An original supplier review page has an address containing a review reference. Its author links to a public supplier manual. Before sending that page to colleagues, the developer wants to know which part of the review address the manual host could receive when someone follows the link.
Set the policy on the navigation that needs it
<a href="https://manuals.example.com/pump-maintenance"
referrerpolicy="no-referrer">Pump maintenance manual</a>
The example destination is fictional. For the actual link, this policy asks the browser to omit the source-address header on the navigation. It does not require opening another tab.
Be precise about spelling. The HTML attribute is referrerpolicy, the response header is Referrer-Policy, and the outgoing source-address header is historically spelled Referer. Looking for a request header called Referrer can make a valid test look as if it found nothing.
Compare the policy with the destination's origin
For an HTTPS source such as https://review.example.com/pack?review=R018, the documented policies give these intended results:
| Policy | Same-origin HTTPS destination | Different-origin HTTPS destination |
|---|---|---|
no-referrer |
No Referer | No Referer |
origin |
https://review.example.com/ |
https://review.example.com/ |
same-origin |
Source origin, path, and query | No Referer |
strict-origin-when-cross-origin |
Source origin, path, and query | Source origin only |
MDN documents strict-origin-when-cross-origin as the default when a valid policy is absent. Under that policy, an HTTPS-to-HTTP downgrade sends no referrer. A same-origin navigation can still send the path and query, so “the default hides my review reference” is an incomplete claim.
The table describes the browser policy, not an observation of the fictional hosts. Browser privacy settings can further restrict disclosure. Keep secrets out of URLs regardless of policy; the source page, its own server logs, history, and copied address can retain them.
Apply a document rule when the requirement is broader
The server can send a Referrer-Policy response header. HTML can also declare a document policy:
<meta name="referrer" content="no-referrer">
Use the application's actual response configuration when setting the header, and inspect the delivered page rather than assuming an edited local file changed the server response. Individual supported elements, including anchors, images, and iframes, can specify referrerpolicy for their own requests.
rel="noreferrer" is another link-specific way to omit referrer information. The new-tab link guide explains that link relation and noopener. noopener addresses the opener relationship; it does not by itself express a no-referrer rule. An iframe has its own request policy to consider separately from links in the parent page.
Inspect a real request before relying on the setting
Serve a disposable test page over HTTP or HTTPS with test references, then use developer tools' Network panel to inspect the navigation request. Check a same-origin destination and a different-origin destination under the intended policy. Record whether Referer is absent or contains the expected origin or address. A page opened as a local file: document is a poor substitute for testing the production origin relationship.
Finally, inspect the destination itself. If the link's href already contains ?review=R018, suppressing Referer does not remove that parameter. For the supplier manual, the completed check is a clean public destination URL and an observed request that follows the review page's chosen disclosure rule.