Security Tools
Referrer-Policy Checker
Check whether a website sends a Referrer-Policy header.
Enter a domain to check whether it sends a Referrer-Policy header.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
By default, browsers can send the full URL of the page a visitor came from (including query strings, which sometimes contain sensitive data like search terms or session identifiers) to whatever site they navigate to next.
It sends the full referrer URL for same-site navigation, but only the origin (domain, no path/query) when navigating to a different site - and nothing at all when downgrading from https to http, balancing analytics usefulness against privacy leakage.
A stricter policy can reduce the referrer detail your OWN analytics receives from incoming visitors just as much as it protects outgoing visitors' privacy - it's a two-way effect worth considering when choosing a policy.
Maximum privacy - it strips the referrer header entirely on every navigation, at the cost of losing referrer-based analytics data both for sites you link to and sites that link to you.
It's more of a privacy consideration than a direct exploit vector - the concern is unintended information leakage (like sensitive URL parameters) to third-party sites, not a mechanism attackers actively exploit to compromise your site.
Yes - individual links can override the page-wide header via a "referrerpolicy" HTML attribute on that specific link, useful when most of your site needs one policy but a specific outbound link needs different handling.