All tools

Referrer-Policy Header Builder

Network

Build a Referrer-Policy header value from one or more policy tokens with a plain-English explanation of each and warnings for risky choices like unsafe-url

Pick one or more Referrer-Policy tokens and get back the assembled header value, an equivalent meta tag, and a plain-English explanation of exactly what gets sent to a destination site under each token: the full URL, just the origin, or nothing at all, and whether it still leaks on an HTTPS to HTTP downgrade. Multiple tokens form a fallback chain per the Referrer Policy spec, useful for supporting older browsers while defaulting newer ones to a stricter policy. It is pure string assembly and lookup against the eight standard policy values, it never inspects real request traffic or your site's actual referrer behavior.

httpheaderssecurityprivacyreferrer

How to use Referrer-Policy Header Builder

  • 1.Pick a preset or select a policy value from the dropdown and add it to the chain.
  • 2.Add additional fallback values if you need older-browser compatibility, in priority order.
  • 3.Copy the generated Referrer-Policy header or the equivalent meta tag into your server config or HTML.

Frequently asked questions

What's the current browser default if I don't set this header at all?
Modern browsers default to strict-origin-when-cross-origin, which sends the full URL only for same-origin requests and just the origin for cross-origin ones, with nothing sent on an HTTPS to HTTP downgrade.
Why would I list more than one policy value?
The header supports a comma-separated fallback chain: a browser that doesn't recognize an earlier token in the list falls through to the next one it does understand. This is mostly a legacy compatibility technique today since all current browsers support the full policy set.
What does the meta tag do differently from the header?
The <meta name="referrer"> tag sets the same policy at the page level instead of via an HTTP response header. This tool renders it using only the last (highest-priority) token in your chain, since the meta tag doesn't support a fallback list the way the header does.
Does this tool check what my site is actually sending?
No, it only builds and explains a header value from the tokens you choose. Verifying what a live page actually sends requires inspecting real network requests in a browser.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/referrer-policy-builder \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"policies":"strict-origin-when-cross-origin"}'

Get an API key from your dashboard · Full API docs →

Related tools

Cache-Control Header BuilderBuild and explain an HTTP Cache-Control response header from directives like max-age, s-maxage, no-store, and immutableNetworkCORS Header BuilderGenerate CORS headers with nginx, Express, and Apache config snippetsNetworkCSP Header BuilderBuild Content-Security-Policy headers with presets and validationNetwork