EngineeringScore
Security Small

Tighten the Referrer-Policy value

unsafe-url is a legal Referrer-Policy value, but its name describes exactly what it does: it sends the complete URL a visitor is leaving, including any query string, to every destination, on every request, even when that destination is reached by downgrading from https to http. A site with this value has a Referrer-Policy header in every response; it just tells browsers to share the maximum amount of information rather than the minimum.

Why it matters

unsafe-url sends the full page URL (including query strings, which can carry session tokens, search terms, or internal paths) to every destination a user navigates to or loads a resource from, even when that destination is reached over a downgraded, insecure connection. It is a one-line value change, not a missing header.

How to fix

  1. 1 Change the Referrer-Policy value from unsafe-url to strict-origin-when-cross-origin (or stricter).
  2. 2 Review any analytics or link-tracking that depends on full-URL referrer data before tightening further.
  3. 3 Re-scan and confirm the header now reports as safe, not unsafe.

Common mistakes

  • Copying unsafe-url from an old tutorial or a legacy config that predates strict-origin-when-cross-origin (the current browser default), not realising it is the least private option on the list, not a neutral or default one.
  • Setting unsafe-url to fix a broken referrer-dependent integration without checking whether a less permissive value like origin-when-cross-origin would have been enough.
  • Treating "the header is present" as the finish line, without checking that the value it holds actually restricts anything.

How to verify

  1. 1 Inspect the response headers and confirm Referrer-Policy no longer resolves to unsafe-url (check the last recognised value if a comma-separated fallback list is used).
  2. 2 Click an outbound link to a third-party site and inspect the Referer header the browser actually sent to confirm only the intended amount of URL is shared.
  3. 3 Confirm any analytics or attribution tooling that depended on the full referrer still functions with the tightened value.

Related checks

Security Referrer PolicySecurity CSPSecurity Permissions Policy

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site