HTML link referrer policy: control what a navigation reveals

Implementation choice

A support page links to a public claim glossary. The route is within the same application, yet the page may be reused when linking to another service that should not learn the current case URL. A no-referrer policy on the sensitive navigation is explicit and local to that link. It does not remove query parameters from the destination URL, hide the current page from scripts, or prevent the browser from recording history.

<p>Read the terminology before you submit a claim.</p>
<a href="/help/claim-terms" referrerpolicy="no-referrer">Open the claim terms</a>

What remains outside the markup

The local route must exist. A destination can still infer information from the URL being requested and from its own logs, so avoid encoding secrets in either source or destination paths.

Cost and limits

The attribute adds no separate request. The cost is policy complexity: differing link-level, document-level, and response-header rules become hard to reason about unless the application has a clear privacy policy.

Common Mistakes

• Do not assume no-referrer anonymizes the user.
• Do not put private tokens in the href and expect referrerpolicy to erase them.
• Do not use link-level policy inconsistently across sensitive pages.

Connected lessons

• HTML anchors: use href for navigation and stable fragment targets
• HTML links in a new tab: preserve context without hiding the action
• HTML title and metadata: distinguish document identity from page copy

Continue with HTML iframe referrerpolicy: limit parent-page details sent to an embed.