Referrer
How much of the previous page's URL is shared with other sites?
When the browser follows a link or loads a resource, it tells the destination which page the request came from: the referrer, sent in the Referer header and exposed to scripts as document.referrer. A full referrer can leak search terms, user IDs or other details in the URL to another site.
All browsers now default to the strict-origin-when-cross-origin policy: other sites only see the origin of the referring page (https://www.example.com/), not its path or query string. Sites can set a different policy. Browsers differ in whether they allow sites to loosen it, for example with unsafe-url.
By browser
Brave
strict-origin-when-cross-originor stricter referrer policy in subresource requests and cross-site navigational requests. Sites can’t loosen it: withunsafe-url, only the origin is sent.- Same-site navigation preserves the referrer.
Sources (1) · 2026-10-31
- Cookie Status test, 2026-10-31
Chrome
- Default browser policy (
strict-origin-when-cross-origin) - Sites can loosen the policy: with
unsafe-url, the full URL is sent to other sites. New
Sources (1) · 2026-10-31
- Cookie Status test, 2026-10-31
Edge
- Default browser policy (
strict-origin-when-cross-origin) - Sites can loosen the policy: with
unsafe-url, the full URL is sent to other sites. New
Sources (1) · 2026-10-31
- Cookie Status test, 2026-10-31
Firefox
- Default browser policy (
strict-origin-when-cross-originor stricter) - Sites can’t loosen it for cross-site requests: with
unsafe-url, only the origin is sent. New
Sources (1) · 2026-10-31
- Cookie Status test, 2026-10-31
Safari
- Default browser policy (
strict-origin-when-cross-origin) - In third-party requests (images, scripts, frames), the referrer is always cut to the origin, also in
document.referrer. New - In navigations, sites can loosen the policy: with
unsafe-url, the full URL is sent to other sites. New - For referrers that are known trackers, where the referring page also has URL decoration (query parameters or fragments),
document.referreris downgraded to eTLD+1.
Sources (2) · 2026-10-31
- Tracking Prevention in WebKit
- Cookie Status test, 2026-10-31
History
ITP 2.3
Script-writable storage is deleted after 7 days without interaction on sites reached via known trackers, and
document.referreris trimmed for them.