Referrer-Policy

An HTTP header that controls how much referrer information is included when navigating from one page to another.

Oct 31, 2026 / About 1 min read

Analytics

Referrer-Policy is an HTTP response header that controls how much referrer information the browser includes when a user navigates from the current page to another page. It allows site owners to balance privacy concerns with the need for referrer data in analytics and security contexts.

The header supports several values ranging from no-referrer (never send referrer information) to unsafe-url (always send the full URL). MDN Web Docs (as of September 2026) describes strict-origin-when-cross-origin as the default when no policy is specified. It sends the full URL for same-origin requests but only the origin for cross-origin requests, and sends nothing when downgrading from HTTPS to HTTP. According to the Chrome for Developers blog (July 2020), Chrome planned to gradually make it the default starting in version 85.

For URL shortening services, Referrer-Policy affects how much information about the referring page is available when a user clicks a short URL. If the referring page sets a restrictive policy, the shortening service may not receive the full referrer URL, limiting the analytics data available to link owners.

Services that rely on referrer data for traffic source analysis may receive only the origin, or no referrer at all, depending on the policy set by the referring page and the browser default.

Was this article helpful?

Related Terms

Referrer

The URL of the page that linked to the current page, transmitted in the HTTP Referer header.

HTTPS

The secure version of HTTP that encrypts data transmitted between a browser and a web server using TLS.

UTM Parameter

Tags added to URLs that track the source, medium, and campaign name of traffic in analytics tools.

CORS

Cross-Origin Resource Sharing - a browser security mechanism that controls which domains can access resources from another domain.

X-Frame-Options

An HTTP response header that controls whether a browser should allow a page to be displayed in an iframe.

HSTS

HTTP Strict Transport Security - a header that forces browsers to only connect to a website using HTTPS.

Short URL Security - Phishing Risks, Safe Sharing Practices, and Protection Guide

A comprehensive guide to short URL security. Understand phishing risks, malware distribution via shortened links, and best practices for safe sharing.

Short URL Analytics 101: How to Read and Act on Click Data

An explanation of how to read and use the access analytics obtained from short URL click data. We introduce analysis methods by device / region / time of day, points to watch in bot filtering, the impact of privacy regulations, and how to build an improvement cycle.

GDPR and Short URLs - Privacy-First Link Tracking Compliance Guide

Learn how short URL services handle personal data under GDPR. Covers consent requirements, data retention policies, and privacy-first tracking alternatives.

FAQ

What's the recommended Referrer-Policy setting?

strict-origin-when-cross-origin is the default value: it sends the full URL for same-origin requests and only the origin for cross-origin requests. The Chrome for Developers blog (July 2020) says Chrome planned to gradually make it the default starting in version 85, and that websites can still pick a policy of their choice.

What happens if I don't set a Referrer-Policy?

The browser's default applies. MDN Web Docs (as of September 2026) gives strict-origin-when-cross-origin as the default when no policy is specified or the value is invalid.

Put the terms to work

Shorten a URL for Free