Referrer-Policy header values, compared (tested in Chrome)
Referrer-Policy controls how much of the current URL goes out in the Referer header. We measured every value in Chrome on a page whose URL held ?secret=abc.
1. What Chrome sent
Page: http://localhost:8981/page?secret=abc. fetch() and a normal link click gave the same result for every value.
| Referrer-Policy | Same origin | Other origin |
|---|---|---|
| (header not set) | Full URL | Origin only (http://localhost:8981/) |
strict-origin-when-cross-origin | Full URL | Origin only |
origin-when-cross-origin | Full URL | Origin only |
same-origin | Full URL | None |
origin | Origin only | Origin only |
strict-origin | Origin only | Origin only |
no-referrer | None | None |
no-referrer-when-downgrade | Full URL | Full URL incl. ?secret=abc |
unsafe-url | Full URL | Full URL incl. ?secret=abc |
The no-header row matches strict-origin-when-cross-origin: that is Chrome's default, so other sites never see your paths or query strings unless you opt in with no-referrer-when-downgrade or unsafe-url. Those two are the values to avoid when URLs carry tokens, emails or search terms.
2. HTTPS page linking to HTTP
The strict- values and no-referrer-when-downgrade send nothing when an HTTPS page requests an HTTP URL; origin, origin-when-cross-origin and unsafe-url still send. (Spec behaviour; our test servers were both HTTP.)
3. Meta tag vs header
<meta name="referrer" content="no-referrer"> alone removed the Referer everywhere. With the header set to unsafe-url and that meta tag on the same page, Chrome sent no Referer: the meta tag, read later, won.
4. Setting it
# nginx (server block; 'always' also covers error pages)
add_header Referrer-Policy strict-origin-when-cross-origin always;
# Apache (mod_headers)
Header always set Referrer-Policy "strict-origin-when-cross-origin"Setting the default explicitly keeps older browsers and security scanners happy. Use same-origin or no-referrer for pages whose URLs are private. As with every nginx header, a nested location with its own add_header drops it (measured here with HSTS). Verify with curl -sI https://your-site/ | grep -i referrer-policy.
Frequently asked questions
What is the default Referrer-Policy?
strict-origin-when-cross-origin. In our Chrome test a page with no header behaved exactly like it: full URL to the same origin, origin only to other sites.
Which Referrer-Policy leaks the query string to other sites?
no-referrer-when-downgrade and unsafe-url. Both sent the full URL including ?secret=abc to a different origin in our test.
Does the meta referrer tag override the header?
In our test, yes: header unsafe-url plus meta no-referrer sent no Referer at all.
Is it Referer or Referrer?
The request header is spelled Referer (a historic typo); the policy header is Referrer-Policy.
Written with AI assistance. Measured on 2026-10-01 in Chromium 153: a page at localhost:8981/page?secret=abc sent each Referrer-Policy value, then fetch() and a link click went to the same origin and to a different origin (127.0.0.1:8982), and a local server logged the Referer it received. Both origins were plain HTTP on this machine, so the HTTPS-to-HTTP downgrade rows are from the spec, not this test. PlainHeaders is our extension; the other methods are free.