Secure default
- strict-origin-when-cross-origin -> valid
web validator
Referrer-Policy Validator
Validate Referrer-Policy header/meta values against allowed directives.
Results
Paste input and validate locally.- Status
- Ready when you validate.
- Details
- Ready when you validate.
- Policies
- Ready when you validate.
- Invalid entries
- Ready when you validate.
Rules & checks
Allows standard directives: no-referrer, no-referrer-when-downgrade, same-origin, origin, strict-origin, origin-when-cross-origin, strict-origin-when-cross-origin, unsafe-url.
Supports comma-separated values.
Runs entirely client-side/offline; no data leaves the page.
When to use it
- QA security headers and meta tags
- Validate CDN/edge overrides
- Ensure referrer privacy policies are enforced
Tips
- Prefer strict-origin-when-cross-origin as a balanced default
- Avoid unsafe-url unless required for analytics
Examples
Multiple values
- no-referrer, strict-origin -> valid
Invalid token
- foo -> invalid
FAQs
- Is anything uploaded?
- No. Validation is local and clears on refresh.
Related validators
web
Security Headers SEO Validator & Public Site Hardening Checker
Validate public-site HTTP security headers for HTTPS trust, response hardening, framing protection, referrer leakage, browser permissions, and launch-readiness QA.
web
Meta Robots / X-Robots-Tag SEO Validator
Validate page-level indexability signals across meta robots, X-Robots-Tag headers, canonical targets, snippet controls, and launch noindex cleanup.
web
Open Graph & Twitter Card SEO Validator
Validate rendered Open Graph and Twitter/X card tags for search-result snippets, social previews, share-card images, absolute URLs, and launch QA before publishing.
Format-only; does not inspect actual network requests.