KKorrali Web

Security headers › Referrer-Policy

How to add the Referrer-Policy header in Apache

Referrer-Policy controls how much of the current URL is sent in the Referer header when users follow links or load resources.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Before you deploy

strict-origin-when-cross-origin is the browser default in modern browsers and a safe choice. Use no-referrer for maximum privacy if analytics do not depend on referrers.

Verify it works

curl -sI https://your-site.com | grep -i referrer-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Apache