Referrer-Policy header

Recommended value

Referrer-Policy: strict-origin-when-cross-origin

How to set Referrer-Policy

# inside your server { } block
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# .htaccess or virtual host (needs mod_headers)
Header always set Referrer-Policy "strict-origin-when-cross-origin"

// app/Http/Middleware/SecurityHeaders.php
public function handle(Request $request, Closure $next): Response
{
    $response = $next($request);
    $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');

    return $response;
}

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\App\Http\Middleware\SecurityHeaders::class);
})

app.use((req, res, next) => {
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  next();
});

// or: app.use(require('helmet')()) for a sensible default set

Rules → Transform Rules → Modify Response Header → Create rule.
Match: all incoming requests (or your hostname).
Then: Set static → Header name: Referrer-Policy → Value: strict-origin-when-cross-origin

In nginx, an add_header inside a location block discards every add_header inherited from the server block. Repeat your security headers there, or use an include file. The always flag also sends the header on error responses.

Common mistakes

• ✕ Using unsafe-url or no-referrer-when-downgrade to "fix" analytics. That sends full URLs, query strings included, to every third party.
• ✕ Keeping password reset or invite tokens in URLs on pages that load third-party scripts.
• ✕ Typos such as strict-origin-when-crossorigin. Unknown values are ignored and the browser default applies.

FAQ