Referrer-Policy

How it works

When a page loads an image, a script, or a frame, or a visitor follows a link, the browser can send the page URL in the Referer header. Referrer-Policy sets how much of that URL goes out: the full URL, only the origin, or nothing. The full URL means the origin, path, and query string.

You can set the policy for the whole page with the header or with <meta name="referrer">. You can set it for one element with the referrerpolicy attribute on <iframe>, <a>, <img>, <script>, and <link>. On an iframe, the referrerpolicy attribute sets the policy for the request that loads the frame.

Values

Value	What the browser sends
no-referrer	Nothing.
no-referrer-when-downgrade	The full URL, but nothing from HTTPS to HTTP.
origin	Only the origin.
origin-when-cross-origin	The full URL to the same origin. Only the origin to other origins and from HTTPS to HTTP.
same-origin	The full URL to the same origin. Nothing to other origins.
strict-origin	Only the origin, and nothing from HTTPS to HTTP.
strict-origin-when-cross-origin (default)	The full URL to the same origin. Only the origin to other origins. Nothing from HTTPS to HTTP.
unsafe-url	The full URL to all pages, also from HTTPS to HTTP. This can leak private data in the URL.

The browser also uses the default when the value is not valid.

<iframe
  src="https://partner.example/widget"
  referrerpolicy="no-referrer"
></iframe>

Referrer-Policy: strict-origin-when-cross-origin