---
title: "Share less in the Referer header · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/referrer-policy
updated: 2026-10-20
licence: "All rights reserved"
---

# Share less in the Referer header

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Send `Referrer-Policy: strict-origin-when-cross-origin` or stricter. It limits what other sites learn about the page a visitor came from.
- How: Send `Referrer-Policy: strict-origin-when-cross-origin` on every response.
- Check: `curl -sI` on a page and an error page shows `strict-origin-when-cross-origin`, `same-origin` or `no-referrer`.

Example:

```http
Referrer-Policy: strict-origin-when-cross-origin
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/referrer-policy`.

- Previous: [Keep other sites' windows apart](https://agentwranglers.se/playbook/website/security/cross-origin-isolation)
- Next: [Switch off browser features you don't use](https://agentwranglers.se/playbook/website/security/permissions-policy)
- [Security](https://agentwranglers.se/playbook/website/security)