Referrer-Policy
An HTTP response header that sets how much of a page's address a browser passes on as the Referer when a visitor follows a link or loads a resource from it. CrawlCheck sends strict-origin-when-cross-origin on its pages and no-referrer on its private account pages and on redirects that carry an order result in the address.
What Referrer-Policy does not show
It limits what the browser sends; it does not hide the visit from the site being linked to.
Where Referrer-Policy comes up on this site
- Google's /goto redirect: why referrer data can't show itBrowsers default to strict-origin-when-cross-origin , which also drops the path ( MDN ). google.com/search Referrer-Policy: origin click google.com/goto 302, same origin your page Referer: google.com/ redirectCount 0 Search Console counts the click here…
Related terms in Security and privacy
Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
X-Frame-Options · frame-ancestors · Permissions-Policy · Encrypted Client Hello · lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce
Questions about Referrer-Policy
What is Referrer-Policy?
An HTTP response header that sets how much of a page's address a browser passes on as the Referer when a visitor follows a link or loads a resource from it. CrawlCheck sends strict-origin-when-cross-origin on its pages and no-referrer on its private account pages and on redirects that carry an order result in the address.
What does Referrer-Policy not show or guarantee?
It limits what the browser sends; it does not hide the visit from the site being linked to.
Which area of the glossary does Referrer-Policy belong to?
Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
← frame-ancestors · Permissions-Policy →
See it in the full glossary · 772 terms across 19 areas.
Free browser extension
See this on any site you visit, in one click.
CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.