The referrer policy check: keeping full addresses private
When a visitor follows a link, their browser usually tells the next site where they came from, in a header named Referer. A referrer policy decides how much of that address is shared. Anticode pages set strict-origin-when-cross-origin in a meta tag and in their response headers, and Sentinel checks that the meta tag is present on every page.
What the referrer can give away
The header is useful: it's how sites know a visitor arrived from a search engine, a newsletter or a partner's page. But a full address can say more than the owner intended. Page paths can reveal what someone was reading, and query strings sometimes hold things that should never leave the site, such as a search term, a reference number or a token in a link that was meant to be private. Without a policy, older defaults could send all of that to every site a visitor clicked through to, and over plain HTTP if the destination wasn't secure. (The header's misspelling, Referer, dates from the original HTTP specification and has been kept ever since.)
The policy Anticode pages use
strict-origin-when-cross-origin is a balanced choice, and it's also the default modern browsers apply when a page doesn't set one. Broken into its parts:
| Where the visitor goes next | What the next site is told |
|---|---|
| Another page on the same site | The full address, path and query included |
| A different site over HTTPS | Only the origin, such as https://bakery.anticode.dev/ |
| Any site over plain HTTP | Nothing at all |
So another site learns that a visitor came from your site, which is fair and useful to them, but not which page or what was in the address. Nothing leaks over an insecure connection.
Where it's set, and what Sentinel checks
Every page from the design engine includes the referrer policy meta tag in its head: a meta element named referrer with the content strict-origin-when-cross-origin. Published sites also send a Referrer-Policy response header with the same value, so the policy applies even before the page's head is read.
Sentinel's check is about presence: it passes when the page has a meta element named referrer, and the Report tab shows the expected value next to it. It doesn't grade the value, so a looser policy written by hand would still pass. On a site with several pages, each page is checked.
Choosing a policy for another site
- no-referrer
- Sends nothing anywhere. The most private, but sites you link to can't tell you sent them visitors.
- same-origin
- Full address within your site, nothing to other sites.
- strict-origin-when-cross-origin
- Full address within your site, origin only to other secure sites, nothing over HTTP. A sensible default for most sites.
- unsafe-url
- Sends the full address everywhere, even over HTTP. Avoid it.
To check any site, open the developer tools' Network panel, select the page request and look for a referrer-policy response header, then search the page source for a meta element named referrer. The guide to security headers covers setting it as a header on common hosts.
What it means for your analytics
Referrer policies on other sites shape what you see too. When someone arrives from a site using this policy, you learn which site, not which page. Anticode's site analytics group visits by source, such as search engines and AI assistants, which works at that level. For finer attribution on links you control, such as a newsletter, add campaign parameters to the link itself; see UTM parameters explained.
Limits
- Presence, not strength. The check confirms the meta tag exists, not that its value is a good one.
- Builder scan. This is one of Sentinel's checks in the builder. The server's publish gate doesn't repeat it, but the header is sent by published sites regardless.
- Doesn't hide your visitors' origin. Other sites still learn your site's address, which is usually what you want.
- Not a substitute for clean addresses. If a page's address ever carries something private, fix the address. A policy limits where it travels; it doesn't stop it appearing in the visitor's own history.
Questions people ask
What does strict-origin-when-cross-origin mean?
Full addresses within your own site, only the site's origin to other HTTPS sites, and nothing to plain-HTTP sites.
Do I need a referrer policy meta tag if browsers default to the same thing?
It's still worth setting. It makes the behaviour explicit and consistent for browsers with older defaults. Anticode pages set it in the page and in a header.
Will it stop other sites seeing that I sent them visitors?
No. They still see your site's origin. Only the path and query are withheld.