<zhead>
Meta tags

referrer

Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information.

Parameters

no-referrer
Sends no referrer information.
<meta name="referrer" content="no-referrer">
no-referrer-when-downgrade
Sends the full URL unless a secure page requests an insecure resource.
<meta name="referrer" content="no-referrer-when-downgrade">
origin
Sends only the document origin.
<meta name="referrer" content="origin">
origin-when-cross-origin
Sends the full URL to the same origin and only the origin elsewhere.
<meta name="referrer" content="origin-when-cross-origin">
same-origin
Sends the full URL to the same origin and no referrer elsewhere.
<meta name="referrer" content="same-origin">
strict-origin
Sends only the origin, and sends nothing on a downgrade from HTTPS to HTTP.
<meta name="referrer" content="strict-origin">
strict-origin-when-cross-origin
Sends the full URL to the same origin, only the origin across equally secure origins, and nothing on an HTTPS to HTTP downgrade.
<meta name="referrer" content="strict-origin-when-cross-origin">
unsafe-url
Sends the full URL with same-origin and cross-origin requests, including HTTPS to HTTP downgrades.
<meta name="referrer" content="unsafe-url">
export type Referrer =
     /**
   * Sends no referrer information.
  **/
    'no-referrer'
    /**
   * Sends the full URL unless a secure page requests an insecure resource.
  **/
    'no-referrer-when-downgrade'
    /**
   * Sends only the document origin.
  **/
    'origin'
    /**
   * Sends the full URL to the same origin and only the origin elsewhere.
  **/
    'origin-when-cross-origin'
    /**
   * Sends the full URL to the same origin and no referrer elsewhere.
  **/
    'same-origin'
    /**
   * Sends only the origin, and sends nothing on a downgrade from HTTPS to HTTP.
  **/
    'strict-origin'
    /**
   * Sends the full URL to the same origin, only the origin across equally secure origins, and nothing on an HTTPS to HTTP downgrade.
  **/
    'strict-origin-when-cross-origin'
    /**
   * Sends the full URL with same-origin and cross-origin requests, including HTTPS to HTTP downgrades.
  **/
    'unsafe-url'

Code examples

Good example
<meta name="referrer" content="same-origin">
Keeps full referrers within the site and sends no referrer to other origins.
Good example
<meta name="referrer" content="strict-origin-when-cross-origin">
The current default balances same-origin diagnostics with less cross-origin disclosure.
Avoid this example
<meta name="referrer" content="strict-origin-when-crossorigin">
This misspelling is not the standard policy token. Use strict-origin-when-cross-origin.
Avoid this example
<meta name="referrer" content="unsafe-url">
This sends full URLs across origins and even on HTTPS to HTTP downgrades, so it can reveal path and query data.

Recommendations

  • 01
    Know the Current Default
    The modern default is strict-origin-when-cross-origin. Add this tag when the page needs a different policy, or when you want the choice to be explicit.
  • 02
    Avoid Secrets in URLs
    A stricter policy reduces referrer disclosure, but sensitive data still does not belong in paths or query strings.

Related documentation

Related meta tags

Content-Security-Policy

http-equiv

Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs.

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; base-uri 'self';">
Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin.

referrer

name

Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information.

<meta name="referrer" content="same-origin">
Keeps full referrers within the site and sends no referrer to other origins.

refresh

http-equiv

Reloads the current page after a delay or performs a timed redirect. Automatic navigation can confuse users, so a server redirect is usually a better choice.

<meta http-equiv="refresh" content="5; URL=https://example.com/next">
Valid timed redirect syntax. Prefer an HTTP redirect unless the visible delay serves a real purpose.