`Referrer-Policy`

How much of the current URL browsers send as Referer.

Response header (sent by servers) security

How it works

strict-origin-when-cross-origin or no-referrer avoids leaking tokens or IDs in URLs to other sites.

Example

Referrer-Policy: no-referrer

See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: W3C Referrer Policy.

Related headers

`Content-Security-Policy`

Restricts what a browser page may load and run.

`Cross-Origin-Resource-Policy`

Which origins may embed this resource.

`Permissions-Policy`

Which browser features a page may use.

`Strict-Transport-Security`

Tells browsers to use HTTPS only for this host.

`X-Content-Type-Options`

Stops browsers from guessing the content type.

`X-Frame-Options`

Whether the page may be shown in a frame.