n-US/docs/Glossary/Response_header)  
---|---  
[ Forbidden header name ](/en-US/docs/Glossary/Forbidden_header_name) |  no   
  
##  Syntax

http

    
    
    Referrer-Policy: no-referrer
    Referrer-Policy: no-referrer-when-downgrade
    Referrer-Policy: origin
    Referrer-Policy: origin-when-cross-origin
    Referrer-Policy: same-origin
    Referrer-Policy: strict-origin
    Referrer-Policy: strict-origin-when-cross-origin
    Referrer-Policy: unsafe-url
    

**Note:** The original header name [ ` Referer ` ](/en-
US/docs/Web/HTTP/Headers/Referer) is a misspelling of the word "referrer". The
` Referrer-Policy ` header does not share this misspelling.

##  Directives

` no-referrer `

    

The [ ` Referer ` ](/en-US/docs/Web/HTTP/Headers/Referer) header will be
omitted: sent requests do not include any referrer information.

` no-referrer-when-downgrade `

    

Send the [ origin ](/en-US/docs/Glossary/Origin) , path, and querystring in [
` Referer ` ](/en-US/docs/Web/HTTP/Headers/Referer) when the protocol security
level stays the same or improves (HTTPâHTTP, HTTPâHTTPS, HTTPSâHTTPS).
Don't send the [ ` Referer ` ](/en-US/docs/Web/HTTP/Headers/Referer) header
for requests to less secure destinations (HTTPSâHTTP, HTTPSâfile).

` origin `

    

Send only the [ origin ](/en-US/docs/Glossary/Origin) in the [ ` Referer `
](/en-US/docs/Web/HTTP/Headers/Referer) header. For example, a document at `
https://example.com/page.html ` will send the referrer ` https://example.com/
` .

` origin-when-cross-origin `

    

When performing a [ same-origin ](/en-US/docs/Glossary/Same-origin_policy)
request to the same protocol level (HTTPâHTTP, HTTPSâHTTPS), send the [
origin ](/en-US/docs/Glossary/Origin) , path, and query string. Send only the
origin for cross origin requests and requests to less secure destinations
(HTTPSâHTTP).

` same-origin `

    

Send the [ origin ](/en-US/docs/Glossary/Origin) , path, and query string for
[ same-origin ](/en-US/docs/Glossary/Same-origin_policy) requests. Don't send
the [ ` Referer ` ](/en-US/docs/Web/HTTP/Headers/Referer) header for cross-
origin requests.

` strict-origin `

    

Send only the origin when the protocol security level stays the same
(HTTPSâHTTPS). Don't send the [ ` Referer ` ](/en-
US/docs/Web/HTTP/Headers/Referer) header to less secure destinations
(HTTPSâHTTP).

` strict-origin-when-cross-origin ` (default)

    

Send the origin, path, and querystring when performing a same-origin request.
For cross-origin requests send the origin (only) when the protocol security
level stays same (HTTPSâHTTPS). Don't send the [ ` Referer ` ](/en-
US/docs/Web/HTTP/Headers/Referer) header to less secure destinations
(HTTPSâHTTP).

**Note:** This is the default policy if no policy is specified, or if the
provided value is invalid (see spec revision [ November 2020
](https://github.com/whatwg/fetch/pull/1066) ). Previously the default was `
no-referrer-when-downgrade ` .

` unsafe-url `

    

Send the origin, path, and query string when performing any request,
regardless of security.

**Warning:** This policy will leak potentially-private information from HTTPS
resource URLs to insecure origins. Carefully consider the impact of this
setting.

##  Integration with HTML

You can also set referrer policies inside HTML. For example, you can set the
referrer policy for the entire document with a [ ` <meta> ` ](/en-
US/docs/Web/HTML/Element/meta) element with a [ name ](/en-
US/docs/Web/HTML/Element/meta#name) of ` referrer ` :

html

    
    
    <meta name="referrer" content="origin" />
    

You can specify the ` referrerpolicy ` attribute on [ ` <a> ` ](/en-
US/docs/Web/HTML/Element/a) , [ ` <area> ` ](/en-
US/docs/Web/HTML/Element/area) , [ ` <img> ` ](/en-
US/docs/Web/HTML/Element/img) , [ ` <iframe> ` ](/en-
US/docs/Web/HTML/Element/iframe) , [ ` <script> ` ](/en-
US/docs/Web/HTML/Element/script) , or [ ` <link> ` ](/en-
US/docs/Web/HTML/Element/link) elements to