---
title: "Share less in the Referer header · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/browser-security-headers/referrer-policy
id: APS-31
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 755
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Share less in the Referer header

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Browser security headers](https://agentwranglers.se/playbook/application-security/browser-security-headers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-31
- Level: Recommended
- Chapter: [Browser security headers](https://agentwranglers.se/playbook/application-security/browser-security-headers.md)
- Rule: Keep `Referrer-Policy` at the browser default, `strict-origin-when-cross-origin`, or stricter. Send it on every response, so no framework default, meta tag or old browser loosens it.
- Check: `curl -sI` on a page and an error page shows `strict-origin-when-cross-origin`, `same-origin` or `no-referrer`. A search of the built pages finds no `referrerpolicy` attribute or `<meta name="referrer">` with `unsafe-url`, `no-referrer-when-downgrade`, `origin` or `origin-when-cross-origin`.
- How: Current browsers already default to `strict-origin-when-cross-origin`, so the header mostly guards against looser settings. A framework, a CMS plugin or a `<meta name="referrer">` tag can set `unsafe-url` or `no-referrer-when-downgrade`, which send full addresses to other sites. Use `same-origin` or `no-referrer` on pages whose addresses carry tokens. Keep private data out of addresses in the first place, as [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### HTTP example

```http
Referrer-Policy: strict-origin-when-cross-origin
```

## Sources

- [W3C Referrer Policy](https://www.w3.org/TR/referrer-policy/)

## Related rules

- APS-79 [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/referrer-policy">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep other sites' windows apart](https://agentwranglers.se/playbook/application-security/browser-security-headers/cross-origin-isolation.md)
- Next: [Switch off browser features you don't use](https://agentwranglers.se/playbook/application-security/browser-security-headers/permissions-policy.md)
- [Browser security headers](https://agentwranglers.se/playbook/application-security/browser-security-headers.md)