Referrer Policy Values

Name: Referrer Policy Values
Creator: staticdata.dev
License: https://opensource.org/licenses/MIT

All eight values defined in the W3C Referrer Policy specification for the Referrer-Policy HTTP response header and the referrerpolicy HTML attribute, covering the full range from no-referrer (send nothing) through strict-origin-when-cross-origin (the current browser default) to unsafe-url (always send the full URL).

v1.0.0 MIT 8 records Updated 2026-10-05 stable Source: W3C Referrer Policy, MDN Web Docs — Referrer-Policy

Quick fetch

Stable URL. CORS-enabled. No auth.

bash

curl https://staticdata.dev/v1/referrer-policies.json

Or use as a typed import: import { referrerPolicies } from "https://staticdata.dev/v1/referrer-policies.ts"

Formats

JSON 1.7 KB

/v1/referrer-policies.json

Open

min: 1.6 KB · /v1/referrer-policies.min.json
CSV 1.4 KB

/v1/referrer-policies.csv

Open
TypeScript 1.9 KB

/v1/referrer-policies.ts

export const referrerPolicies

type ReferrerPolicy = (typeof referrerPolicies)[number]

Open

Schema

Each record in the dataset has the following shape.

Schema
Field	Type	Description	Example
value	string	The Referrer-Policy directive value token	strict-origin-when-cross-origin
description	string	Description of the referrer-sending behavior this policy produces	Sends the full URL for same-origin requests, only the origin for cross-origin requests when the security level is maintained or improved, and omits the referrer on cross-origin downgrades (HTTPS to HTTP). This is the current browser default.

Preview

First 8 records.

Data preview
value	description
no-referrer	The Referer header will be omitted entirely. No referrer information is sent with requests.
no-referrer-when-downgrade	Sends the full URL as the referrer when the protocol security level stays the same or improves (HTTP to HTTP, HTTPS to HTTPS), but omits it on downgrades (HTTPS to HTTP). This is the historical browser default.
origin	Sends only the origin (scheme, host, and port) of the document as the referrer, stripping the path and query string.
origin-when-cross-origin	Sends the full URL (origin + path + query) for same-origin requests, but only the origin for cross-origin requests.
same-origin	Sends the full URL as referrer for same-origin requests. No referrer information is sent for cross-origin requests.
strict-origin	Sends only the origin when the protocol security level stays the same (HTTPS to HTTPS) or on HTTP to HTTP requests, and omits the referrer on downgrades (HTTPS to HTTP).
strict-origin-when-cross-origin	Sends the full URL for same-origin requests, only the origin for cross-origin requests when the security level is maintained or improved, and omits the referrer on cross-origin downgrades (HTTPS to HTTP). This is the current browser default.
unsafe-url	Always sends the full URL (origin + path + query string) as the referrer, regardless of security. This leaks private URLs to potentially untrusted origins and should be used with caution.

Showing 8 of 8. View full data: JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl

curl -sSL https://staticdata.dev/v1/referrer-policies.json | jq '.[0]'

JavaScript

import type { ReferrerPolicy } from "https://staticdata.dev/v1/referrer-policies.ts";

const res = await fetch("https://staticdata.dev/v1/referrer-policies.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const referrerPolicies: ReferrerPolicy[] = await res.json();
console.log(referrerPolicies[0]);

Python

import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/referrer-policies.min.json") as r:
    referrerPolicies = json.load(r)

print(referrerPolicies[0])

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/referrer-policies.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}

Rust

use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/referrer-policies.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The values in this dataset are defined by the W3C Referrer Policy specification and control how much referrer information (sent via the Referer request header) is included with navigations and resource requests. The policy can be set via the Referrer-Policy HTTP response header, a <meta name="referrer"> element, or the referrerpolicy attribute on individual HTML elements (<a>, <img>, <link>, etc.).

The specification also allows the empty string, which means no policy is set and the default applies; it is not included as a record. The eight values form a spectrum from most private to most permissive. no-referrer suppresses the header entirely. strict-origin-when-cross-origin — the current default in all major browsers — balances usability with privacy by sending the full URL only to same-origin destinations and only the origin to cross-origin destinations when the protocol does not downgrade. unsafe-url unconditionally sends the complete URL including path and query string, which risks leaking sensitive information embedded in URLs to third parties.

When choosing a policy, strict-origin-when-cross-origin (the default) is appropriate for most sites; no-referrer-when-downgrade sends full URLs, including paths and query strings, to every HTTPS origin and is less private. no-referrer or same-origin are suitable when stricter privacy guarantees are needed. unsafe-url should be avoided except in fully controlled, private network contexts.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the referrer-policies changelog for this dataset's history.