The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To check whether your website exposes paths or query strings through the Referer request header, inspect its Referrer-Policy response header, then verify actual requests in your browser’s Network panel. Test a same-origin request, a secure cross-origin request, and an HTTPS-to-HTTP request. The policy controls what the receiving site can learn about where a request came from; a full URL can reveal sensitive paths or query parameters.
What a referrer policy test checks
Referer is the intentionally misspelled name of an HTTP request header. It may tell a destination site which page initiated a request. The Referrer-Policy header is a response header that tells browsers how much referrer information to send.
These are different parts of the exchange: the policy configures browser behavior, while Referer is the outgoing request field you need to observe. A policy check therefore has two parts: inspect the page’s configured policy and check what the browser actually sends on representative requests.
The privacy concern is practical, not merely cosmetic. A URL may include internal-only paths or sensitive parameters. If a browser sends that full URL to another site, that site receives information the page owner may not have intended to disclose.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
How to test your website’s referrer policy
- Inspect the page response. Fetch the page and inspect its response headers for
Referrer-Policy. Record the exact value. Note whether it is absent or invalid; browsers use a default in either case. - Open browser developer tools. In your browser, open Developer Tools and select the Network panel. Load the page and trigger the requests you want to test, such as clicking a link or loading a resource. Select each relevant outgoing request and inspect its request headers for
Referer. - Use a safe, distinctive test URL. To tell whether a path and query survive, test from a page URL with a harmless, distinctive path and query string. Do not put passwords, tokens, personal information, or real secrets in a test URL.
- Test three destinations. Trigger a request to the same origin, one to a different HTTPS origin, and one from your HTTPS page to an HTTP destination. Use a receiver you control for cross-origin tests when possible, so you can inspect exactly what arrived.
- Compare the observed fields with the policy. Under
strict-origin-when-cross-origin, a same-origin request should carry the full page URL, a secure cross-origin request should carry only the origin, and an HTTPS-to-HTTP request should carry no referrer. - Check for narrower overrides. If an individual link or resource behaves differently from the page-level policy, inspect that element and any script making the request. Element-level attributes and fetch options can apply their own policy.
Testing only the response header is not enough to confirm what every request sends. Conversely, seeing a Referer on one request does not by itself mean the site is exposing that same value to every destination: same-origin, cross-origin, and downgrade requests can have different results.
How to read the policy results
The matrix shows the expected referrer information for the listed policies. “Full URL” means the page URL, including its path and query when present; “origin” means the scheme, host, and port, without the path or query; “none” means no Referer is sent.
| Policy | Same origin | Different HTTPS origin | HTTPS to HTTP |
|---|---|---|---|
no-referrer |
None | None | None |
same-origin |
Full URL | None | None |
strict-origin |
Origin | Origin | None |
origin-when-cross-origin |
Full URL | Origin | Origin |
strict-origin-when-cross-origin |
Full URL | Origin | None |
unsafe-url |
Full URL | Full URL | Full URL |
The modern browser default documented by MDN is strict-origin-when-cross-origin when no valid policy is specified. That default retains the full URL for same-origin requests, limits secure cross-origin requests to the origin, and suppresses the referrer on an HTTPS-to-HTTP downgrade. Do not assume the default is your intended policy: set the header explicitly and test the behavior your site needs.
Which policy should you choose?
Choose no-referrer for maximum suppression
This sends no referrer on requests. Use it when your site does not need referrer data for same-site behavior, analytics, or integrations and you want the strongest suppression of that information.
Recommended Free Tools
Choose same-origin to keep same-site context
This preserves the full URL for same-origin requests and sends no referrer to other origins. It can be a fit when your own pages need that context but cross-origin disclosure is not required.
Choose strict-origin-when-cross-origin when integrations need the origin
This retains full context within your origin but limits secure cross-origin requests to the origin, with no referrer on HTTPS-to-HTTP requests. It is the documented modern default when no valid policy is set and is a common compatibility-oriented choice when an integration needs to know the referring site but not the exact page.
Be cautious with broader policies
origin-when-cross-origin can send the origin on an HTTPS-to-HTTP downgrade. unsafe-url sends the full URL, including paths and potentially sensitive query data, even in that downgrade case. The W3C specification warns that this can disclose origins and paths from TLS-protected resources to insecure origins. Choose the strictest policy that still allows required site behavior.
