Free tool

Referrer Policy Generator & Tester

Q: Does this tool send my data anywhere?

No. Both tools on this page run entirely in your browser. The Referrer Tester reads document.referrer, a property already available to any page you visit, and displays it locally. Nothing is transmitted to referrerattribution.com or any third party. There are no tracking scripts on this page.

See exactly what your browser sends right now, then generate the code to change it.

Tool 1 of 2

Live Referrer Tester

This reads your browser's own document.referrer right now. Nothing is sent anywhere — it all happens locally on this page.

referrer-diagnostic — live

document.referrer Reading…

Detected source type Reading…

Current page URL —

Simulate an inbound click

This link points back to this same page with dummy tracking parameters attached. Click it, then check whether the parameters survived the round trip below.

Simulate inbound click →

Tool 2 of 2

Referrer Policy Generator

Pick a policy. Copy the exact code for your platform. No build step, no dependencies.

Referrer-Policy value

HTML <meta> tag

Per-link override

Nginx

Apache (.htaccess)

WordPress (functions.php)

Cloudflare Worker

Quick Answer

What does a Referrer-Policy actually control?

A Referrer-Policy header or meta tag controls how much of your page's URL gets sent to the next site when a visitor clicks a link or your page loads a cross-origin resource. It directly affects how much attribution data downstream analytics tools, including this site's own plugin, ever receive.

Test your current policy below, then generate the exact code to change it.

Why this matters for attribution

Challenge

A site you link to is seeing less of your URL than you expect

If your own site uses a strict Referrer-Policy (no-referrer or origin), every outbound link from your pages arrives at the destination with little or no path information. This is invisible until someone downstream asks why their referrer data from your site looks incomplete.

What to do about it

Use the Generator below to set strict-origin-when-cross-origin, which preserves the full path for same-origin requests and the origin for cross-origin HTTPS requests.

Challenge

Inbound traffic to your own site shows as Direct when it should not

If the site sending you traffic has a strict Referrer-Policy, your server receives no referrer header at all, regardless of what policy your own site sets. This is the single most common reason attribution tools under-report Referral and Organic search traffic.

What to do about it

Run the Live Referrer Tester below from a few real inbound links you control to see exactly what your server is receiving today.

Challenge

You changed a security header and traffic patterns shifted overnight

Referrer-Policy is frequently set as part of a broader security headers rollout (alongside Content-Security-Policy, X-Frame-Options, and similar), often without anyone connecting it to the analytics team. A move from the modern default to a stricter policy is easy to make for security reasons without realizing the attribution cost.

What to do about it

Check your current live header in the Tester below before assuming a traffic drop is real rather than a measurement gap.

Before you deploy this

Questions worth answering first

A policy change is a five-minute edit with effects that show up in your analytics weeks later. Read these first.

Will changing my Referrer-Policy break my analytics?

It can. Stricter policies like no-referrer or origin strip or shorten the referrer data your analytics platform receives from inbound links. If your dashboards rely on full referrer URLs to attribute traffic, switching to a stricter policy without testing first can make some traffic look like Direct that was not. Test on a staging environment before deploying a stricter policy site-wide.

What is the actual default if I set nothing at all?

Modern browsers (Chrome 85+, Firefox 87+, Safari) default to strict-origin-when-cross-origin when no policy is declared. Older documentation and some hosting defaults still reference no-referrer-when-downgrade, which was the previous default. If you have not explicitly set a policy, assume your visitors are on the modern default unless you have reason to believe otherwise.

Does this tool send my data anywhere?

Why did my test parameters disappear after I clicked the simulate button?

Most commonly: a browser privacy feature, ad blocker, or your own site's Referrer-Policy header stripped them before the page reloaded. Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection are the two most common causes on modern browsers. This is the same mechanism that can strip attribution parameters from real campaign links, which is exactly why server-side attribution exists.

Which policy should I actually use for marketing attribution?

strict-origin-when-cross-origin (the modern default) is the right balance for most sites: it sends the full URL to same-origin requests and only the origin to cross-origin HTTPS requests, while sending nothing to a less secure HTTP destination. Switching to a stricter policy than this trades attribution visibility for privacy and gains very little additional protection on a typical marketing site.

Does CQI Referrer Attribution depend on the visitor's Referrer-Policy?

Partly. CQI Referrer Attribution reads the HTTP referrer header on the server the same way any analytics tool does, so it is subject to the same browser-side stripping behavior these tools test. This is exactly why the plugin also classifies sessions using UTM parameters as a parallel signal: when the referrer is stripped or restricted, a UTM-tagged link still attributes correctly.

Referrer data is only half the picture

Browser referrer headers get stripped more often every year. CQI Referrer Attribution adds UTM-based classification as a parallel signal, so your attribution survives even when the referrer does not.

Install Free See how it works

Referrer Policy Generator & Tester

Live Referrer Tester

Simulate an inbound click

Referrer Policy Generator

What does a Referrer-Policy actually control?

Why this matters for attribution

A site you link to is seeing less of your URL than you expect

Inbound traffic to your own site shows as Direct when it should not

You changed a security header and traffic patterns shifted overnight

Questions worth answering first

Will changing my Referrer-Policy break my analytics? +

What is the actual default if I set nothing at all? +

Does this tool send my data anywhere? +

Why did my test parameters disappear after I clicked the simulate button? +

Which policy should I actually use for marketing attribution? +

Does CQI Referrer Attribution depend on the visitor's Referrer-Policy? +

Referrer data is only half the picture

Will changing my Referrer-Policy break my analytics?

What is the actual default if I set nothing at all?

Does this tool send my data anywhere?

Why did my test parameters disappear after I clicked the simulate button?

Which policy should I actually use for marketing attribution?

Does CQI Referrer Attribution depend on the visitor's Referrer-Policy?