Referrer-Policy Header Generator
Free online Referrer-Policy header generator. Works entirely in your browser.
Loading tool...
What is Referrer-Policy Header Generator?
The Referrer-Policy Header Generator helps you declare how much referrer information browsers may share when visitors leave your site. It explains all 8 W3C directives in plain language, shows a per-scenario matrix of what actually gets sent, and generates copy-paste snippets for nginx, Apache, Express, and the HTML meta tag. Everything runs locally in your browser with no signup.
Key Benefits
- Prevent full URLs, query strings, and tokens from leaking to third-party sites and insecure HTTP pages.
- Meet OWASP security headers and privacy best practices with one explicit declaration.
- Keep full URLs in your own analytics while sharing only your origin elsewhere.
- Avoid surprises from browser default changes by setting the policy yourself.
- Ship faster with ready snippets for every popular server stack.
Common Use Cases
- •Hardening a production website before a security review or launch.
- •Fixing a failing Referrer-Policy check on securityheaders.com or Observatory.
- •Deciding between same-origin and strict-origin policies for a privacy-sensitive product.
- •Adding the meta tag variant when you cannot modify server configuration.
- •Teaching teams how the Referer header behaves across origins and protocols.
Set a Referrer-Policy Header
- Pick a directive: Click one of the eight radio cards — strict-origin-when-cross-origin is preselected and marked recommended, while unsafe-url carries a warning badge.
- Compare behavior: The matrix shows exactly what the browser sends for same-origin requests, cross-origin requests, and HTTPS-to-HTTP downgrades: nothing, origin only, or the full URL.
- Choose your deployment target: Scroll through the generated header line, the meta referrer tag, and the nginx, Apache, and Express snippets — all update live to your selected directive.
- Copy and ship: Press the Copy button next to the snippet for your stack, add it to your server config or page head, and use Reset to return to the default recommendation.
Key Features
- All 8 W3C Referrer-Policy directives explained with plain-language privacy hints.
- Per-scenario leak matrix showing exactly what is sent same-origin, cross-origin, and on HTTPS downgrades.
- Recommended and leak-risk badges so safe and unsafe choices are obvious at a glance.
- Copy-paste output for the HTTP header, nginx, Apache, Express middleware, and the HTML meta tag.
- Fully bilingual EN/TH interface and 100% offline — nothing leaves your browser.
Frequently Asked Questions
Which referrer directives can I generate snippets for?
All eight: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin (marked recommended), and unsafe-url (marked with a warning).
What does strict-origin-when-cross-origin actually do?
It sends the full URL to same-origin destinations, only the origin to cross-origin ones, and nothing on HTTPS-to-HTTP downgrades — a good privacy and compatibility balance, which is why browsers use it as their default.
Where can I deploy the generated snippets?
The tool outputs the raw header (Referrer-Policy: directive), an HTML meta referrer tag, and copy-ready snippets for nginx (add_header ... always), Apache (Header always set), and Express middleware — pick the one matching your stack.
How does the behavior matrix help me choose?
Each directive shows three chips — what is sent on same-origin requests, cross-origin requests, and HTTPS-to-HTTP downgrades (nothing, origin only, or the full URL) — so you can compare privacy trade-offs at a glance. Everything is generated locally in your browser.