> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Referrer Policy Auditor
> Checks that the Referrer-Policy header does not send full page addresses to other sites
**Security Auditor** — checks that the `Referrer-Policy` response header is set, uses valid values, and does not weaken the browser's default protection of your page addresses.
Keeps tokens, emails and search terms in your URLs away from analytics, ad networks and every site you link to.
Follows the W3C Referrer Policy specification and the browsers' current default.
When a visitor follows a link or the page loads a script, image or font from another site, the browser tells that site where the request came from in the `Referer` header. The `Referrer-Policy` header decides how much of the page address goes with it: nothing, only the origin (`https://example.com/`), or the full URL with its path and query string. This auditor reads that header from the audited URL and checks the policy browsers will apply.
## How it works
1. **Fetch** — sends a `HEAD` request (or `GET` when `HEAD` is not supported) to the audited URL as 37AuditsBot. A blocked request ends the audit with `590`; any other failure (timeout, DNS, TLS, non-2xx answer) ends it with `500`.
2. **Read** — collects every `Referrer-Policy` header line and splits it on commas into tokens, compared case-insensitively.
3. **Effective policy** — like browsers, takes the **last valid** token as the policy in force, so `Referrer-Policy: no-referrer, strict-origin-when-cross-origin` applies `strict-origin-when-cross-origin`. Unknown tokens are skipped.
4. **Rules** — `unsafe-url` (`400`) and `no-referrer-when-downgrade` (`401`) fail; a missing header (`300`) and unknown tokens (`301`) warn.
5. **Aggregate** — `FAIL` wins over `WARNING`; when every rule passes the audit is `SUCCESS` (`200`).
6. **Specification pin** — every run emits `37A-ReferrerPolicyAuditor-100` (`INFORMATION`), naming the [W3C Referrer Policy Candidate Recommendation of 2017-01-26](https://www.w3.org/TR/2017/CR-referrer-policy-20170126/). It does not change the overall status.
Valid values: `no-referrer`, `no-referrer-when-downgrade`, `same-origin`, `origin`, `strict-origin`, `origin-when-cross-origin`, `strict-origin-when-cross-origin`, `unsafe-url`.
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`, in the order the auditor runs them. CheckCode suffixes use status ranges: `100` information, `200` success, `300–399` warning, `400–499` fail, `500–599` error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| `37A-ReferrerPolicyAuditor-100` | `INFORMATION` | Always. Records the specification version this auditor implements. | — (recommendation is `null`; nothing for the site to change) | — |
| `37A-ReferrerPolicyAuditor-400` | `FAIL` | The effective policy is `unsafe-url`. | Replace "unsafe-url" with "strict-origin-when-cross-origin" in the Referrer-Policy of `{url}`. | Every link click and third-party request sends the full page address, including tokens, emails or search terms in it, to other sites, even over plain HTTP. |
| `37A-ReferrerPolicyAuditor-401` | `FAIL` | The effective policy is `no-referrer-when-downgrade`. | Replace "no-referrer-when-downgrade" with "strict-origin-when-cross-origin" in the Referrer-Policy of `{url}`. | This old policy sends the full page address, including tokens, emails or search terms in it, to every other HTTPS site the page links to or loads from, such as analytics and ad networks. |
| `37A-ReferrerPolicyAuditor-300` | `WARNING` | The page sends no `Referrer-Policy` header, or an empty one. | Add "Referrer-Policy: strict-origin-when-cross-origin" (or a stricter policy such as "same-origin" or "no-referrer") to the responses of `{url}`. | Browsers already hide full URLs from other sites by default, but security scanners and customer audits still flag the missing header, and a weaker policy set elsewhere on the page goes unchallenged. |
| `37A-ReferrerPolicyAuditor-301` | `WARNING` | A token of the header is not a referrer policy (one check per token). | Replace "`{token}`" in the Referrer-Policy of `{url}` with a valid policy such as "strict-origin-when-cross-origin". Valid values: `{values}`. | Browsers ignore values they do not know, so a typo silently leaves the page on a different policy than the one you meant to set. |
| `37A-ReferrerPolicyAuditor-200` | `SUCCESS` | All rules passed. Message is `Referrer-Policy on {url} is {policy} (header: "{value}").` | — | — |
| `37A-ReferrerPolicyAuditor-500` | `ERROR` | The page could not be fetched (timeout, DNS, TLS, or a non-2xx answer other than a block). | Make sure `{url}` answers with HTTP 2xx, then run the audit again. Last error: `{error}`. | — |
| `37A-ReferrerPolicyAuditor-590` | `ERROR` | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See [https://www.37audits.com/bot](https://www.37audits.com/bot). | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
## Output documentation
| Status | Description | Test logic |
| - | - | - |
| **SUCCESS** | The header sets a policy that keeps full URLs on your site | Header present, every token valid, effective policy is neither `unsafe-url` nor `no-referrer-when-downgrade` (`200`). |
| **WARNING** | The header is missing or contains a value browsers ignore | Missing or empty header (`300`); unknown token (`301`). |
| **FAIL** | The policy sends full page addresses to other sites | Effective policy `unsafe-url` (`400`) or `no-referrer-when-downgrade` (`401`). |
| **ERROR** | The auditor could not read the page | Fetch failure or non-2xx answer (`500`); site blocked 37AuditsBot (`590`). |
| **INFORMATION** | Specification pin | Always emitted (`100`); does not change overall status. |
## Risks and considerations
### What leaks through the Referer header
* Page addresses often carry private data: password-reset and magic-link tokens, session or tracking ids, email addresses, order numbers and search terms. Any third party that receives the full URL (analytics, ad networks, CDNs, embedded widgets, every site you link to) can log it.
### The browser default changed
* Since 2020–2021 Chrome, Edge, Firefox and Safari apply `strict-origin-when-cross-origin` when a page sends no policy: other sites receive only your origin, and nothing at all over a downgrade to HTTP. That is why a missing header is a `WARNING`, not a `FAIL`.
* Setting `unsafe-url` or `no-referrer-when-downgrade` (the old default) **overrides** that protection and is worse than sending no header, so both fail.
### Choosing a policy
* `strict-origin-when-cross-origin` keeps full URLs on your own site and still lets analytics see which site sent the visitor.
* `same-origin` or `no-referrer` hide even your origin from other sites; use them for admin panels, account pages and any page whose address alone is sensitive.
### What this auditor does not check
* A `` tag in the HTML and `referrerpolicy` attributes on links, images and scripts can override the header for the page or for single requests; they are not read.
* Only the audited URL is fetched; other pages of the site may send a different policy.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.