HTTP
Referrer-Policy Header & Privacy Checker
Analyze website Referrer-Policy HTTP security headers. Ensures sensitive user URLs, session tokens, and tracking parameters are not leaked to external third-party servers.
Queries response headers to verify Referrer-Policy directive.
How to use
- Enter a domain, URL, or value relevant to Referrer-Policy Header & Privacy Checker.
- Run the check and review the output carefully.
- Apply recommended fixes, then run the check again to verify.
Common use cases
- Pre-deployment validation for Referrer-Policy Header & Privacy Checker.
- Incident triage when security checks fail in production.
- Periodic security review as part of technical SEO and hardening.
Example inputs
validatethis.orggithub.comgoogle.comCommon issues and fixes
Unsafe URL Policy
`unsafe-url` exposes private tokens and sensitive query parameters to external ad trackers and analytics endpoints.
Missing Referrer-Policy Header
While modern browsers default safely, older clients may fall back to `no-referrer-when-downgrade`.
Recommended remediation
Add `Referrer-Policy: strict-origin-when-cross-origin` or `no-referrer` to your web server (Nginx, Caddy, Cloudflare, Next.js headers).
FAQ
Is Referrer-Policy Header & Privacy Checker free to use?
Yes. This tool is free and can be used without account registration.
Do you store submitted values?
Only the minimum processing needed for the check. For client-side tools, data stays in your browser.
How should I use these results?
Use the output as a diagnostic baseline, apply fixes in your stack, then re-run the check to confirm remediation.
Related security tools
HTTP Header Analyzer
Analyze HTTP response headers and check security headers like CSP, HSTS, X-Frame-Options.
Clickjacking Checker
Check X-Frame-Options and CSP frame-ancestors. Detect clickjacking vulnerability.
CSP Checker
Check Content-Security-Policy. Parse directives, detect unsafe-inline, unsafe-eval.
Cookie Analyzer
Parse Set-Cookie headers. Check HttpOnly, Secure, SameSite.
Run a full security check
After this tool passes, run related header and policy checks to catch transport and browser-level risks.