Safety
Referrer-Policy vs URL Leaks on Public Websites
June 22, 2025
Referrer-Policy vs URL leaks is a default you should set on purpose. When a user clicks from your HTTPS page to another origin, the browser may send a Referer header that includes path and query. If those URLs hold tokens, reset codes, or internal search strings, you just mailed them to a third party. strict-origin-when-cross-origin is a sane default for most public sites: full referrer on same-origin, origin-only on HTTPS cross-origin, nothing when downgrading to HTTP. RoastMyOpsec's free header audit grades Referrer-Policy on the primary document. It does not follow your users off-site.
The practical difference
The Referer header is a browser feature that tells the next site where the click came from. Referrer-Policy is how you constrain that story. no-referrer sends nothing. unsafe-url sends everything, including to HTTP.
Meta referrer tags exist, but HTTP headers at the edge cover every HTML route more reliably.
How to choose a policy
Marketing sites that need analytics on outbound clicks can often live with origin-when-cross-origin or strict-origin-when-cross-origin. Apps that put secrets in query strings should stop putting secrets in query strings first, then set a tight policy as defense in depth.
| Policy | Same-origin | HTTPS → HTTPS cross-origin | Takeaway |
|---|---|---|---|
| no-referrer | Nothing | Nothing | Maximum privacy; some analytics break |
| strict-origin-when-cross-origin | Full URL | Origin only | Usual default for public sites |
| origin | Origin only | Origin only | When paths should never leave |
| unsafe-url | Full URL | Full URL, even to HTTP in some cases | Do not ship this on tokenized links |
When policy is not the real bug
Password-reset and magic-link URLs in query strings leak through logs, browser history, and Referer regardless of a 'pretty good' policy. Move those tokens to POST bodies or fragment identifiers you never send to the server of a third party.
Open redirects plus a fat Referer is how a token walks off-site. Collapse redirect chains on a host you own.
Common mistakes
The first mistake is no Referrer-Policy at all, trusting browser defaults forever.
The second mistake is unsafe-url because an old analytics vendor asked for full paths.
The third mistake is a tight policy on / and none on /blog/*.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- What Referrer-Policy should a marketing site use?
- strict-origin-when-cross-origin is the usual starting point. Tighten to origin or no-referrer if paths are sensitive.
- Does Referrer-Policy stop tokens in my own URLs?
- It reduces who else sees them on outbound clicks. It does not stop your own logs, analytics, or the user's history. Do not put secrets in query strings.
- How does RoastMyOpsec grade Referrer-Policy?
- As part of the free header pack on the primary document response. Header read only.