Referrer-Policy Checker
Check the Referrer-Policy HTTP header for any URL and understand what referrer information is shared. Our tool detects the current policy (strict-origin-when-cross-origin, no-referrer, same-origin, and more), explains exactly what referrer data is sent for same-origin requests, cross-origin requests, and protocol downgrades, and provides a security rating from Excellent to Poor. No signup required - just enter a URL and get instant results.
Check the Referrer-Policy header for any URL. See what referrer information is sent with requests and whether your site is configured for optimal privacy.
Enter a URL to check its Referrer-Policy header (https:// is added automatically if missing)
Why Use Our Referrer-Policy Checker?
Instant Referrer-Policy Detection
Enter any URL and instantly detect the Referrer-Policy header value. Our tool sends a HEAD request from your browser and parses the response to identify exactly which referrer policy is configured for the target domain.
Detailed Policy Explanations
Every detected Referrer-Policy value comes with a detailed plain-English explanation. Understand exactly what the policy means, how it affects referrer information sharing, and whether it is the default browser behavior.
Comprehensive Behavior Breakdown
See how the detected policy behaves across three critical scenarios: same-origin requests, cross-origin requests, and protocol downgrades (HTTPS → HTTP). Understand exactly what referrer data is sent in each case.
Full Policy Reference Guide
Compare all eight standard Referrer-Policy values side-by-side in a detailed reference table. Learn the privacy implications of each policy with security ratings from Excellent to Poor, and decide which policy is right for your website.
Common Use Cases for Referrer-Policy Checker
Privacy Audit & Compliance
Use the Referrer-Policy checker to audit your website's privacy configuration. Verify that your site has an appropriate referrer policy that protects user privacy while still allowing necessary referrer data for analytics. Essential for GDPR and privacy regulation compliance.
HTTPS Migration Verification
After migrating from HTTP to HTTPS, check that your Referrer-Policy is configured to prevent referrer leakage from secure to non-secure pages. Ensure policies like strict-origin-when-cross-origin or no-referrer-when-downgrade protect user privacy during downgrade transitions.
Third-Party Service Integration
When integrating external services like payment gateways, CDNs, or analytics platforms, verify their Referrer-Policy to understand what referrer data they receive. Ensure that sensitive URL parameters or session data are not inadvertently exposed through referrer headers.
Website Configuration Review
Check that your web server (Nginx, Apache, Cloudflare) is correctly sending the Referrer-Policy header. Verify that the policy matches your intended configuration and that it is not being overridden by middleware, CDN settings, or meta tags in your HTML.
Cross-Origin Referrer Debugging
When external partner sites report missing referrer data from your links, use this tool to verify what referrer information your site actually sends. Debug cross-origin referrer issues by checking your site's Referrer-Policy and comparing it against the expected behavior.
Security Policy Documentation
Document and compare Referrer-Policy configurations across your organization's properties. Use the tool to generate consistent reports showing which policies are in use, ensuring alignment with your security policy and identifying domains that need updates.
Understanding Referrer-Policy
What is the Referrer-Policy Header?
The Referrer-Policy HTTP header is a security and privacy mechanism that controls how much referrer information is sent with requests from your website. When a user clicks a link on your site, the browser sends a Refererheader to the destination URL, revealing where the request came from. The Referrer-Policy header tells the browser what information to include in that header - from the full URL down to no information at all. Proper configuration is essential for user privacy, security, and analytics accuracy. The Referrer-Policy can be set via the HTTP header, a <meta> tag, or per-link using the rel attribute with noreferrer.
How Our Referrer-Policy Checker Works
- Enter a URL: Type any URL (with or without https://) and click "Check Referrer-Policy". We automatically add https:// if no protocol is specified and send an HTTP HEAD request from your browser to the target server.
- Header Detection: The server returns its response headers. We extract the Referrer-Policy header value and cross-reference it against the complete list of standard Referrer-Policy values defined by the W3C specification.
