The referrer
Why it matters When you click a link, the next site is often told where you came from. That can reveal what you were reading or searching for. Knowing how it works also helps you build sites that do not leak your own visitors' pages.
Imagine a receptionist who asks every visitor "who sent you?" and writes the answer down. On the web your browser often answers that question automatically, on your behalf, every time you follow a link or a page loads a picture from somewhere else.
Referrer: the address of the page you came from, sent to the next site. The header carrying it is spelled Referer, with one r missing: a spelling mistake from the 1990s that everyone kept.
URL: a web address, such as https://shopa.example/shoes?size=9. The part before the first single slash, https://shopa.example, is called the origin; the rest is the path and the query.
Why referrers exist
Referrers began as a friendly tool. A site owner could see which other sites linked to them, and fix broken links. Shops use it today to see whether visitors arrive from a search engine or an advert.
Where it leaks
A full URL can say a lot. Suppose you are reading https://health.example/forum/topic/back-pain?user=ana and click a link to a shop. If the full address went along, the shop would learn the topic you were reading and even a user name in the address.
The same happens with things you never click. When a page loads a picture, a font or a script from another site, each of those requests can carry a referrer too. So an advert or analytics company embedded on many sites can learn which pages you read on each of them.
Referrer-Policy: the volume knob
Sites can choose how much referrer to send with a header called Referrer-Policy. The common settings are:
| Policy | What another site receives |
|---|---|
no-referrer | Nothing at all. |
origin | Only the origin, for example https://health.example/. |
strict-origin-when-cross-origin | The full address within the same site; only the origin for other sites; nothing when going from a secure (https) page to an insecure (http) one. |
unsafe-url | The full address, everywhere. Avoid it. |
Modern browsers use strict-origin-when-cross-origin when a site sets nothing, so other sites usually see only where you came from, not the exact page (checked October 2026). A site can still choose a leakier policy, and some browsers trim referrers further in their private or strict modes.
A common misconception
"The referrer only matters when I click a link." In fact every embedded picture, script and font can send one. And even the origin alone can be sensitive: arriving from a clinic's site or a job board says something about you.
Recap
- The Referer header tells the next site which page you came from.
- It is sent on clicks and on embedded pictures, scripts and fonts.
- Referrer-Policy controls how much is sent; browsers now default to sending only the origin to other sites.
- If you run a site, set a careful policy and keep private details out of your URLs.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.