Skip to Content
HTML Head TagsIssue 18

No referrer policy meta tag

What Is This Issue

This issue checks whether your web pages have a properly configured Referrer-Policy that controls how much URL information is sent in the HTTP Referer header when users navigate to other websites.

A passing implementation includes one of the following policies (in order of preference):

  • strict-origin-when-cross-origin (recommended - modern browser default)
  • strict-origin
  • same-origin
  • no-referrer

Example of correct implementation (HTTP header):

Referrer-Policy: strict-origin-when-cross-origin

Example of correct implementation (HTML meta):

<meta name="referrer" content="strict-origin-when-cross-origin" />

Without a proper referrer policy, browsers may send the full URL (including path and query string with sensitive parameters) to third-party websites, potentially leaking private information.

Why Is This Important

The Referrer-Policy is important for privacy and security:

  • User experience: Prevents leaking sensitive URL parameters (like tokens, session IDs, or PII) to third-party sites via the Referer header.
  • Security: Sensitive information in URLs (like password reset tokens or API keys) should not be sent to third-party sites.
  • Privacy: Users may not want the full URL of internal pages to be visible to external sites they visit.
  • AI Search / AEO: While not directly related to AI search, protecting user privacy and security builds trust, which is important for overall site quality.

Resolving this issue improves your SEO health score by demonstrating attention to privacy and security best practices, which contributes to overall site quality signals.

How XeoPix Detects This

XeoPix performs the following checks to detect this issue:

  1. HTTP header check: The crawler examines the Referrer-Policy HTTP response header from the page request.

  2. Meta tag search: It looks for a <meta> tag with the attribute name="referrer" in the <head> section.

  3. Policy determination: XeoPix determines the effective policy:

    • HTTP headers take precedence over HTML meta tags
    • If neither is present, the browser default (strict-origin-when-cross-origin in modern browsers) is assumed

  4. Policy classification: The crawler classifies the policy as:

    • Strict: no-referrer, strict-origin, strict-origin-when-cross-origin, same-origin
    • Loose: no-referrer-when-downgrade, unsafe-url
    • Invalid: Not a recognized Referrer-Policy token

  5. Pass/Fail determination:

    • Passes: If a strict referrer policy is explicitly set (via header or meta tag)
    • Fails: If no policy is set, or if a loose/permissive policy is configured

The detection focuses on whether a privacy-protecting referrer policy is in place, not on the specific policy choice (though recommendations are provided).

How To Fix

Follow these steps to implement a proper Referrer-Policy:

  1. Choose your method (HTTP header is preferred over HTML meta):

    Method 1: HTTP Header (Recommended)

    • Configure your web server to send the Referrer-Policy HTTP header
    • Example for Apache (.htaccess): 
      Header set Referrer-Policy "strict-origin-when-cross-origin"
    • Example for Nginx: 
      add_header Referrer-Policy "strict-origin-when-cross-origin";

    Method 2: HTML Meta Tag

    • Add the meta tag to your HTML <head> section: 
      <meta name="referrer" content="strict-origin-when-cross-origin" />

  2. Choose the right policy for your needs:

    • strict-origin-when-cross-origin (recommended): Sends only the origin for cross-origin requests, but full URL for same-origin requests
    • strict-origin: Sends only the origin for all requests
    • same-origin: Sends full URL only for same-origin requests
    • no-referrer: Sends no referrer information

  3. Avoid these policies (too permissive):

    • no-referrer-when-downgrade (old default, leaks full URL)
    • unsafe-url (most permissive, leaks full URL including to HTTP sites)

  4. Verify implementation:

    • Use browser developer tools to check HTTP response headers
    • Test by clicking external links and checking if the Referer header is properly restricted
    • Use security testing tools to ensure sensitive parameters aren’t leaked

Note: If your site uses URL parameters for sensitive data (like password reset tokens), this policy is critical for security.

What We Store

Storage Level

Page Level — This issue is evaluated for each individual URL.

Database Table / Prisma Model

PageHtmlHeadAudit

Stored Fields

FieldTypeDescription
referrerMetaValueString?The content attribute of the referrer meta tag

Detection Dependencies

  • The following data sources are required to evaluate this issue:
  • HTML Document — The crawler parses the HTML head section to find the referrer meta tag
  • Meta Tag Extraction — The <meta name="referrer"> tag is extracted

Examples

Example 1: Correct Implementation with HTTP Header

Scenario: A properly configured page with Referrer-Policy HTTP header.

Correct State (Passes):

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Referrer-Policy: strict-origin-when-cross-origin
...

