Validates Referrer-Policy header for privacy protection
3 of 3 free audits left today
See what Referrer Policy finds on your site. No sign-up needed.
Fetch — sends a HEAD request (or GET when HEAD is not supported) to the audited URL as 37AuditsBot. A blocked request ends the audit with 590; any other failure (timeout, DNS, TLS, non-2xx answer) ends it with 500.
Read — collects every Referrer-Policy header line and splits it on commas into tokens, compared case-insensitively.
Effective policy — like browsers, takes the last valid token as the policy in force, so Referrer-Policy: no-referrer, strict-origin-when-cross-origin applies strict-origin-when-cross-origin. Unknown tokens are skipped.
Rules — unsafe-url (400) and no-referrer-when-downgrade (401) fail; a missing header (300) and unknown tokens (301) warn.
Aggregate — FAIL wins over WARNING; when every rule passes the audit is SUCCESS (200).
Specification pin — every run emits 37A-ReferrerPolicyAuditor-100 (INFORMATION), naming the W3C Referrer Policy Candidate Recommendation of 2017-01-26. It does not change the overall status.
Valid values: no-referrer, no-referrer-when-downgrade, same-origin, origin, strict-origin, origin-when-cross-origin, strict-origin-when-cross-origin, unsafe-url.
Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-ReferrerPolicyAuditor-100 | INFORMATION | Always. Records the specification version this auditor implements. | — (recommendation is null; nothing for the site to change) | — |
37A-ReferrerPolicyAuditor-400 | FAIL | The effective policy is unsafe-url. | Replace "unsafe-url" with "strict-origin-when-cross-origin" in the Referrer-Policy of {url}. | Every link click and third-party request sends the full page address, including tokens, emails or search terms in it, to other sites, even over plain HTTP. |
37A-ReferrerPolicyAuditor-401 | FAIL | The effective policy is no-referrer-when-downgrade. | Replace "no-referrer-when-downgrade" with "strict-origin-when-cross-origin" in the Referrer-Policy of {url}. | This old policy sends the full page address, including tokens, emails or search terms in it, to every other HTTPS site the page links to or loads from, such as analytics and ad networks. |
37A-ReferrerPolicyAuditor-300 | WARNING | The page sends no Referrer-Policy header, or an empty one. | Add "Referrer-Policy: strict-origin-when-cross-origin" (or a stricter policy such as "same-origin" or "no-referrer") to the responses of {url}. | Browsers already hide full URLs from other sites by default, but security scanners and customer audits still flag the missing header, and a weaker policy set elsewhere on the page goes unchallenged. |
37A-ReferrerPolicyAuditor-301 | WARNING | A token of the header is not a referrer policy (one check per token). | Replace "{token}" in the Referrer-Policy of {url} with a valid policy such as "strict-origin-when-cross-origin". Valid values: {values}. | Browsers ignore values they do not know, so a typo silently leaves the page on a different policy than the one you meant to set. |
37A-ReferrerPolicyAuditor-200 | SUCCESS | All rules passed. Message is Referrer-Policy on {url} is {policy} (header: "{value}"). | — | — |
37A-ReferrerPolicyAuditor-500 | ERROR | The page could not be fetched (timeout, DNS, TLS, or a non-2xx answer other than a block). | Make sure {url} answers with HTTP 2xx, then run the audit again. Last error: {error}. | — |
37A-ReferrerPolicyAuditor-590 | ERROR | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See https://www.37audits.com/bot. | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | The header sets a policy that keeps full URLs on your site | Header present, every token valid, effective policy is neither unsafe-url nor no-referrer-when-downgrade (200). |
| WARNING | The header is missing or contains a value browsers ignore | Missing or empty header (300); unknown token (301). |
| FAIL | The policy sends full page addresses to other sites | Effective policy unsafe-url (400) or no-referrer-when-downgrade (401). |
| ERROR | The auditor could not read the page | Fetch failure or non-2xx answer (500); site blocked 37AuditsBot (590). |
| INFORMATION | Specification pin | Always emitted (100); does not change overall status. |
Page addresses often carry private data: password-reset and magic-link tokens, session or tracking ids, email addresses, order numbers and search terms. Any third party that receives the full URL (analytics, ad networks, CDNs, embedded widgets, every site you link to) can log it.
Since 2020–2021 Chrome, Edge, Firefox and Safari apply strict-origin-when-cross-origin when a page sends no policy: other sites receive only your origin, and nothing at all over a downgrade to HTTP. That is why a missing header is a WARNING, not a FAIL.
Setting unsafe-url or no-referrer-when-downgrade (the old default) overrides that protection and is worse than sending no header, so both fail.
strict-origin-when-cross-origin keeps full URLs on your own site and still lets analytics see which site sent the visitor.
same-origin or no-referrer hide even your origin from other sites; use them for admin panels, account pages and any page whose address alone is sensitive.
A <meta name="referrer"> tag in the HTML and referrerpolicy attributes on links, images and scripts can override the header for the page or for single requests; they are not read.
Only the audited URL is fetched; other pages of the site may send a different policy.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.