Referrer-Policy: the Header That Stops URL Leaks
Your URLs leak into other sites' analytics. What Referrer-Policy controls and which value to set - strict-origin-when-cross-origin, explained.
Short answer
Set Referrer-Policy to strict-origin-when-cross-origin unless you have a reason not to. It stops full URLs (and tokens sitting in them) from leaking to other sites when users click away.
The leak nobody notices
Every time a visitor clicks an outbound link, the browser may send a Referer header with the full previous URL - path, query string, and all. Invite tokens, password-reset IDs, internal search terms, and campaign parameters ride along for free into third-party analytics and partner sites.
You did not mean to publish that data. The default browser behaviour still does, unless you set a policy. That is not a theoretical privacy footnote; it is how session tokens and customer IDs end up in someone else's logs.
The default that works
strict-origin-when-cross-origin is the modern sensible default. Same-origin navigations still send a full referrer so your own analytics and same-site flows keep working. Cross-origin HTTPS hops get origin only. HTTPS-to-HTTP downgrades send nothing.
That split is the whole point: keep usefulness inside your site, cut leakage outside it. Most brochure sites and SaaS products can ship this value and never look back.
When to go stricter
no-referrer and same-origin fit high-sensitivity apps that do not need outbound referrer data at all - banking-style dashboards, admin tools, anything that puts secrets in URLs you should not have put there in the first place.
Measure before you tighten past the default. Some partner integrations, payment embeds, and affiliate links still expect a referrer. Break those on purpose only if product agrees, then document the exception.
Ship and prove it
Add the header at the reverse proxy or CDN that terminates real user traffic. Verify with curl -I against production, not only a staging box. Re-run a passive grade so the check flips green where scanners look for it.
Pair it with the rest of the baseline headers. Celebrating one green Referrer-Policy next to missing HSTS and open framing is cosplay.
Config to copy
Referrer-Policy: strict-origin-when-cross-originPaste carefully. Test on staging first if the setting can lock users out.
What to do this week
- curl -sI https://your-production-host | find Referrer-Policy (or grep -i referrer).
- Set Referrer-Policy: strict-origin-when-cross-origin at the edge if it is missing.
- Click an outbound link from a page with a query string and confirm the third party does not receive the full path.
- Re-scan the public site and file a one-line note in the runbook with the deploy ID.
One header. Less of your URL ends up in someone else's analytics.
Update log (1)
2026-05-08Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