Example 2: Missing Referrer-Policy

Scenario: Page has no Referrer-Policy configured.

Problematic State (Fails):

<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <title>Page Title</title>
</head>

Why it fails: Without an explicit policy, the browser uses its default, which may leak full URLs to third parties.

Corrected State (Passes):

  • Add Referrer-Policy: strict-origin-when-cross-origin as an HTTP response header
  • Or add <meta name="referrer" content="strict-origin-when-cross-origin" /> to the HTML head

Example 3: Too Permissive Policy

Scenario: Page uses no-referrer-when-downgrade policy.

Problematic State (Fails):

<head>
  <meta name="referrer" content="no-referrer-when-downgrade" />
  <title>Page Title</title>
</head>

Why it fails: This policy sends the full URL (including query parameters) to all cross-origin HTTPS destinations, potentially leaking sensitive information.

Corrected State (Passes):

<head>
  <meta name="referrer" content="strict-origin-when-cross-origin" />
  <title>Page Title</title>
</head>

Example 4: Conflicting Policy Between Header and Meta Tag

Scenario: HTTP header and meta tag specify different policies.

Problematic State (Fails):

HTTP/1.1 200 OK
Referrer-Policy: no-referrer-when-downgrade
...
<head>
  <meta name="referrer" content="strict-origin-when-cross-origin" />
  <title>Page Title</title>
</head>

Why it fails: Conflicting policies create inconsistent behavior. The HTTP header takes precedence, so the loose policy will be applied.

Corrected State (Passes):

  • Remove the meta tag and rely on the HTTP header
  • Or update the HTTP header to match the stricter meta tag policy
  • Best practice: Set the policy only via HTTP header

Example 5: Sensitive URL Parameters

Scenario: Checkout page with session tokens in URL.

Problematic State (Fails):

<!-- URL: https://shop.example.com/checkout?session_id=abc123&return_token=xyz789 -->
<head>
  <meta name="referrer" content="no-referrer-when-downgrade" />
</head>

Why it fails: When the user navigates to a third-party payment processor, the full URL (including session_id and return_token) will be sent in the Referer header.

Corrected State (Passes):

<head>
  <meta name="referrer" content="no-referrer" />
</head>

Or better, set Referrer-Policy: no-referrer as an HTTP header for the entire checkout flow.

Unit Test

Test File

__tests__/seo-audit-checks/htmlHeadTags/issue-112-meta-name-referrer.test.js

Purpose

Validates the detection of a missing <meta name="referrer"> declaration in the HTML <head>. Ensures pages are flagged when the referrer policy meta tag is absent, and not flagged when it is present with any valid policy value.

Tested Function

runHtmlHeadTags() from toggleGroups/htmlHeadTags.js

Issue Information

  • Issue Number: 112
  • Issue Code: META_NAME_REFERRER
  • Toggle Group: htmlHeadTags

Test Scenarios

Positive Test Cases

  • Page has <meta name="referrer" content="no-referrer"> — no issue reported
  • Page has <meta name="referrer" content=""> (empty content but tag present) — no issue reported
  • Page has <meta name="referrer" content="origin"> — no issue reported
  • All eight standard referrer policies are accepted: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url
  • Malformed HTML with the tag present — no issue reported, no crash

Negative Test Cases

  • Page has no referrer meta tag — issue reported with message "Meta referrer policy tag is missing"

Boundary Cases

None present.

Edge Cases

  • Empty HTML (<html></html>): issue reported (referrer policy tag is missing)
  • Malformed HTML: function handles without crashing; correctly detects the tag when present
  • Empty content: content="" is considered present, so no issue reported
  • All policy values: the test iterates through all eight standard referrer policy values

Expected Outcome

Pass

The issue should be reported when:

  • The referrer meta tag is completely absent

Fail

The issue should not be reported when:

  • <meta name="referrer"> is present with any content value (including empty)
  • Any of the eight standard referrer policy values is used

Validation

  • Correct detection of missing referrer meta tag
  • Correct handling of present tag with all standard policy values
  • Graceful handling of malformed HTML
  • Comprehensive policy value coverage
  • Cache mechanism prevents duplicate issue entries on repeated calls
  • toggleGroups/htmlHeadTags.js
  • issueCodes.js

Coverage Summary

  • Positive cases: 4 (no-referrer, empty content, origin, all 8 policies via loop)
  • Negative cases: 1 (missing tag)
  • Edge cases: 3 (empty HTML, malformed HTML, empty content)
  • Cache validation: 1

References

Last updated on
Issue 17Issue 19