In short. Referrer-Policy controls whether a browser sends a referring URL, its origin, or no Referer header.

Definition: Referrer-Policy is an HTTP response header that controls which referral information a browser sends in the Referer request header when loading resources or following links from a page. A policy can retain a referring URL, reduce it to its origin, or suppress the header.

Key facts

The W3C Referrer Policy specification defines the header for requests made from the protected resource’s context, including outgoing navigation.
As of October 2026, the W3C editor’s draft defines strict-origin-when-cross-origin as the default policy.
Google’s Chrome policy explanation states that this policy removes the referring page’s path and query string from cross-origin referral information, affecting analytics that rely on the full URL.
The IETF’s HTTP Semantics specification requires browsers to exclude URL fragments and user information from Referer values.

What information does each policy allow?

An origin consists of a URL’s scheme, host and port. The W3C editor’s draft describes removing the path and query to leave these components. Requests within the same origin are same-origin requests; requests between different origins are cross-origin requests.

Under strict-origin-when-cross-origin, same-origin navigation retains the referring URL, subject to the required removal of fragments and credentials. Cross-origin navigation between HTTPS pages sends only the origin. Navigation from an HTTPS page to an ordinary HTTP destination omits the header.

In the draft’s example, navigation from https://example.com/page.html to https://not.example.com/ sends:

Referer: https://example.com/

The no-referrer policy omits the header for every destination. The same-origin policy omits it for cross-origin requests while retaining referral information within the same origin.

The published W3C Candidate Recommendation, dated 26 January 2017, describes no-referrer-when-downgrade as its default. The editor’s draft provides the updated baseline.

Where does a website set the policy?

The W3C editor’s draft header example supplies this response header to suppress outgoing referral information:

Referrer-Policy: no-referrer

The same specification also describes an HTML meta element named referrer, a referrerpolicy attribute on individual elements, and the noreferrer link relation.

The header governs requests originating from the resource’s context. Consequently, setting it on a receiving website governs that website’s subsequent requests; an incoming visit’s referral information depends on the referring context’s policy.

How does this affect referral measurement?

Google’s Chrome explanation identifies reduced detail in server logs and analytics that depend on a complete referring URL. An origin-only value can identify a source website while omitting the particular source page and its query parameters. A suppressed header removes that referral signal from the request entirely.

As of October 2026, Google’s Network panel reference documents inspecting a selected request through the Headers tab. A practical check compares Response Headers on the referring document, including Referrer-Policy, with Request Headers on the destination request, including Referer. The reference warns that cached requests can show provisional headers; disabling caching allows inspection of the full request headers.

FAQ

Can I recover the referring page from an origin-only header?

You receive only the origin in that header. The W3C stripping algorithm removes the path and query when producing an origin-only value.

Does an absent Referer always indicate a restrictive policy?

The IETF’s HTTP Semantics specification also covers addresses entered from the keyboard and bookmarks: the browser must omit Referer or send about:blank when the source has no URI of its own.

Why are Referer and Referrer-Policy spelled differently?

The W3C header definition explains that Referrer-Policy does not share the historical misspelling in the Referer header name.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer