What does Referrer-Policy control?

It controls how much URL information the browser sends in the Referer header when navigating away from your page. This affects outbound link clicks, embedded resources, and API requests.

What is the recommended Referrer-Policy value?

strict-origin-when-cross-origin is recommended for most sites. It provides full referrer data for same-origin navigation (useful for analytics) while limiting cross-origin referrers to just the origin domain.

Does Referrer-Policy affect SEO?

Using no-referrer prevents destination sites from seeing your URL in their analytics, but this does not affect search engine ranking. Google and Bing receive referrer data through Search Console, not via the HTTP Referer header.

Referrer-Policy Header Explained

Referrer-Policy is an HTTP response header that controls how much referrer information is sent when a user navigates away from your site. Setting it to strict-origin-when-cross-origin or no-referrer prevents sensitive URL paths, query parameters, and internal page structures from leaking to third-party sites.

Recommended Value

Referrer-Policy: strict-origin-when-cross-origin

What Each Directive Does

Directive	Purpose
`no-referrer`	Never send any referrer information
`strict-origin-when-cross-origin`	Send full URL for same-origin, only origin for cross-origin HTTPS, nothing for HTTPS→HTTP
`same-origin`	Only send referrer for same-origin requests, nothing for cross-origin
`origin`	Only send the origin (scheme+host+port), never the path or query string

What Happens Without This Header

Without Referrer-Policy, the full URL (including path, query parameters, and fragments) is sent as the Referer header when users click outbound links. This can leak sensitive data like session tokens in URLs, internal admin paths, search queries, or user-specific page URLs to third-party analytics, ads, or linked sites.

How to Implement

# Nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Express.js
app.use((req, res, next) => {
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  next();
});

Testing and Report-Only

Referrer-Policy has no report-only mode. To test, check your outbound link behavior using browser DevTools Network tab — inspect the Referer header on cross-origin requests.