You may have seen a short HTML attribute change how a field, image, or link behaves. This guide is about Referrerpolicy Values: All Recognized Policies. A referrer policy controls how much of the current page address is disclosed when a resource or link is requested.
The useful question is not simply “Which value should I memorize?” It is “What should people be able to do on this page?” First decide the goal, then choose an HTML value that matches it.
How the values work
Different values affect different parts of the browser. Read the example below, then compare its attributes with the browser behavior described in the next section. Values that look similar may serve very different purposes.
A practical example
<a href="https://example.org/resources" referrerpolicy="no-referrer">Visit learning resources</a>
<img src="banner.webp" alt="Classroom" referrerpolicy="strict-origin-when-cross-origin">Understanding the code
Start by finding the attribute in the example. The HTML element tells the browser what kind of thing it is displaying; the attribute supplies an extra instruction or hint about that particular element. If you remove the attribute, the element usually still exists, but one part of its behavior may change.
Recognized keywords include no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, and unsafe-url; not all protect privacy equally. The browser default is commonly strict-origin-when-cross-origin.
If a file path or form action appears in the code, it is an example project path. Create the matching file or server endpoint before expecting the complete behavior to work. This distinction is important: HTML describes the page, but it does not automatically build a server or create missing resources.
When to use it
Use Referrerpolicy only where its documented behavior helps someone complete a task. Ask whether the choice improves clarity, keyboard access, performance, or correct data collection. If an extra attribute has no clear purpose, leaving it out may be safer than relying on a poorly understood hint.
Try it yourself
Compare Referer request headers and avoid unsafe-url for sensitive page addresses.
Save the code in a local HTML file, open it in a current browser, and inspect the relevant control or request. When the feature depends on a server, use a small local development server rather than guessing from the source alone.
Common Beginner Mistakes
- Recognized keywords include no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, and unsafe-url; not all protect privacy equally.
- Assuming every browser provides identical controls or follows a hint in exactly the same way.
- Copying a demonstration without providing the files or server behavior it expects.
Key Takeaways
- Recognized keywords include no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, and unsafe-url; not all protect privacy equally.
- Choose the value based on what the visitor needs to do, not only on how the source looks.
- Test the result in the browser, including keyboard access and submitted values where relevant.