Referrer-Policy Header Missing: How to Set It Correctly

What the Referrer-Policy header is

When a browser follows a link, loads an image, or fetches a script from one page to another, it can attach a Referer request header (the historical misspelling is baked into the spec) that tells the destination which URL the request came from. The Referrer-Policy response header is how your server tells the browser exactly how much of that originating URL to share: the full address, the origin only, or nothing at all.

When the header is missing, the browser falls back to its own built-in default. In modern browsers that default is strict-origin-when-cross-origin, which is reasonable, but relying on an implicit default means behavior can differ across browsers and versions, and you have no documented, intentional policy of your own. Setting the header explicitly removes that ambiguity.

Why it matters

Privacy and security

URLs frequently carry information you would not want broadcast to third parties: session tokens in query strings, internal path structures, password-reset identifiers, account IDs, or search terms. Without a policy, that full URL can be sent in the Referer header to every external resource and outbound link. OWASP flags this as a real data-leak vector and recommends always setting a Referrer-Policy so sensitive information in URLs is not exposed to destinations you do not control.

Analytics and referral data

This is the part that catches SEO and marketing teams off guard. The Referer header is exactly what powers referral attribution. When another site links to you, your analytics platform reads that header to credit the visit to its source. If you (or sites linking to you) apply an overly strict policy such as no-referrer, those visits can show up as direct traffic instead of being attributed to the referring domain, and your inbound-link reporting goes dark.

The reverse matters too: if your own site sends no-referrer, the partners, publishers, and affiliates you link out to lose the ability to credit you as a traffic source, which can quietly weaken relationships and reporting. The goal is a balanced policy that protects sensitive data without erasing legitimate attribution.

SEO impact

The header is not a ranking factor and Google does not use it to score pages. Its SEO relevance is indirect: site auditors such as Screaming Frog and Sitebulb report a missing Referrer-Policy as a security or best-practice issue, so it shows up on technical-audit scorecards. Clearing it improves your audit hygiene and protects the referral data that underpins your off-page reporting.

Policy values explained

The values range from sending everything to sending nothing:

no-referrer sends no Referer header at all. Maximum privacy, but it erases all referral attribution. Breaks analytics referral tracking.
no-referrer-when-downgrade sends the full URL except when moving from HTTPS to HTTP. This was an old default and is no longer recommended because it leaks full paths between secure sites.
origin sends only the origin (scheme plus host), never the path or query.
origin-when-cross-origin sends the full URL to same-origin destinations and only the origin to cross-origin ones.
same-origin sends the full URL within your own site and nothing to other sites.
strict-origin sends only the origin, and nothing when downgrading HTTPS to HTTP.
strict-origin-when-cross-origin sends the full URL to same-origin requests, only the origin to cross-origin requests at the same security level, and nothing on a downgrade. This is the modern browser default and the recommended balance.
unsafe-url always sends the full URL, including on downgrades. Avoid: it leaks paths and query strings everywhere.

How to diagnose

Check the response headers your server actually sends. From a terminal:

curl -sI https://seoprocheck.com/ | grep -i referrer-policy

No output means the header is absent. You can also open your browser DevTools, go to the Network tab, click the document request, and read the Response Headers. Site crawlers like Screaming Frog (Security tab) and Sitebulb will list every URL that is missing the header in a single report.

How to fix

Apache (.htaccess or vhost)

<IfModule mod_headers.c>
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Place this inside the relevant server or location block, then reload with nginx -s reload.

WordPress (functions.php)

add_action('send_headers', function () {
    header('Referrer-Policy: strict-origin-when-cross-origin');
});

A security plugin such as a headers manager can set the same value through a settings screen if you prefer not to edit code.

Meta-tag fallback

If you cannot touch server configuration, add this to the <head>. The response header is preferred because it covers every resource, but the meta tag works for the document:

<meta name="referrer" content="strict-origin-when-cross-origin">

Recommended value

For most sites, set strict-origin-when-cross-origin. It withholds full paths and query strings from external destinations, never leaks anything on an HTTPS-to-HTTP downgrade, and still passes your origin to other sites so referral attribution keeps working in their and your analytics. Reserve no-referrer for pages with genuinely sensitive URLs, and only after you have accepted that it will suppress referral reporting.