How to add the Referrer-Policy header in Nginx

Nginx configuration (nginx server block)

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

strict-origin-when-cross-origin is the browser default in modern browsers and a safe choice. Use no-referrer for maximum privacy if analytics do not depend on referrers.

Verify it works

curl -sI https://your-site.com | grep -i referrer-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Other headers in Nginx

• Strict-Transport-Security in Nginx
• Content-Security-Policy in Nginx
• X-Frame-Options in Nginx
• X-Content-Type-Options in Nginx
• Permissions-Policy in Nginx
• Cross-Origin-Opener-Policy in Nginx
• Cross-Origin-Resource-Policy in Nginx