- Analysis & Explanation: Each detected policy is explained in detail: what referrer data is sent for same-origin requests, cross-origin requests, and during protocol downgrades. A security rating from Excellent to Poor helps you evaluate the privacy impact of the current configuration.
Referrer-Policy Values Explained
- no-referrer: The most private option. No referrer information is ever sent. The Referer header is completely omitted from all requests.
- no-referrer-when-downgrade: (Browser default) Full URL sent for same-security requests. No referrer sent when navigating from HTTPS to HTTP.
- origin: Only the origin (protocol + host + port) is sent, never the full URL path or query string. Applied to all requests.
- strict-origin-when-cross-origin: (Modern default) Full URL for same-origin. Origin only for cross-origin. No referrer on HTTPS→HTTP downgrades.
- same-origin: Full URL sent for same-origin requests only. No referrer for cross-origin requests or downgrades.
- strict-origin: Origin only sent for same-origin and safe cross-origin requests. No referrer on protocol downgrades.
- origin-when-cross-origin: Full URL for same-origin. Origin only for cross-origin requests. Sends origin even on downgrades.
- unsafe-url: Least private option. Full URL (including path and query string) sent for ALL requests, including HTTPS→HTTP downgrades.
Privacy, Security & Availability
Our Referrer-Policy Checker sends requests directly from your browser to the target server. We do not proxy, store, log, or process any URL checks on our servers. The tool is 100% free with no signup, no account, and no usage limits. All header parsing and policy analysis happens client-side in your browser. Note that some servers may block HEAD requests or have CORS restrictions that prevent browser-side fetching, which may cause certain URLs to fail. For accurate results, test URLs that are publicly accessible and do not require authentication.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About Referrer-Policy Checker
The Referrer-Policy HTTP header controls how much referrer information is included in the Referer header when a user navigates from your site to another page. It determines whether the full URL, just the origin, or nothing at all is sent as referrer information. This header is a key privacy and security mechanism that helps prevent sensitive data leakage through URL paths and query parameters.
Enter a URL and click "Check Referrer-Policy". Your browser sends a HEAD request to the URL, which retrieves the response headers without downloading the full page body. The tool extracts the Referrer-Policy header value and matches it against the eight standard policies defined by the W3C specification. Each policy is explained with its behavior for same-origin, cross-origin, and downgrade scenarios.
The default Referrer-Policy in most web browsers is no-referrer-when-downgrade. This means the full URL is sent as referrer for same-origin and cross-origin requests of equal security level (HTTP→HTTP, HTTPS→HTTPS), but no referrer is sent when navigating from HTTPS to HTTP. However, many modern browsers have adopted strict-origin-when-cross-origin as the default for fetch() requests, providing better privacy protection.
For most websites, strict-origin-when-cross-origin or strict-origin provides the best balance between functionality and privacy. These policies preserve referrer data for your own site while limiting what is shared with third parties. For maximum privacy, use no-referrer, though this may break analytics and referrer-based features. The unsafe-url policy should never be used in production as it exposes full URLs to all destinations.
You can set the Referrer-Policy header in your web server configuration. For Nginx, add "add_header Referrer-Policy 'strict-origin-when-cross-origin';" to your server block. For Apache, use "Header set Referrer-Policy 'strict-origin-when-cross-origin'". You can also set it via a <meta> tag: <meta name="referrer" content="strict-origin-when-cross-origin">, or per-link using the rel="noreferrer" attribute on anchor tags.
No. Your URL checks go directly from your browser to the target server. We do not store, log, or process your queries on any server. The HEAD request is made from your browser, and all Referrer-Policy analysis happens client-side. Your privacy is fully protected.
Many websites do not explicitly set the Referrer-Policy header. When no header is detected, the browser uses its default behavior, which is typically no-referrer-when-downgrade. The tool will indicate "Not Set" and explain the default browser behavior. This is not necessarily a security issue, but explicitly setting a policy like strict-origin-when-cross-origin is considered a best practice.
Yes! 100% free with no signup, no account, and no usage limits. Check the Referrer-Policy for any URL as many times as you need. All processing happens locally in your browser, and we never store your lookups.