Referrer-Policy: which value to send and what leaks
unsafe-url sends the full URL, query string included, to every site you link to. squirrel reads the header and flags the leaky values.
What Referrer-Policy is
Referrer-Policy is a response header that controls how much of the current URL the browser puts in the Referer header of the next request. The choices run from no-referrer, which sends nothing, through origin-only values, to unsafe-url, which sends the full URL including path and query string on every request.
Modern browsers default to strict-origin-when-cross-origin: the full URL on same-origin requests, the origin alone cross-origin, and nothing when moving from HTTPS to HTTP. That default is a reasonable policy, so the absence of the header is not itself a defect. Setting unsafe-url is, because password-reset tokens, search terms and session identifiers in URLs all travel to third parties.
What squirrel checks
The rule reads the response headers of the first crawled page and emits a single check named referrer-policy:
- Skipped when the crawl produced no pages. Message:
No pages to check. - Info when the header is absent. Message:
No Referrer-Policy header (browser default applies), withModern browsers default to strict-origin-when-cross-originas the value. - Warn when the comma-separated value list includes
unsafe-url. Message:Referrer-Policy includes unsafe-url, withThis leaks full URLs cross-originas the value. - Pass when the list includes any of
no-referrer,same-origin,strict-originorstrict-origin-when-cross-origin. Message:Referrer-Policy header present, with the raw header value. - Info when the header is present with some other value, such as
originorno-referrer-when-downgrade. Message:Referrer-Policy header present, with the raw value.
Values are lowercased and trimmed before comparison. Severity is info and the weight is 3.
How to fix it
Referrer-Policy: strict-origin-when-cross-origin
Set it on the HTML responses at the edge. Use no-referrer for pages whose URLs carry tokens or personal data, and same-origin when no external site should learn where the user came from. Remove unsafe-url wherever it appears.
Analytics tools that attribute traffic by referrer see less detail under a stricter policy. That is the trade the header exists to make. Origin-level attribution survives strict-origin-when-cross-origin and strict-origin, but not no-referrer or same-origin, and no policy sends a referrer from HTTPS to HTTP except the ones that leak more.
| Rule ID | security/referrer-policy |
| Category | Security |
| Scope | Site-wide |
| Severity | info |
| Weight | 3/10 |
Enable / disable
Disable this rule
[rules]
disable = ["security/referrer-policy"]Disable all Security rules
[rules]
disable = ["security/*"]Enable only this rule
[rules]
enable = ["security/referrer-policy"]enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.
Related rules
- security/new-tab: the per-link version of the same leak,
rel="noreferrer". - security/permissions-policy: the other privacy-facing response header.
- security/third-party-cookies: which external domains are receiving requests at all.
- security/x-content-type: the remaining one-line header in this group.
Security findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.
References
Check your site
Run squirrel audit https://example.com and open the Security section of the report. The policy value your server sent is reported once for the site. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.