files/en-us/web/http/reference/headers/referrer-policy/index.md
The HTTP Referrer-Policy {{Glossary("response header")}} controls how much referrer information (sent with the {{HTTPHeader("Referer")}} header) should be included with requests.
Aside from the HTTP header, you can set this policy in HTML.
Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url
[!NOTE] The header name {{HTTPHeader("Referer")}} is a misspelling of the word "referrer". The
Referrer-Policyheader does not share this misspelling.
no-referrer
no-referrer-when-downgrade
origin
https://example.com/page.html will send the referrer https://example.com/.origin-when-cross-origin
same-origin
strict-origin
strict-origin-when-cross-origin (default)
: Send the origin, path, and query string when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS). Don't send the {{HTTPHeader("Referer")}} header to less secure destinations (HTTPS→HTTP).
[!NOTE] This is the default policy if no policy is specified, or if the provided value is invalid (see spec revision November 2020). Previously the default was
no-referrer-when-downgrade.
unsafe-url
: Send the origin, path, and query string when performing any request, regardless of security.
[!WARNING] This policy will leak potentially-private information from HTTPS resource URLs to insecure origins. Carefully consider the impact of this setting.
You can also set referrer policies inside HTML. For example, you can set the referrer policy for the entire document with a {{HTMLElement("meta")}} element with a name of referrer:
<meta name="referrer" content="origin" />
You can specify the referrerpolicy attribute on {{HTMLElement("a")}}, {{HTMLElement("area")}}, {{HTMLElement("img")}}, {{HTMLElement("iframe")}}, {{HTMLElement("script")}}, or {{HTMLElement("link")}} elements to set referrer policies for individual requests:
<a href="http://example.com" referrerpolicy="origin">…</a>
Alternatively, you can set a noreferrer link relation on an a, area, or link elements:
<a href="http://example.com" rel="noreferrer">…</a>
[!WARNING] As seen above, the
noreferrerlink relation is written without a dash. When you specify the referrer policy for the entire document with a {{HTMLElement("meta")}} element, it should be written with a dash:<meta name="referrer" content="no-referrer">.
CSS can fetch resources referenced from stylesheets. These resources follow a referrer policy as well:
strict-origin-when-cross-origin), unless it's overwritten by a Referrer-Policy HTTP header on the CSS stylesheet's response.style attributes, the owner document's referrer policy is used.no-referrer| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | anywhere | (no referrer) |
no-referrer-when-downgrade| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | https://example.com/otherpage | https://example.com/page |
https://example.com/page | https://mozilla.org | https://example.com/page |
https://example.com/page | http://example.com | (no referrer) |
| http://example.com/page | anywhere | http://example.com/page |
origin| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | anywhere | https://example.com/ |
origin-when-cross-origin| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | https://example.com/otherpage | https://example.com/page |
https://example.com/page | https://mozilla.org | https://example.com/ |
https://example.com/page | http://example.com/page | https://example.com/ |
same-origin| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | https://example.com/otherpage | https://example.com/page |
https://example.com/page | https://mozilla.org | (no referrer) |
strict-origin| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | https://mozilla.org | https://example.com/ |
https://example.com/page | http://example.com | (no referrer) |
| http://example.com/page | anywhere | http://example.com/ |
strict-origin-when-cross-origin| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page | https://example.com/otherpage | https://example.com/page |
https://example.com/page | https://mozilla.org | https://example.com/ |
https://example.com/page | http://example.com | (no referrer) |
unsafe-url| From document | Navigation to | Referrer used |
|---|---|---|
https://example.com/page?q=123 | anywhere | https://example.com/page?q=123 |
If you want to specify a fallback policy in case the desired policy hasn't got wide enough browser support, use a comma-separated list with the desired policy specified last:
Referrer-Policy: no-referrer, strict-origin-when-cross-origin
In the above scenario, no-referrer is used only if the browser does not support the strict-origin-when-cross-origin policy.
[!NOTE] Specifying multiple values is only supported in the
Referrer-PolicyHTTP header, and not in thereferrerpolicyattribute.
You can configure the default referrer policy in Firefox preferences. The preference names are version specific:
network.http.referer.defaultPolicy (and network.http.referer.defaultPolicy.pbmode for private networks)network.http.referer.userControlPolicyAll of these settings take the same set of values: 0 = no-referrer, 1 = same-origin, 2 = strict-origin-when-cross-origin, 3 = no-referrer-when-downgrade.
{{Specifications}}
{{Compat}}