Referrer-Policy Header Builder

The Referrer-Policy header controls how much of your URL travels in the Referer request header when someone follows a link out or the page fetches a subresource. Pick one of the eight standard policies and the builder shows exactly what a receiving server would see in three situations that matter: a request to your own origin, a cross-origin request over HTTPS, and a cross-origin request that downgrades to plain HTTP. Both the response-header form and the <meta name="referrer"> form are emitted, so you can set the policy at the server or inside HTML that a CDN has already cached.

The spelling is not a typo on our side. The header was written Referer in the 1996 HTTP specification, the mistake was noticed too late to change, and every implementation has carried it since. The policy header that controls it is spelled correctly, as is the JavaScript property document.referrer, so any code touching both has to get the two spellings right in the same file.

The default matters more than most people realise, because it changed. Browsers used to send the full URL to any HTTPS destination, and modern Chrome, Firefox and Safari now default to strict-origin-when-cross-origin: your own origin gets the whole URL, another origin gets only the scheme and host, and a downgrade to HTTP gets nothing at all. That default is already a sensible privacy position, which means the main reasons to set the header explicitly are to tighten it further or to document the intent.

Tightening has a cost worth weighing. A URL leaks whatever is in its path and query string — a password-reset token, a document identifier, a search phrase someone typed — and no-referrer closes that completely. It also erases your site from every analytics dashboard you would otherwise appear in, breaks referral attribution for partners who measure traffic you send them, and stops some servers accepting the request at all, because hotlink protection is usually implemented by checking exactly this header. strict-origin is the middle position: the receiving site learns you sent the visitor without learning which page they were on.