How to check referrer-policy header

Read the response header of the document: curl -sI https://example.org/ | grep -i referrer-policy. The value names how much of the current URL the browser attaches to outgoing requests. No header at all is still a policy, because Chrome, Firefox and Safari fall back to strict-origin-when-cross-origin.

Why check this

The Referer request header carries the address of the page the user came from. If that address holds a password reset token, an invitation code, a document id or an email address, every third-party script, image and outbound link on the page receives it. A policy of unsafe-url on a reset page hands the token to an analytics vendor in plain text.

Run this check on the pages whose URLs contain secrets, not on the homepage: reset links, magic links, shared document views, anything under a signed URL. Run it again after a marketing tag, a chat widget or an error tracker is added, since those load from other origins and are exactly what the policy governs.

Prerequisites

• curl 7.0 or later. Any build works. See the curl manual.
• A page whose URL carries an identifier, so the finding is about real data and not a theory.
• The MDN list of Referrer-Policy values, which gives the sent value for each policy in each of the four navigation cases.

Steps

1. 1

   Step 1.

   Read the header on the document response.

   curl -sI https://www.cloudflare.com/ | grep -i 'referrer-policy'
   

   referrer-policy: strict-origin-when-cross-origin

   Same origin requests get the full URL. Cross origin requests get the scheme, host and port only. A downgrade from HTTPS to HTTP gets nothing.

2. 2

   Step 2.

   Count the header on a host that does not send it, so a missing policy is a number you can assert on.

   curl -sI https://example.com/ | grep -ci 'referrer-policy'
   

   0

3. 3

   Step 3.

   Read a host that sends two policies in one header and work out which one applies.

   curl -sI https://api.github.com/ | grep -i 'referrer-policy'
   

   referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin

   The browser walks the list left to right and keeps the last token it recognises, so a modern browser applies strict-origin-when-cross-origin here. The first token is the fallback for a browser that does not know the second.

4. 4

   Step 4.

   Count the per page overrides in the HTML, because a meta tag or a referrerpolicy attribute beats the header for the elements it covers.

   curl -s https://www.cloudflare.com/ | grep -coE '<meta[^>]+name="referrer"|referrerpolicy='
   

   0

   Zero means the header governs every request this document makes. A non-zero count is the list of places to read before you report the page as safe.

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | strict-origin-when-cross-origin | Full URL to your own origin, origin only to others, nothing on a downgrade | Nothing. This is the value to aim for on ordinary pages. | | no-referrer | No Referer is sent anywhere | Keep it on token pages. Expect analytics attribution to go blank. | | unsafe-url | Full URL including path and query goes to every origin | Treat as a defect on any page whose URL holds an identifier. | | origin-when-cross-origin | Origin is sent even when HTTPS downgrades to HTTP | Move to the strict- variant, which drops the header on a downgrade. | | No header at all | The browser default applies | Set the header explicitly. A default you did not choose changes with the browser. |

Thresholds

Common mistakes

What to check next

• How to check security headers: reads this header alongside the rest of the set in one request.
• How to check CSP header: controls which third parties can load at all, which limits who receives any referrer.
• How to check SameSite cookie attribute: the other setting that decides what leaves your origin on a cross-site request.
• How to check if HSTS is enabled: removes the HTTPS to HTTP downgrade case that the strict policies exist to cover.
• Security headers checker: paste a URL and read this header with the others.

FAQ

How to check referrer policy in the browser?

Open DevTools, Network tab, click any outgoing request, then the Headers panel and read the Referer request header. That shows the value the policy produced, which is stronger evidence than the policy name.

Does the header apply to images and scripts as well as links?

Yes. The policy covers every request the document makes: images, scripts, fetch calls, form posts and navigations. A single referrerpolicy attribute on one element overrides it for that element only.

Is Referer spelled wrong?

The request header is Referer, with one r, from a typo in the original 1996 specification. The response header that controls it is Referrer-Policy, spelled correctly. Match both spellings when you grep.

Which value should a login page use?

no-referrer on any URL that carries a token, strict-origin-when-cross-origin everywhere else. Decide per route, because a site-wide no-referrer removes attribution data the marketing team depends on.

Verified