◆Error Codes Wiki

Referrer-Policy Errors — Missing Referrer Data and Privacy Header Issues

Informational4xx client error

Overview

Fix Referrer-Policy configuration errors causing missing referrer data in analytics, broken affiliate tracking, and cross-origin referrer leaks.

Key Details

  • Referrer-Policy controls how much referrer information is sent with requests from your page
  • Browsers default to 'strict-origin-when-cross-origin' which strips the path for cross-origin requests
  • Overly strict policies (no-referrer) break analytics, affiliate tracking, and some API integrations
  • Overly permissive policies (unsafe-url) leak full URLs including query parameters to third parties
  • The policy can be set via HTTP header, meta tag, or per-element rel/referrerpolicy attributes

Common Causes

  • Referrer-Policy: no-referrer preventing analytics from seeing traffic sources
  • Policy stripping query parameters that contain affiliate or campaign tracking IDs
  • HTTPS-to-HTTP downgrade causing the referrer to be stripped entirely (default behavior)
  • Security middleware adding 'no-referrer' globally without considering analytics requirements

Steps

  1. 1Use 'strict-origin-when-cross-origin' as a balanced default — sends origin cross-origin, full URL same-origin
  2. 2For analytics and affiliate links, use 'no-referrer-when-downgrade' to keep referrer on HTTPS-to-HTTPS
  3. 3Set per-link policies using the referrerpolicy attribute for specific outbound links
  4. 4Audit your policy's impact: check GA4 referral data for gaps before and after policy changes
  5. 5Use the meta tag <meta name='referrer' content='strict-origin-when-cross-origin'> as a page-level fallback

Tags

referrer-policyreferrerprivacyanalyticstracking

More in 4xx Client Error

http-400-bad-requestHTTP 400 Bad Request — What It Means & How to Fix It
Error
http-401-unauthorizedHTTP 401 Unauthorized — What It Means & How to Fix It
Error
http-402-payment-requiredHTTP 402 Payment Required — What It Means & How to Fix It
Error
http-403-forbiddenHTTP 403 Forbidden — What It Means & How to Fix It
Error
http-404-not-foundHTTP 404 Not Found — What It Means & How to Fix It
Error
http-405-method-not-allowedHTTP 405 Method Not Allowed — What It Means & How to Fix It
Error

Frequently Asked Questions

strict-origin-when-cross-origin is the recommended default. It sends the full URL for same-origin requests and only the origin (not path/query) for cross-origin requests.