--- title: "referrer · Meta Tag · zhead" canonical_url: "https://zhead.dev/meta/referrer" last_updated: "2026-08-10T16:29:02.724Z" meta: description: "Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information." "og:description": "Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information." "og:title": "referrer · Meta Tag · zhead" --- Meta tags # referrer Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information. ## Parameters no-referrer Sends no referrer information. ``` ``` no-referrer-when-downgrade Sends the full URL unless a secure page requests an insecure resource. ``` ``` origin Sends only the document origin. ``` ``` origin-when-cross-origin Sends the full URL to the same origin and only the origin elsewhere. ``` ``` same-origin Sends the full URL to the same origin and no referrer elsewhere. ``` ``` strict-origin Sends only the origin, and sends nothing on a downgrade from HTTPS to HTTP. ``` ``` strict-origin-when-cross-origin Sends the full URL to the same origin, only the origin across equally secure origins, and nothing on an HTTPS to HTTP downgrade. ``` ``` unsafe-url Sends the full URL with same-origin and cross-origin requests, including HTTPS to HTTP downgrades. ``` ``` ## Code examples Good example ``` ``` Keeps full referrers within the site and sends no referrer to other origins. Good example ``` ``` The current default balances same-origin diagnostics with less cross-origin disclosure. Avoid this example ``` ``` This misspelling is not the standard policy token. Use strict-origin-when-cross-origin. Avoid this example ``` ``` This sends full URLs across origins and even on HTTPS to HTTP downgrades, so it can reveal path and query data. ## Recommendations - 01 Know the Current Default The modern default is strict-origin-when-cross-origin. Add this tag when the page needs a different policy, or when you want the choice to be explicit. - 02 Avoid Secrets in URLs A stricter policy reduces referrer disclosure, but sensitive data still does not belong in paths or query strings. ## Related documentation - [w3c.github.io: Webappsec Referrer Policy](https://w3c.github.io/webappsec-referrer-policy/) - [HTML Living Standard: Semantics](https://html.spec.whatwg.org/multipage/semantics.html#meta-referrer) ## Related meta tags ### [Content-Security-Policy](https://zhead.dev/meta/content-security-policy) http-equiv Enforces a Content Security Policy from the document head. A policy limits where scripts, styles, images, connections, and other resources can come from, which reduces the impact of content injection bugs. ``` ``` Uses the same origin by default, blocks plugin content, and limits base URLs to the same origin. ### [referrer](https://zhead.dev/meta/referrer) name Sets the document’s default Referrer-Policy. The policy controls whether requests reveal the full page URL, only its origin, or no referrer information. ``` ``` Keeps full referrers within the site and sends no referrer to other origins. ### [refresh](https://zhead.dev/meta/refresh) http-equiv Reloads the current page after a delay or performs a timed redirect. Automatic navigation can confuse users, so a server redirect is usually a better choice. ``` ``` Valid timed redirect syntax. Prefer an HTTP redirect unless the visible delay serves a real purpose.