Security Tools

Referrer-Policy Checker

Check whether a website sends a Referrer-Policy header.

Enter a domain to check whether it sends a Referrer-Policy header.

More Security Tools

X-Content-Type-Options Checker Permissions-Policy Checker X-Frame-Options Checker CORS Header Checker Content Security Policy (CSP) Checker Mixed Content Detector HSTS Checker Security Headers Checker

JustChecker monitors your security headers continuously and alerts you if any regress.

What Is Referrer-Policy?

When a visitor clicks a link, the browser can tell the destination site which page they came from. The Referrer-Policy header controls how much of that URL is shared. This tool checks the header and its value.

When to Use It

When your URLs may contain private data such as tokens or search terms.
When analytics on another site of yours shows missing referrers.

How to Use It

Enter the domain.
Check the policy value.

Understanding the Result

strict-origin-when-cross-origin is a good default and is what modern browsers use when no header is set: other sites only see your domain, not the full path. no-referrer shares nothing.

Limitations

Individual links can override the policy with a referrerpolicy attribute.

Frequently Asked Questions

By default, browsers can send the full URL of the page a visitor came from (including query strings, which sometimes contain sensitive data like search terms or session identifiers) to whatever site they navigate to next.

It sends the full referrer URL for same-site navigation, but only the origin (domain, no path/query) when navigating to a different site - and nothing at all when downgrading from https to http, balancing analytics usefulness against privacy leakage.

A stricter policy can reduce the referrer detail your OWN analytics receives from incoming visitors just as much as it protects outgoing visitors' privacy - it's a two-way effect worth considering when choosing a policy.

Maximum privacy - it strips the referrer header entirely on every navigation, at the cost of losing referrer-based analytics data both for sites you link to and sites that link to you.

It's more of a privacy consideration than a direct exploit vector - the concern is unintended information leakage (like sensitive URL parameters) to third-party sites, not a mechanism attackers actively exploit to compromise your site.

Yes - individual links can override the page-wide header via a "referrerpolicy" HTML attribute on that specific link, useful when most of your site needs one policy but a specific outbound link needs different handling.