Does Referrer-Policy affect analytics?

It can. strict-origin-when-cross-origin still gives your own analytics the full path, but third-party analytics on other sites only see your origin.

headers5 min readUpdated 2026-01-05

Referrer-Policy

Every link click and image request sends a Referer header. Referrer-Policy lets you trim that to just the origin — or drop it entirely.

Recommended value

For most sites: strict-origin-when-cross-origin. Sends the full URL on same-origin requests, only the origin on cross-origin HTTPS, and nothing on HTTPS→HTTP downgrades.

When to use no-referrer

High-privacy contexts (medical, financial, whistleblowing) should ship Referrer-Policy: no-referrer to stop leaking any URL data at all.

Frequently asked questions

Does Referrer-Policy affect analytics?: It can. strict-origin-when-cross-origin still gives your own analytics the full path, but third-party analytics on other sites only see your origin.

Try it on your site

Run a free Website Auditor scan and see which of these controls you're missing.

Run a scan

Referrer-Policy

Recommended value

When to use no-referrer

Frequently asked questions

Try it on your site

Related tools

Security Headers Checker

More guides

HTTP Security Headers: A Practical Guide