How to add the Referrer-Policy header in Next.js

Referrer-Policy controls how much of the current URL is sent in the Referer header when users follow links or load resources.

Next.js configuration (next.config)

async headers() {
  return [
    {
      source: "/:path*",
      headers: [{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }],
    },
  ];
}

Add the headers() function to your Next.js config and restart or redeploy. Headers set by a proxy or CDN in front can override these.

Before you deploy

strict-origin-when-cross-origin is the browser default in modern browsers and a safe choice. Use no-referrer for maximum privacy if analytics do not depend on referrers.

Verify it works

curl -sI https://your-site.com | grep -i referrer-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Next.js

Strict-Transport-Security in Next.js
Content-Security-Policy in Next.js
X-Frame-Options in Next.js
X-Content-Type-Options in Next.js
Permissions-Policy in Next.js
Cross-Origin-Opener-Policy in Next.js
Cross-Origin-Resource-Policy in Next.js