Referrer-Policy header: Crawl Audit check 150

Short answer: when someone clicks from your page to another site, their browser can tell that site which page they came from. Referrer-Policy controls how much of that address is shared. Check 150 warns if you don't set it.

What Crawl Audit checks

• Pass: a Referrer-Policy header, with any value. The report shows it.
• Warning: no header.

What the sources say

• MDN: the header "controls how much referrer information (sent with the Referer header) should be included with requests."
• strict-origin-when-cross-origin is what browsers use when no policy is set. Chrome switched to it as the default in version 85, in 2020.
• OWASP: "Set the header explicitly rather than relying on browser defaults."

Picking a value

strict-origin-when-cross-origin suits most sites. It sends the full address within your own site, only your domain (like https://example.com/) to other sites, and nothing when going from HTTPS to plain HTTP.

Referrer-Policy: strict-origin-when-cross-origin

Addresses can carry private details, such as search terms, order numbers or password reset tokens. For pages like that, no-referrer sends nothing at all. Other sites will still see your domain as the source of visits under the default above, so referral reports keep working.

On devmarde.com

We added Referrer-Policy: strict-origin-when-cross-origin to every page on 6 October. Before that this check warned for us.

Sources

• MDN, Referrer-Policy (updated 4 September 2026).
• Chrome for Developers, A new default Referrer-Policy for Chrome (2020), and OWASP, HTTP Headers Cheat Sheet, checked 6 October 2026.