Referrer-Policy
Controls how much of the current URL is sent to sites you link to or load resources from.
Recommended value
Referrer-Policy: strict-origin-when-cross-origin
What it does
The Referer header leaks. If your URLs contain reset tokens, search terms, document ids or account numbers, every third-party script and every outbound link is a chance to hand them to someone else.
strict-origin-when-cross-origin is the modern browser default and a sensible explicit setting: full URL to your own origin, origin only to other https sites, nothing at all when downgrading to http.
unsafe-url is the value to watch for. It sends the full URL — path and query — to every destination regardless of origin. no-referrer is the most private and occasionally breaks analytics or CSRF checks that rely on Referer.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: