Security Recommended

Share less in the Referer header

Send Referrer-Policy: strict-origin-when-cross-origin or stricter. It limits what other sites learn about the page a visitor came from.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Send Referrer-Policy: strict-origin-when-cross-origin on every response.

Example

Referrer-Policy: strict-origin-when-cross-origin

How to check

curl -sI on a page and an error page shows strict-origin-when-cross-origin, same-origin or no-referrer.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/referrer-policy.