Referrer-Policy Header Builder
The Referrer-Policy header controls how much of your URL is included in the `Referer` request header when users click links or your page makes subresource requests. This builder lets you pick one of the eight standard policies and see exactly what gets sent for the three scenarios that matter: a request to the same origin, a cross-origin request over HTTPS, and a cross-origin request that downgrades to HTTP. Both the response-header and the `<meta>` form are emitted so you can apply the policy from the server or inside a CDN-cached HTML.
Referrer-Policy: strict-origin-when-cross-origin<meta name="referrer" content="strict-origin-when-cross-origin">
| Scenario | Referer sent |
|---|---|
| Same origin (HTTPS→HTTPS, same host) | https://app.example.com/page?id=42 |
| Cross-origin (HTTPS→HTTPS, different host) | https://api.other.com |
| Downgrade (HTTPS→HTTP) | (no header) |
Apply the header on every HTML response. The `<meta>` form is useful when you can't control headers (static hosting that doesn't let you set them, etc.).
How to use
- Pick a policy. The default for modern browsers is `strict-origin-when-cross-origin` — leak only the origin when leaving HTTPS for HTTPS, and nothing on a downgrade.
- Read the three example rows to see exactly what the browser would send.
- Copy the response header (preferred) or the `<meta>` tag (works inside an HTML page when you can't control headers).
Frequently asked questions
- Which policy is the safe default?
- `strict-origin-when-cross-origin`. It sends the full URL for same-origin (your analytics still works), only the origin for cross-origin HTTPS, and nothing when downgrading to HTTP. This is the implicit default in modern browsers if you don't set a policy.
- Why is `unsafe-url` flagged?
- It sends the full URL (including query string) to every destination, even on HTTPS→HTTP downgrades. Query strings often contain tokens, ids and personal info — `unsafe-url` leaks them to the network and to whatever ad/analytics/embed lives at the destination.
Related tools
HSTS Header Builder
Compose a Strict-Transport-Security header — max-age, includeSubDomains, preload — with a live preload-list eligibility check.
Permissions-Policy Header Builder
Build the `Permissions-Policy` response header — toggle camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.
CORS Headers Builder
Compose Access-Control-* response headers from a checklist, with four presets and live warnings for the dangerous combinations.
Content-Security-Policy Builder
Build a CSP header from per-directive source lists, with three starter presets and live warnings for the dangerous wildcards.
SPF Record Builder
Compose a Sender Policy Framework TXT record from mechanisms, IPs and includes — with a live DNS-lookup counter and warnings.
Cache-Control Header Builder
Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.