probeo

How to set Referrer-Policy to prevent URL leakage?

referrer-policy-missing global

The issue

Without a deliberate referrer policy, the URL a visitor leaves from can travel to the next site, including paths and query strings that were never meant to leave. Search terms, internal paths and tokens placed in URLs end up in other sites’ logs and analytics.

The cause is leaving the decision to the browser. Current Chrome, Edge and Firefox default to strict-origin-when-cross-origin, which sends only the origin to other sites. Older browsers sent the full URL, and an explicit header is the only way to make the policy the site’s own.

Scope

The policy applies to every navigation and resource request a page makes: links, scripts, images and fetch calls. Set it site-wide, then tighten it on sensitive pages. Probeo doesn’t grade this header.

How to check you have it

  • By hand: run curl -sI https://example.com/ and look for referrer-policy.
  • In the browser: in DevTools, select a request to another site in the Network tab and read the Referer request header it sent.

The fix

Set Referrer-Policy: strict-origin-when-cross-origin on every response.

It sends the full URL within the site, only the origin to other sites, and nothing from HTTPS to HTTP. On login, account and admin pages, use same-origin or no-referrer. Set the header at the server or CDN, then override it per route where needed.

Done when: every response carries the policy, sensitive pages carry a stricter one, and the check above comes back clean.

Do not

  • Do not use unsafe-url, which sends the full URL everywhere.
  • Do not rely on browser defaults without an explicit header.
  • Do not put secrets in URLs; a referrer policy is not the only way URLs leak.

Policy values

  • no-referrer: sends nothing.
  • no-referrer-when-downgrade: sends the full URL, except from HTTPS to HTTP.
  • origin: sends only the scheme, host and port.
  • origin-when-cross-origin: the full URL within the site, only the origin elsewhere.
  • same-origin: the full URL within the site, nothing elsewhere.
  • strict-origin: only the origin, and nothing from HTTPS to HTTP.
  • strict-origin-when-cross-origin: the full URL within the site, only the origin elsewhere, and nothing from HTTPS to HTTP.
  • unsafe-url: the full URL everywhere.

FAQ

Why not just use no-referrer everywhere?

no-referrer eliminates all referrer data, including same-origin referrers used by internal analytics, CSRF protection mechanisms, and server-side logging. Applications that track navigation paths, attribute internal conversions, or validate request origins lose that signal entirely. strict-origin-when-cross-origin preserves same-origin referrer data while restricting cross-origin leakage to the origin only.

Does Referrer-Policy affect analytics tracking?

It can. Third-party analytics tools that rely on the Referer header for page-level traffic attribution receive less data under strict policies. With strict-origin-when-cross-origin, external analytics see which domain sent the request but not which page. First-party analytics on the same origin still receive the full URL. Most analytics platforms have adapted to use JavaScript-based tracking that does not depend on the Referer header.

Can Referrer-Policy be set per element instead of globally?

Yes. HTML elements accept a referrerpolicy attribute, and fetch requests accept a referrerPolicy option. These override the document-level policy for specific resources. This is useful for embedding third-party widgets that require referrer data while maintaining a strict global policy. The global header sets the baseline; element-level attributes provide targeted exceptions.

What is the difference between Referrer-Policy and the Referer header?

Referrer-Policy is a response header set by the server to control browser behavior. The Referer header is a request header sent by the browser when navigating or loading resources, containing the URL of the referring page. Referrer-Policy governs what value the browser places in Referer. The misspelling of Referer (missing double r) is a historical artifact preserved for backward compatibility.

Do modern browsers already default to strict-origin-when-cross-origin?

Current Chrome, Edge and Firefox do. However, relying on browser defaults means the policy is invisible in server configuration, cannot be audited or enforced centrally, and fails silently in older browsers or non-standard clients. Setting the header explicitly makes the policy declarative and verifiable.

Does Referrer-Policy protect against all URL leakage?

No. It controls only the Referer request header. URLs can also leak through server logs, browser history, cached pages, the Origin header on CORS requests, and JavaScript APIs like document.referrer. Referrer-Policy addresses the most common and automated leak vector but is not a substitute for keeping sensitive data out of URLs entirely.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.