Security headers

How to fix: Referrer-Policy header

Referrer-Policy controls how much of the current page's URL is sent to other sites in the Referer header when a visitor clicks a link or loads a resource.

Not sure whether your site has this problem? Check it in seconds.

Run a free audit

Why it matters

Full URLs can contain private details such as account IDs, search terms or reset tokens. Limiting what is shared reduces accidental leakage to third-party sites and analytics.

How to check

Look for Referrer-Policy in the response headers, or a <meta name="referrer"> tag in the page.

How to fix it

Header value

Referrer-Policy: strict-origin-when-cross-origin

Nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Next.js (next.config.ts)

const nextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }],
      },
    ];
  },
};
export default nextConfig;

Common mistakes

Choosing no-referrer when you rely on referrer data for your own analytics or affiliate tracking: you'll lose it. strict-origin-when-cross-origin is a good balance for most sites.

Frequently asked questions

Don't browsers already default to a safe value?

Current browsers default to strict-origin-when-cross-origin, but setting it explicitly makes your behaviour consistent across browsers and versions.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.