HTTP headers / response header
Referrer-Policy
Referrer-Policy: strict-origin-when-cross-origin
What it does
Controls how much of the current URL leaks in the Referer header of outgoing requests.
The gotcha
The modern default (strict-origin-when-cross-origin) already trims paths cross-origin — analytics teams discovering "missing referrer paths" are seeing this.
Debugging headers on a phone
The fastest way to see what Referrer-Policy is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · WWW-Authenticate · Content-Encoding · Transfer-Encoding · ETag · Last-Modified · Expires
Inspect Referrer-Policy on a live request.
Build the request, send it, read raw headers and timing — from your iPhone. Free to start.