Glossary Term

Referrer Policy

glossary referrer policy featured

Referrer policy is a browser rule that decides how much of the current URL gets sent in the referrer header when a visitor follows a link or a page requests an external resource. It exists to stop private paths and query strings leaking to other sites. Every modern browser applies a default policy, and any site can override it with the Referrer-Policy response header, a meta tag, or a per-link attribute.

Referrer Policy Values

Eight values are defined in the W3C Referrer Policy specification. Each answers two questions: is the destination the same origin, and does the request downgrade from HTTPS to HTTP.

Assume the visitor is on https://linkutm.com/blog/utm-guide?id=42. This is what each policy sends:

Value Same origin Cross origin HTTPS to HTTP
no-referrer Nothing Nothing Nothing
no-referrer-when-downgrade Full URL Full URL Nothing
origin Origin only Origin only Origin only
origin-when-cross-origin Full URL Origin only Origin only
same-origin Full URL Nothing Nothing
strict-origin Origin only Origin only Nothing
strict-origin-when-cross-origin Full URL Origin only Nothing
unsafe-url Full URL Full URL Full URL

“Full URL” means https://linkutm.com/blog/utm-guide?id=42. “Origin only” means https://linkutm.com/. Fragments (#section) and credentials are always stripped, whatever the policy.

Avoid unsafe-url. It sends paths and query strings to every third party, including password reset tokens and internal search terms sitting in URLs.

How to Set a Referrer Policy

Four mechanisms exist, and the most specific one wins.

1. Response header, applied site-wide. This is the recommended approach.

Referrer-Policy: strict-origin-when-cross-origin
  • nginx: add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  • Apache: Header set Referrer-Policy "strict-origin-when-cross-origin

2. Meta tag, applied to one document. Place it in the <head> above any resource that matters, because it only governs requests made after the browser parses it.

<meta name="referrer" content="strict-origin-when-cross-origin">

3. Element attribute, applied to one request. Works on <a>, <img>, <iframe>, <link>, <script>, and <area>.

<a href="https://partner.example.com" referrerpolicy="no-referrer">Partner</a>

4. Fetch option, applied to one call.

fetch('https://api.example.com/data', { referrerPolicy: 'origin' });

rel="noreferrer on a link overrides all of the above for that link. Comma-separated values give older browsers a fallback, since the browser applies the last value it recognizes: Referrer-Policy: no-referrer, strict-origin-when-cross-origin.

Browser Defaults

Browsers default to strict-origin-when-cross-origin, which means other sites see your domain but never your paths.

  • Chrome adopted it as the default in version 85, released August 2020.
  • Firefox followed in version 87, released March 2021.
  • Edge inherits the Chromium default.
  • Safari trims cross-site referrers to the origin under Intelligent Tracking Prevention and strips them entirely in Private Browsing.

The old default was no-referrer-when-downgrade, which sent full URLs to any HTTPS destination. That is why analytics reports from before 2020 show complete referring URLs and current ones rarely do.

Why Referrer Policy Matters

It decides what leaves your site, not what arrives. A policy set on linkutm.com controls what a visitor’s browser reveals when they click out to another domain. It cannot make other sites send you their referrers.

Two consequences follow. Privately, URLs often carry sensitive data: invite links, reset tokens, account IDs, internal search queries. A loose policy hands all of that to every embedded script and outbound link.

Commercially, strict policies flatten referral reporting. Partners, publishers, and affiliates who once saw the exact referring article now see a bare domain, and traffic from apps or downgraded requests arrives with nothing at all. UTM parameters sit in the destination URL itself, so they survive every policy, which is why campaign tags outperform referrer data for attribution.

Common Referrer Policy Mistakes

  • Expecting it to control incoming referrers. Your policy applies only to requests your pages initiate.
  • Using unsafe-url to improve analytics. The gain is minor. The leakage is permanent.
  • Placing the meta tag low in the page. Requests made above it use the previous policy.
  • Confusing rel="noopener with rel="noreferrer. Only the second suppresses the referrer.
  • Treating it as a security control. Referrer values are client-supplied and forgeable. Use CSRF tokens and SameSite cookies instead.
  • Setting no-referrer sitewide by reflex. It breaks partner attribution, affiliate validation, and your own outbound credit for no privacy gain beyond the default.

Check any site’s policy in DevTools under Network, Response Headers. Mozilla Observatory and securityheaders.com both grade the value automatically.

Frequently Asked Questions

What is a referrer policy?

A referrer policy is a rule that tells browsers how much of the current URL to include in the referrer header on outgoing requests. It can send the full URL, the origin alone, or nothing, and it can vary that by destination. Sites set it with the Referrer-Policy HTTP header, a <meta name="referrer"> tag, or a referrerpolicy attribute on individual elements. Without an explicit setting, the browser default applies.

What does strict-origin-when-cross-origin mean?

It sends the full URL to pages on the same origin, only the origin to other origins, and nothing when the request downgrades from HTTPS to HTTP. Chrome made it the default in August 2020 and Firefox in March 2021. It is the recommended balance: internal analytics keep full paths, external sites learn only the domain, and no data crosses an insecure connection.

What is no-referrer-when-downgrade?

It sends the full URL everywhere except when moving from HTTPS to HTTP, where it sends nothing. This was the universal browser default before 2020. It is still valid but leaks paths and query strings to every third-party domain, so strict-origin-when-cross-origin has replaced it as the sensible baseline.

How do you set a referrer policy with a meta tag?

Add <meta name="referrer" content="strict-origin-when-cross-origin"> inside the <head>, as early as possible. The tag governs only requests the browser makes after parsing it, so anything loaded above it uses the previous policy. The meta tag is useful when server headers cannot be edited, though the HTTP header is more reliable because it applies before parsing begins.

Which referrer policy is best?

strict-origin-when-cross-origin suits most public websites and is already the default. Use same-origin for admin panels and internal tools that should reveal nothing externally, and no-referrer on authentication or password reset pages where the URL itself is a secret. Never use unsafe-url.

Since strict referrer policies hide the referring URL, tag your campaign links with the free UTM builder at linkutm so attribution survives.

Back to Glossary