HTTP headers · Request
Referer
Referer tells the server which page linked to the requested resource.
Key facts
| Type | Request |
|---|---|
| Spelling | Historical misspelling of referrer |
| Value | URL, often origin plus path |
| Default policy | <code>strict-origin-when-cross-origin</code> |
| Downgrade | HTTPS to HTTP sends nothing by default |
| Control | <code>Referrer-Policy</code> header or meta |
| Standard | RFC 9110 §10.1.4 |
Where the name came from
The header was misspelled in the original specification and the spelling stuck. It carries the URL of the page that initiated the request, which servers use for analytics, access control and hotlink protection. Browsers apply a referrer policy that may shorten it to the origin or omit it entirely.
The modern default, strict-origin-when-cross-origin, sends the full URL for same-origin requests, only the origin for cross-origin HTTPS requests, and nothing when downgrading to HTTP. That limits leaks while preserving useful attribution.
Privacy and security
URLs can contain search terms, tokens or internal identifiers. If a page links to a third party, the full referrer can expose them. Set Referrer-Policy: no-referrer or same-origin on sensitive pages, and avoid putting secrets in query strings in the first place.
Do not use Referer as an authorization check. It is missing in many legitimate requests and trivially spoofed outside a browser. CSRF protection needs tokens or SameSite cookies, not referrer checks alone.
Frequently asked questions
Why is it spelled Referer?
A misspelling in the original HTTP specification became part of the protocol and was never corrected for compatibility.
Is Referer sent on HTTPS to HTTP redirects?
Not under the default policy. Downgrade requests omit it to avoid leaking secure URLs.