Control how much referrer information a browser sends when visitors follow links or load resources from your pages. FreeProKit’s Referrer-Policy Header Generator creates a Referrer-Policy HTTP header and matching HTML meta tag so you can apply a policy without manually formatting the syntax. Policies can send no referrer, only the origin, or more of the source URL depending on the request context. Choose the available option that fits your privacy and referral-data needs, generate the markup, and test the live site after deployment.
What Is the Referrer-Policy Header?
Referrer-Policy is an HTTP response header that tells the browser how much source-page information may be included in the Referer request header.
That information can help with analytics and attribution, but it can also reveal more of a URL than you intend. A stricter policy can reduce the exposure of paths and query strings when users move between sites.
How to Generate a Referrer-Policy Header
- Open FreeProKit’s Referrer-Policy Header Generator.
- Review the policy options shown in the live workspace.
- Choose the policy that matches your privacy and referral-data requirements.
- Run the generator.
- Copy the generated HTTP header or matching HTML meta tag.
- Deploy the configuration and test navigation, analytics, and third-party integrations.
Referrer-Policy Header Example
A site-wide HTTP response header can look like this:
Referrer-Policy: strict-origin-when-cross-origin
If you cannot set the HTTP response header, page markup can use a referrer meta element:
<meta name=”referrer” content=”strict-origin-when-cross-origin”>
FreeProKit generates the header and matching HTML meta form. When possible, a response header is usually easier to manage consistently across a whole site because it can be configured centrally.
Common Referrer-Policy Options
no-referrer
Sends no Referer header. This gives the strongest reduction in referrer sharing, but destination services will not receive referral information from the browser.
same-origin
Sends referrer information for requests within the same origin and omits it for cross-origin requests. This is useful when internal referral context matters but external sites should receive no referrer.
strict-origin
Sends only the source origin when the request stays at the same security level, such as HTTPS to HTTPS, and sends no referrer on an HTTPS-to-HTTP downgrade.
strict-origin-when-cross-origin
Keeps fuller referrer information for same-origin requests, sends only the origin to secure cross-origin destinations, and sends no referrer on HTTPS-to-HTTP downgrades. MDN documents this as the current browser default when no valid policy is set.
What About More Permissive Policies?
The Referrer-Policy standard also includes values such as origin, origin-when-cross-origin, no-referrer-when-downgrade, and unsafe-url. More permissive values can expose more information. In particular, unsafe-url can send origin, path, and query information in situations where a stricter policy would reduce or omit it.
Which Referrer-Policy Should You Choose?
Choose the strictest policy that still allows your website to work as intended. A privacy-focused application may prefer no-referrer or same-origin, while a site that still needs useful cross-origin attribution may choose strict-origin or strict-origin-when-cross-origin.
Test before and after deployment. Referral analytics, payment flows, authentication redirects, embedded services, affiliate systems, and other integrations can behave differently when less referrer data is available.
Why Referrer Data Can Be Sensitive
A source URL can contain internal paths, search terms, campaign parameters, record identifiers, or other context. If a browser sends the full referrer to another origin, some of that URL information can leave your site.
Referrer-Policy helps limit that exposure, but sensitive credentials or private data should not be placed in URLs in the first place.
HTTP Header vs HTML Meta Tag
The HTTP header is a response-level control and is generally the better choice when you can configure the server, CDN, framework, or hosting platform. The HTML meta alternative is useful when you can edit page markup but cannot change response headers.
Individual HTML elements can also support a referrerpolicy attribute for more targeted control, but that is different from setting a page-wide or site-wide policy.
Referrer-Policy vs Other Website Security Headers
Referrer-Policy solves one narrow problem: how much referrer information is sent. It is not a replacement for other browser security and privacy controls.
Use the Permissions-Policy Header Generator when you need to control features such as geolocation, camera, microphone, fullscreen, or payment. Use the CSP Nonce Generator and Content Security Policy Analyzer for Content-Security-Policy-related workflows.
Check Headers After Deployment
Generating a correct policy is only the first step. After adding it to the site, verify that the expected response header is actually being served.
FreeProKit’s HTTP Headers Parser can turn raw HTTP request or response headers into a readable table and JSON representation, which is useful when reviewing a captured header set.
Other Related Website Configuration
Use the Cache-Control Header Builder for caching directives. Use the Security.txt Generator when you need a standards-oriented vulnerability-disclosure contact file with expiration and optional policy links.
If you implement the referrer policy through HTML markup, the HTML Viewer can be useful as part of a markup-review workflow.
Privacy and Browser Processing
The FreeProKit page requires JavaScript and is presented as a browser tool. Its standard privacy note says uploaded files are processed in the browser unless a tool clearly identifies a live server check. Generating Referrer-Policy syntax does not require the tool to crawl your website.
Important Limitations
- The public page does not list the exact policy values exposed in the live selector.
- The generator does not automatically deploy the header to your hosting environment.
- The public page does not claim to check a live site’s existing Referrer-Policy.
- Server-specific configuration snippets are not documented on the static page.
- Test analytics and integrations after changing the policy.
- Referrer-Policy reduces referrer exposure but does not make sensitive URL parameters safe.
Frequently Asked Questions
What does Referrer-Policy control?
Referrer-Policy controls how much information the browser may send in the Referer request header when navigating to another page or requesting a resource. Depending on the policy, the browser may send a full referrer, only the origin, or no referrer.
What does FreeProKit’s Referrer-Policy Header Generator create?
FreeProKit states that the tool generates a Referrer-Policy HTTP header and a matching HTML meta tag. The public page does not expose the exact live policy choices in its static text, so use the options shown in the workspace as the authoritative list.
What is the current default Referrer-Policy in browsers?
MDN documents strict-origin-when-cross-origin as the current default when no valid policy is specified. It keeps fuller referrer information for same-origin requests, sends only the origin on secure cross-origin requests, and sends no referrer on HTTPS-to-HTTP downgrades.
Is no-referrer the most private option?
Among the standard site-wide values, no-referrer is the strictest because it tells the browser not to send the Referer header. The trade-off is that referral information is unavailable to destination services that may otherwise use it for analytics, attribution, or diagnostics.
Should I use the HTTP header or the HTML meta tag?
Use the HTTP response header when you can configure it consistently at the server, CDN, framework, or hosting layer. The HTML meta form is useful when you can edit page markup but cannot change response headers. Test either approach after deployment.
Does Referrer-Policy hide sensitive data in my URLs?
It can reduce how much of a source URL is shared, but it is not a substitute for safe URL design. Sensitive credentials, secrets, and personal data should not be placed in URLs simply because a strict referrer policy is configured.
Is Referrer-Policy the same as Permissions-Policy or CSP?
No. Referrer-Policy controls outgoing referrer information. Permissions-Policy controls selected browser features, while Content-Security-Policy controls allowed content sources and script/style behavior. They solve different problems and can be used together.
Does this generator install the header on my website?
No deployment behavior is documented on the public FreeProKit page. The tool generates the header and matching meta syntax; you still need to place the chosen configuration in your server, CDN, CMS, application, or HTML and then test the live site.