Referrer-Policy header

How much of the current address is handed to other sites when a visitor clicks a link. The loose values send the full URL, query string and all.

• Help center

When a visitor follows a link or the page loads a third-party resource, the browser sends the Referer header with the address of the page they came from. That address can contain a lot: password-reset tokens, search queries, order numbers, internal paths. Referrer-Policy decides how much of it leaves your site.

How SiteScan grades it

• “Strong”: a value that does not send the full URL to other sites — strict-origin-when-cross-origin, strict-origin, same-origin, origin or no-referrer;
• “Weak”: unsafe-url, no-referrer-when-downgrade or origin-when-cross-origin — these still pass the full address, path and query string to other sites;
• “Missing”: no header. Modern browsers then use strict-origin-when-cross-origin by default, but older ones and some embedded browsers do not.

Recommended value

Referrer-Policy: strict-origin-when-cross-origin — your own pages get the full address for analytics, other sites see only the domain, and nothing is sent from HTTPS to HTTP. If even the domain is sensitive, use no-referrer. Partner programmes still see where traffic came from, just not the exact page. See the other security headers in the group.