# Referrer-Policy

## What This Does

This protection controls how much referral information is shared when users navigate away from your site.

It determines what data is included in the `Referer` header sent to other websites.

---

## Why It Matters

When a user clicks a link, their browser may send the previous page’s URL as a referrer.

This can expose:

- full URLs (including query parameters)  
- internal paths  
- sensitive information in links  

Without a defined policy, more information may be shared than necessary.

---

## When to Apply It

This protection is recommended for most websites.

Apply it when:

- you want to limit information shared with external sites  
- you are concerned about data leakage through URLs  
- you want to follow modern privacy best practices  

---

## When Not to Apply It

You may choose a less restrictive policy if:

- your site depends on referral data for analytics  
- integrations require full referrer information  
- marketing tools rely on detailed referral tracking  

---

## How Steel Security Applies This

Steel Security sets the `Referrer-Policy` HTTP header.

Common values include:

- `no-referrer` — no referrer information is sent  
- `same-origin` — referrer sent only within your site  
- `strict-origin-when-cross-origin` — limited referrer for external requests (recommended default)  

The selected policy balances privacy and functionality.

---

## What to Expect After Applying

After applying this protection:

- less referral data will be shared with external sites  
- user privacy is improved  
- some analytics or tracking tools may receive less information  

In most cases, there is no visible impact on site functionality.

---

## How to Verify

To verify the protection:

1. Open your browser developer tools  
2. Navigate to the Network tab  
3. Inspect a page request  
4. Look for the `Referrer-Policy` header  

You should see the configured policy value.

---

## How to Revert (Rollback)

To revert this protection:

1. Navigate to the hardening section in Steel Security  
2. Disable or adjust the control  
3. Confirm the change  
4. Re-check the response headers  

---

## Common Issues

### Analytics Data Is Reduced

This may occur if:

- a restrictive policy limits referrer information  
- external tools rely on full URL data  

To resolve:

- choose a less restrictive policy  
- balance privacy with tracking needs  

---

### No Visible Change

This is expected.

The protection affects how browsers send data, not how your site behaves visually.

---

### Header Not Appearing

- verify server supports header rules  
- check for CDN or caching layers  
- confirm configuration was applied correctly  

---

## Related

- [Security Headers Overview](https://docs.steelwp.com/books/hardening-reference/page/security-headers-overview)
- [X-Frame-Options](https://docs.steelwp.com/books/hardening-reference/page/x-frame-options)
- [X-Content-Type-Options](https://docs.steelwp.com/books/hardening-reference/page/x-content-type-options)
- [Content Security Policy (CSP)](https://docs.steelwp.com/books/hardening-reference/page/content-security-policy-csp)
- [Safe Rollback Practices](https://docs.steelsecurity.com/books/plugin-guide/page/safe-rollback-practices)