Check a Referrer-Policy value or a raw HTTP header block before it reaches production. The checker recognizes the standard directives, flags duplicate or conflicting declarations, and explains how much referrer information each policy can expose. It also spots the common comma-list fallback pattern and identifies the policy modern browsers will apply. Everything runs locally in the page, so pasted response headers are not sent to a server.
Parses Referrer-Policy fields case-insensitively, validates every token, then treats the last recognized token as the effective policy.
A valid policy controls referrer disclosure; it does not prevent navigation tracking through other mechanisms.
Referrer-Policy: strict-origin-when-cross-origin
Valid: strict-origin-when-cross-origin Cross-origin behavior: origin only on HTTPS; none on downgrade.
The parser accepts either a bare directive, comma-separated fallback list, or a raw response-header block. Obsolete values are reported separately.
Browser extensions, HTML referrerpolicy attributes, and a page-level meta policy can override or narrow a response header.
The checker reports this directly from the supplied policy or headers and shows the relevant value in its output.
Use the result together with the browser and server behavior you support; the page does not make remote requests.
Review the generated finding before deployment, especially when proxies or CDNs can alter headers.
The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.
Retest with the exact production response because small header changes can affect the conclusion.
| Stage | What is reported |
|---|---|
| Parse | Recognized input fields and values |
| Validate | Invalid, missing, or conflicting settings |
| Export | Text, CSV, and JSON when structured data is available |
Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.
View HTTP & Security Headers