Referrer Policy Auditor

Security Auditor — checks that the Referrer-Policy response header is set, uses valid values, and does not weaken the browser’s default protection of your page addresses.

Privacy

Keeps tokens, emails and search terms in your URLs away from analytics, ad networks and every site you link to.

Standards

Follows the W3C Referrer Policy specification and the browsers’ current default.

When a visitor follows a link or the page loads a script, image or font from another site, the browser tells that site where the request came from in the Referer header. The Referrer-Policy header decides how much of the page address goes with it: nothing, only the origin (https://example.com/), or the full URL with its path and query string. This auditor reads that header from the audited URL and checks the policy browsers will apply.

How it works

Fetch — sends a HEAD request (or GET when HEAD is not supported) to the audited URL as 37AuditsBot. A blocked request ends the audit with 590; any other failure (timeout, DNS, TLS, non-2xx answer) ends it with 500.
Read — collects every Referrer-Policy header line and splits it on commas into tokens, compared case-insensitively.
Effective policy — like browsers, takes the last valid token as the policy in force, so Referrer-Policy: no-referrer, strict-origin-when-cross-origin applies strict-origin-when-cross-origin. Unknown tokens are skipped.
Rules — unsafe-url (400) and no-referrer-when-downgrade (401) fail; a missing header (300) and unknown tokens (301) warn.
Aggregate — FAIL wins over WARNING; when every rule passes the audit is SUCCESS (200).
Specification pin — every run emits 37A-ReferrerPolicyAuditor-100 (INFORMATION), naming the W3C Referrer Policy Candidate Recommendation of 2017-01-26. It does not change the overall status.

Valid values: no-referrer, no-referrer-when-downgrade, same-origin, origin, strict-origin, origin-when-cross-origin, strict-origin-when-cross-origin, unsafe-url.

What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.

CheckCode	Status	When it fires	Recommendation	Why it matters
`37A-ReferrerPolicyAuditor-100`	`INFORMATION`	Always. Records the specification version this auditor implements.	— (recommendation is `null`; nothing for the site to change)	—
`37A-ReferrerPolicyAuditor-400`	`FAIL`	The effective policy is `unsafe-url`.	Replace “unsafe-url” with “strict-origin-when-cross-origin” in the Referrer-Policy of `{url}`.	Every link click and third-party request sends the full page address, including tokens, emails or search terms in it, to other sites, even over plain HTTP.
`37A-ReferrerPolicyAuditor-401`	`FAIL`	The effective policy is `no-referrer-when-downgrade`.	Replace “no-referrer-when-downgrade” with “strict-origin-when-cross-origin” in the Referrer-Policy of `{url}`.	This old policy sends the full page address, including tokens, emails or search terms in it, to every other HTTPS site the page links to or loads from, such as analytics and ad networks.
`37A-ReferrerPolicyAuditor-300`	`WARNING`	The page sends no `Referrer-Policy` header, or an empty one.	Add “Referrer-Policy: strict-origin-when-cross-origin” (or a stricter policy such as “same-origin” or “no-referrer”) to the responses of `{url}`.	Browsers already hide full URLs from other sites by default, but security scanners and customer audits still flag the missing header, and a weaker policy set elsewhere on the page goes unchallenged.
`37A-ReferrerPolicyAuditor-301`	`WARNING`	A token of the header is not a referrer policy (one check per token).	Replace “`{token}`” in the Referrer-Policy of `{url}` with a valid policy such as “strict-origin-when-cross-origin”. Valid values: `{values}`.	Browsers ignore values they do not know, so a typo silently leaves the page on a different policy than the one you meant to set.
`37A-ReferrerPolicyAuditor-200`	`SUCCESS`	All rules passed. Message is `Referrer-Policy on {url} is {policy} (header: "{value}").`	—	—
`37A-ReferrerPolicyAuditor-500`	`ERROR`	The page could not be fetched (timeout, DNS, TLS, or a non-2xx answer other than a block).	Make sure `{url}` answers with HTTP 2xx, then run the audit again. Last error: `{error}`.	—
`37A-ReferrerPolicyAuditor-590`	`ERROR`	The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page.	Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot.	While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported.

Output documentation

Status	Description	Test logic
SUCCESS	The header sets a policy that keeps full URLs on your site	Header present, every token valid, effective policy is neither `unsafe-url` nor `no-referrer-when-downgrade` (`200`).
WARNING	The header is missing or contains a value browsers ignore	Missing or empty header (`300`); unknown token (`301`).
FAIL	The policy sends full page addresses to other sites	Effective policy `unsafe-url` (`400`) or `no-referrer-when-downgrade` (`401`).
ERROR	The auditor could not read the page	Fetch failure or non-2xx answer (`500`); site blocked 37AuditsBot (`590`).
INFORMATION	Specification pin	Always emitted (`100`); does not change overall status.

Risks and considerations

What leaks through the Referer header

Page addresses often carry private data: password-reset and magic-link tokens, session or tracking ids, email addresses, order numbers and search terms. Any third party that receives the full URL (analytics, ad networks, CDNs, embedded widgets, every site you link to) can log it.

The browser default changed

Since 2020–2021 Chrome, Edge, Firefox and Safari apply strict-origin-when-cross-origin when a page sends no policy: other sites receive only your origin, and nothing at all over a downgrade to HTTP. That is why a missing header is a WARNING, not a FAIL.
Setting unsafe-url or no-referrer-when-downgrade (the old default) overrides that protection and is worse than sending no header, so both fail.

Choosing a policy

strict-origin-when-cross-origin keeps full URLs on your own site and still lets analytics see which site sent the visitor.
same-origin or no-referrer hide even your origin from other sites; use them for admin panels, account pages and any page whose address alone is sensitive.

What this auditor does not check

A <meta name="referrer"> tag in the HTML and referrerpolicy attributes on links, images and scripts can override the header for the page or for single requests; they are not read.
Only the audited URL is fetched; other pages of the site may send a different policy.

Auditors

MCP Server

REST API

Referrer Policy Auditor

Privacy

Standards

How it works

What it audits

Output documentation

Risks and considerations

What leaks through the Referer header

The browser default changed

Choosing a policy

What this auditor does not check

Privacy

Standards

​How it works

​What it audits

​Output documentation

​Risks and considerations

​What leaks through the Referer header

​The browser default changed

​Choosing a policy

​What this auditor does not check

How it works

What it audits

Output documentation

Risks and considerations

What leaks through the Referer header

The browser default changed

Choosing a policy

What this auditor does not check