# Referrer-Policy

> Referrer-Policy is an HTTP header that controls how much of the current URL the browser sends to other sites when a visitor follows a link or a resource loads.

- **Check ID:** SEC6
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/referrer-policy

## Why it matters

Without a proper Referrer-Policy, the URL sent in the Referer header can reveal sensitive data, such as tokens in query parameters, internal URL addresses, or search information. External services (analytics, ads) can thus gain access to data that does not belong to them.

## In practice

GitHub.com uses Referrer-Policy: strict-origin-when-cross-origin. When you click an external link from a private repository, the target website receives only https://github.com as the referrer, not the full URL with the private repository name.

## How be1st checks it

Checks for the presence of the Referrer-Policy HTTP header, which determines how much URL information is sent in the Referer header during navigation or resource loading. The recommended value is strict-origin-when-cross-origin or no-referrer. The check treats the value unsafe-url as a problem.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Referrer-Policy header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) (MDN)
- [OWASP Secure Headers Project](https://owasp.org/projects/secure-headers-project) (OWASP)

## Related terms

- [Permissions-Policy](https://be1st.ai/glossary/security/permissions-policy): Permissions-Policy is an HTTP header that turns browser features such as the camera, microphone or geolocation on or off for a page and its frames.
- [Mixed content](https://be1st.ai/glossary/security/mixed-content): Mixed content means resources, such as images or scripts, that an HTTPS page loads over unencrypted HTTP. Browsers block or flag them.
- [Security warnings](https://be1st.ai/glossary/security/security-warnings): Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.
- [Insecure cookies](https://be1st.ai/glossary/security/insecure-cookies): An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.
- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.