Referrer-Policy: controlling what the Referer header leaks

The Referer header (misspelled in the original specification and never corrected) carries the URL of the page that triggered a request. That is useful for attribution and dangerous for privacy, because a password reset link, a document URL with an identifier in it, or a search results page all end up in the logs of whichever third party the page happens to load a script or an image from.

The values form a scale. no-referrer sends nothing. same-origin sends the full URL to your own origin and nothing to anyone else. origin sends only scheme, host and port everywhere. strict-origin sends the origin but drops it entirely when moving from HTTPS to HTTP. strict-origin-when-cross-origin, the modern default, sends the full URL within your origin and only the origin when leaving it.

The value to avoid is unsafe-url, which sends the full URL including the query string to every destination, plain HTTP ones included. no-referrer-when-downgrade is the old browser default and behaves the same way for HTTPS to HTTPS navigation, which is most of the web, so it also leaks full URLs to third parties.

Because modern browsers already default to strict-origin-when-cross-origin, setting the header is mainly about being explicit and about choosing something stricter. It is worth setting on responses whose URLs contain anything sensitive, and worth overriding per element with the referrerpolicy attribute when one outbound link needs different treatment from the rest of the page.