Security Tools

Referrer-Policy Checker

Check how much of a page's address a site shares with other websites through the Referer header.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Present

github.com

Referrer-Policy

origin-when-cross-origin, strict-origin-when-cross-origin

Last checked: 5 minutes ago Cached

Download JSON Download PDF

Enter a URL to see whether it sends a Referrer-Policy header and what that policy shares when visitors follow links or load external files.

What is a Referrer-Policy?

When a visitor clicks a link, browsers can tell the destination which page they came from in the Referer header. The Referrer-Policy header controls how much of that URL is shared. strict-origin-when-cross-origin is a sensible default: full URL within your site, only the domain to other sites.

How to check a website's Referrer-Policy

Enter the domain in the box above.
Click Check Referrer-Policy.
See which policy is set, if any.
Avoid unsafe-url, which can leak full URLs - including tokens in query strings - to other sites.

Related checks

To control browser features too, use the Permissions-Policy Checker.
For all security headers at once, use the Security Headers Checker.

strict-origin-when-cross-origin is a sensible default for most websites: analytics keep working and full page URLs stay private. JustChecker tells you if your Referrer-Policy disappears after a server or CDN change.

Frequently Asked Questions

strict-origin-when-cross-origin is a good default: other sites see only your domain, not full page addresses, and nothing is sent from HTTPS to HTTP pages.

Your own analytics is unaffected. Other sites will see that traffic came from your domain, just not the exact page.

Addresses can contain search terms, order numbers or reset tokens. Without a policy, they may be sent to every external site and resource a page links to.

Share this tool:

Need a website for your business? Only $599