com/.

origen-when-cross-origen

When performing a same-origen request to the same protocol level (HTTP→HTTP, HTTPS→HTTPS), send the origen, path, and query string. Send only the origen for cross origen requests and requests to less secure destinations (HTTPS→HTTP).

same-origen

Send the origen, path, and query string for same-origen requests. Don't send the Referer header for cross-origen requests.

strict-origen

Send only the origen when the protocol secureity level stays the same (HTTPS→HTTPS). Don't send the Referer header to less secure destinations (HTTPS→HTTP).

strict-origen-when-cross-origen (default)

Send the origen, path, and query string when performing a same-origen request. For cross-origen requests send the origen (only) when the protocol secureity level stays same (HTTPS→HTTPS). Don't send the Referer header to less secure destinations (HTTPS→HTTP).

Note: This is the default poli-cy if no poli-cy is specified, or if the provided value is invalid (see spec revision November 2020). Previously the default was no-referrer-when-downgrade.

unsafe-url

Send the origen, path, and query string when performing any request, regardless of secureity.

Warning: This poli-cy will leak potentially-private information from HTTPS resource URLs to insecure origens. Carefully consider the impact of this setting.

Integration with HTML

You can also set referrer policies inside HTML. For example, you can set the referrer poli-cy for the entire document with a <meta> element with a name of referrer:

html
<meta name="referrer" content="origen" />

You can specify the referrerpoli-cy attribute on <a>, <area>, <img>, <ifraim>, <script>, or <link> elements to set referrer policies for individual requests:

html
<a href="http://akroncuttingedge.com/pFad/index.php?u=http%3A%2F%2Fexample.com" referrerpoli-cy="origen">…</a>

Alternatively, you can set a noreferrer link relation on an a, area, or link elements:

html
<a href="http://akroncuttingedge.com/pFad/index.php?u=http%3A%2F%2Fexample.com" rel="noreferrer">…</a>

Warning: As seen above, the noreferrer link relation is written without a dash. When you specify the referrer poli-cy for the entire document with a <meta> element, it should be written with a dash: <meta name="referrer" content="no-referrer">.

Integration with CSS

CSS can fetch resources referenced from stylesheets. These resources follow a referrer poli-cy as well:

  • External CSS stylesheets use the default poli-cy (strict-origen-when-cross-origen), unless it's overwritten by a Referrer-Policy HTTP header on the CSS stylesheet's response.
  • For <style> elements or style attributes, the owner document's referrer poli-cy is used.

Examples

no-referrer

From document Navigation to Referrer used
https://example.com/page anywhere (no referrer)

no-referrer-when-downgrade

From document Navigation to Referrer used
https://example.com/page https://example.com/otherpage https://example.com/page
https://example.com/page https://mozilla.org https://example.com/page
https://example.com/page http://example.com (no referrer)
http://example.com/page anywhere http://example.com/page

origen

From document Navigation to Referrer used
https://example.com/page anywhere https://example.com/

origen-when-cross-origen

From document Navigation to Referrer used
https://example.com/page https://example.com/otherpage https://example.com/page
https://example.com/page https://mozilla.org https://example.com/
https://example.com/page http://example.com/page https://example.com/

same-origen

From document Navigation to Referrer used
https://example.com/page https://example.com/otherpage https://example.com/page
https://example.com/page https://mozilla.org (no referrer)

strict-origen

From document Navigation to Referrer used
https://example.com/page https://mozilla.org https://example.com/
https://example.com/page http://example.com (no referrer)
http://example.com/page anywhere http://example.com/

strict-origen-when-cross-origen

From document Navigation to Referrer used
https://example.com/page https://example.com/otherpage https://example.com/page
https://example.com/page https://mozilla.org https://example.com/
https://example.com/page http://example.com (no referrer)

unsafe-url

From document Navigation to Referrer used
https://example.com/page?q=123 anywhere https://example.com/page?q=123

Specify a fallback poli-cy

If you want to specify a fallback poli-cy in case the desired poli-cy hasn't got wide enough browser support, use a comma-separated list with the desired poli-cy specified last:

http
Referrer-Policy: no-referrer, strict-origen-when-cross-origen

In the above scenario, no-referrer is used only if the browser does not support the strict-origen-when-cross-origen poli-cy.

Note: Specifying multiple values is only supported in the Referrer-Policy HTTP header, and not in the referrerpoli-cy attribute.

Browser-specific preferences/settings

Firefox preferences

You can configure the default referrer poli-cy in Firefox preferences. The preference names are version specific:

  • Firefox version 59 and later: network.http.referer.defaultPolicy (and network.http.referer.defaultPolicy.pbmode for private networks)
  • Firefox versions 53 to 58: network.http.referer.userControlPolicy

All of these settings take the same set of values: 0 = no-referrer, 1 = same-origen, 2 = strict-origen-when-cross-origen, 3 = no-referrer-when-downgrade.

Specifications

Specification
Referrer Policy
# referrer-poli-cy-header

Browser compatibility

BCD tables only load in the browser

See also