Skip to main content
Yoryantra
Home/Tools
← Back to Tools

Referrer Policy Generator

Build one Referrer-Policy value and preview same-origin, cross-origin, and downgrade behavior.

Choose how much referrer information may leave a page

strict-origin-when-cross-origin

Full same-origin referrer, origin cross-origin at the same security level, nothing on HTTPS-to-HTTP downgrade.

Output

Generated Referrer-Policy output will appear here.
Referrer changes can alter attribution, third-party dashboards, fraud signals, and login handoffs. Test the actual navigation and resource requests that matter before a site-wide rollout.

A referrer policy changes what leaves the current URL

Browsers can send a Referer request header when a page follows a link or loads another resource. Referrer-Policy decides whether that value contains the full source URL, only its origin, or nothing at all.

Paths and query strings can reveal more context than intended—for example an account section, search term, campaign parameter, or internal route. The policy is therefore a privacy boundary as well as a deployment setting.

The current browser default already has downgrade protection

strict-origin-when-cross-origin is the current default when no valid policy is supplied. It keeps a full referrer on same-origin requests, sends only the origin to same-security cross-origin destinations, and sends nothing when an HTTPS page requests an HTTP destination.

The older no-referrer-when-downgrade value prevents downgrade leakage but can still send a full path and query string to an HTTPS third party. That difference matters when old configuration is copied forward.

“Origin only” and “same-origin only” solve different problems

strict-origin

Cross-origin destinations can still learn the source origin, but not the path or query. HTTPS-to-HTTP gets no referrer.

same-origin

Same-origin requests receive the full referrer. Cross-origin destinations receive no referrer at all.

Header, meta element, and per-element policy can coexist

The response header is a clean site or route-level control. An HTML <meta name="referrer"> element can set a document policy when response headers are not available, while elements such as links, scripts, images, and iframes can use a referrerpolicy attribute for a more specific request.

A link using rel="noreferrer" is another request-specific override. When debugging an unexpected Referer value, check all of those layers instead of assuming the response header is the only source.

The policy cannot remove sensitive data that has already leaked elsewhere

Referrer-Policy does not sanitize URLs, fix third-party scripts, or protect query parameters copied into logs, analytics payloads, browser history, or application code. Avoid putting secrets in URLs even when a strict referrer policy is present.

Standards and browser behavior

The Referrer Policy specification defines the policy values and how Fetch derives a referrer. MDN documents the current default and the request behavior of each value. Test in the browsers and embedded contexts your application actually supports.

References: W3C Referrer Policy and MDN Referrer-Policy.