how to set the Referrer-Policy header correctly

TL;DR

Set the Referrer-Policy response header on every response your app serves. no-referrer is the strictest and safest default, strict-origin-when-cross-origin keeps analytics working without leaking full paths. Set it once at your reverse proxy or edge so every route inherits it, then verify with curl. Most leaks people worry about disappear with one header.

The query

how to set the Referrer-Policy header correctly

Use this when

• You run a web app and full page URLs (query strings, tokens in paths) show up in partner analytics via the referrer
• You need a sane default referrer policy across an app, API, or static site
• You want cross-origin embeds and links to keep working but stop leaking path details
• You are hardening response headers and this one is missing from your baseline

Not for

• Controlling CORS, cookies, or redirect behavior; this header only affects what browsers send as the referrer
• Server-side logging choices; your own logs still see whatever the client sends
• Privacy compliance on its own; pair it with actual data handling practices
• Fixing a leak that already happened; rotate anything that leaked and then set the policy

Steps

1. Pick your policy value. Use no-referrer if you want nothing sent anywhere, or strict-origin-when-cross-origin if first-party analytics and integrations need the origin. Avoid unsafe-url unless you truly need full URLs everywhere. Expected output: a one-line decision recorded in your hardening doc.
2. Set the header at your reverse proxy or edge. In nginx add a line like add_header Referrer-Policy "no-referrer" always; inside the server block, or in your CDN add a custom response header with the same name and value. Expected output: the config reloads cleanly with no syntax errors.
3. If some pages need a looser policy, add a meta tag on those pages only. A meta tag overrides the header for that page, so use it sparingly and note the exceptions. Expected output: the exception list is documented, not guessed at later.
4. Verify with curl. Run curl -sI https://your-site.example/ | grep -i referrer and confirm the header name and value appear on the root and on an API path. Expected output: Referrer-Policy: no-referrer (or your chosen value) on both.
5. Check in a real browser. Open devtools, trigger a cross-origin link or fetch, and look at the request headers to confirm the referrer is gone or reduced to the origin. Expected output: cross-origin requests carry no full URL in the referrer.
6. Re-scan on deploys. Header regressions sneak in when teams add new proxies or routes, so keep this in your periodic header check. Expected output: your baseline header set stays green across routes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iDQP9r73rtxQAQoBtV6VwA