The HTTP Referer header tells a server which URI context led to a request. Depending on the browser and the page’s referrer policy, it may disclose the originating page’s full URL, only its origin, or nothing. It is useful for context and analytics, but it is not proof of identity or authorization.
What does the HTTP Referer header contain?
Referer is a request header: a user agent can send it when requesting a resource to identify the URI from which the target URI was obtained. The header name is historically misspelled; the policy header that controls it is correctly spelled Referrer-Policy. See RFC 9110 §10.1.3.
As an Amazon Associate I earn from qualifying purchases.
Depending on policy and browser behavior, the value can include the referring page’s origin, path, and query string—not just its domain. A URL fragment (the part after #) and username or password information must not be included. Browsers may also omit or limit the value.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For example, a page at https://example.com/articles/item?campaign=spring might be represented as that full URL, as https://example.com/, or not represented at all, depending on the policy and the destination request.
#1 Best Overall
How is the Referer header controlled?
Websites control disclosure primarily with the HTTP response header Referrer-Policy. A policy can also be set in HTML, including with a <meta name="referrer"> element or attributes on links and other elements. The policy determines how much referring URL information is sent for different kinds of requests. MDN documents strict-origin-when-cross-origin as the default when no valid policy is supplied.
| Policy | Same-origin request | Cross-origin request | HTTPS page requesting HTTP |
|---|---|---|---|
no-referrer |
No Referer | No Referer | No Referer |
same-origin |
Full URL | No Referer | No cross-origin Referer |
strict-origin |
Origin only | Origin only | No Referer |
strict-origin-when-cross-origin |
Full URL | Origin only | No Referer |
unsafe-url |
Full URL | Full URL | Full URL |
These policy behaviors are described in MDN’s Referrer-Policy reference. “Same-origin” means the same scheme, host, and port. The unsafe-url policy can expose private URL details to another site, including on an insecure HTTP request.
Which policy should a site use?
Choose the most restrictive policy that still supports the site’s needs. For many sites, strict-origin-when-cross-origin provides a practical balance: full URL context stays within the same origin, while cross-origin requests receive only the origin, and secure-to-insecure navigation does not send a Referer. If a site does not need referral context, no-referrer suppresses it. The MDN referrer-policy guide and the W3C Referrer Policy specification describe header and HTML controls.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRegardless of policy, avoid placing secrets or sensitive personal details in URLs. Paths and query parameters can reveal internal page names, search terms, identifiers, or other data when a full URL is shared.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can Referer be trusted for security?
No. A server should not treat a present Referer as proof that a request is authorized, or treat an absent one as proof of an attack. Browsers may omit it, and intermediaries can remove it. RFC 9110 notes that using the field for protections such as CSRF checks can be undermined by indiscriminate removal. It can be useful as supplementary context, but it should not be the sole basis for access control or CSRF defense.
RFC 9110 also requires user agents not to send a Referer containing a URI fragment or userinfo, and not to send the header on an unsecured HTTP request when the referring resource was accessed securely. These rules reduce some disclosures, but they do not make Referer a reliable security credential.
Quick Recap
Best Value
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