Set the policy with an HTTP response header
For a general-purpose policy that keeps same-origin detail but limits cross-origin detail, configure this response header:
Referrer-Policy: strict-origin-when-cross-originIf the site can function without referrer data, use:
Referrer-Policy: no-referrerConfigure the header at the web server, hosting platform, reverse proxy, or application layer that produces the page response. After deployment, inspect the actual response rather than relying only on a configuration file: a proxy or another layer may add, replace, or omit headers.
MDN also documents a comma-separated fallback form, for example:
Referrer-Policy: no-referrer, strict-origin-when-cross-originWhen multiple values are supplied in this form, the last supported value is used. Make sure the effective value matches your intention, and retest the response after changing it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Find page-level and request-level overrides
A response header is not the only place a policy can be set. MDN documents a document meta element, referrerpolicy attributes on links and resource elements, and the Request.referrerPolicy setting for individual fetch requests. These narrower settings can explain why one request does not match the policy you expected from the response header.
- For a link, inspect its
referrerpolicyattribute. - For an image, script, or other resource, inspect the element’s policy attribute where supported.
- For a request initiated by JavaScript, inspect the fetch request’s referrer policy.
- For a document-wide setting, check the page markup as well as the response header.
When debugging, identify the exact request first, then trace how it was initiated. Avoid making a site-wide policy more permissive just to fix one integration until you know which request needs the extra information.
Or skip the browser setup
A screenshot can document what a page looked like during a test, but it cannot show the response’s Referrer-Policy or prove which Referer a destination received. Use the Network panel or a controlled request receiver for that evidence. If you also need a clean visual capture of the page, ScreenshotNeo can take one with a GET request; see the ScreenshotNeo API documentation for its options.
Rank #4
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo removes cookie banners, newsletter popups, and chat widgets before the shot; bot checks, blank pages, and failed loads are never billed. Its MCP server lets AI agents take screenshots. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Sign up free for ScreenshotNeo.
Troubleshoot unexpected referrer results
The response has no Referrer-Policy header
An absent header does not mean every referrer is sent. The documented default is strict-origin-when-cross-origin when no policy is specified. If you want a predictable site policy, configure the response header explicitly, then verify the response actually delivered to the browser.
The observed header contains a full URL cross-origin
Check that you inspected the intended request and response, not a same-origin request. Then check for an element-level referrerpolicy attribute, a document meta setting, or a JavaScript fetch policy that differs from the page header. Compare the exact outgoing request to the matrix before changing configuration.
The receiver gets no Referer
That may be the intended result under no-referrer, same-origin on a cross-origin request, or a policy that suppresses information on an HTTPS-to-HTTP downgrade. Check the source and destination origins and schemes, then compare them with the configured policy.
The response header is invalid or differs from the configured value
Inspect the final response in the browser, including redirects where relevant to the page you loaded. Check the server, application, hosting, and proxy layers for conflicting or malformed configuration. An invalid supplied policy falls back to the documented default; correct the response and rerun the three-route test.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe browser test is inconsistent
Make sure you are looking at the request generated by the action under test, not an unrelated asset request. Repeat with a harmless distinctive source path and query, and use a receiver you control to observe cross-origin requests. If a page uses a link, resource, or scripted fetch, inspect that initiator for a narrower override.
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Reliability and privacy notes
Referrer testing is about browser-generated outgoing requests, so a static screenshot or source-code inspection alone cannot establish what a destination receives. Use the actual browser request or a controlled receiver. Do not use real credentials or secrets in test URLs: a test designed to observe disclosure should not create a new disclosure risk.
For operational consistency, retain the intended policy in the response configuration and verify it after deployment or changes to the hosting stack. A strict policy may affect analytics, routing, or integrations that rely on referrer context; validate those behaviors before rollout. If only a particular integration needs a referrer, investigate its request-level requirements rather than exposing full paths and queries to every cross-origin destination.
Frequently Asked Questions
Why is the request header spelled “Referer”?
That is the established HTTP field name; the configuration header is spelled Referrer-Policy.
Can I test with a URL containing an API key or password?
No. Use a harmless distinctive path and query instead. A test URL should never contain real credentials, tokens, or personal information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
