referrerpolicy Values Table

Resolves a referrerpolicy attribute to its standard keyword or the empty inherited-policy state. It does not compute referrer URLs or combine document headers and noreferrer.

Description

Referrer policy controls how much referring-page information may accompany a request.

Referrer policy controls how much referring-page information may accompany a request. An empty attribute state defers to the surrounding policy rather than choosing a standalone explicit keyword.^[1]

The tool returns state, validKeyword, inheritsPolicy. The fields describe the supplied local pattern or effective state, or contain the formatted markup shown below.

When to use referrerpolicy Values Table

Use this for the following task: Resolves a referrerpolicy attribute to its standard keyword or the empty inherited-policy state. It does not compute referrer URLs or combine document headers and noreferrer. Provide the requested local fields extracted from the relevant element or attribute.

How to use referrerpolicy Values Table and understand its results

Prepare the parsed element names, attribute values or direct element-child lists requested below. Keep attribute presence separate from its value.
Enter present, value according to the field table, then run the tool.
Read state, validKeyword, inheritsPolicy. Check the effective state, recognized-token flags or generated markup against the rules below.
Correct any reported local mismatch and check the resulting markup in its intended document and browser context.

Input field	Meaning	Value type and bounds	Requirement
present	Present	boolean	Required
value	Value	string; maximum text length 100000	Required

Provide presence and value. Recognize the empty string and eight standard policy keywords after ASCII case folding. Return state, validKeyword and inheritsPolicy.

recognized present value → that state; absent/invalid → empty state; inheritsPolicy = state is empty

The symbols and boundary conditions refer to the supplied fields and the implementation described above.

Output field	Meaning	Value type
state	State	string
validKeyword	Valid Keyword	boolean
inheritsPolicy	Inherits Policy	boolean

json

{
  "input": {
    "present": true,
    "value": "strict-origin-when-cross-origin"
  },
  "output": {
    "state": "strict-origin-when-cross-origin",
    "validKeyword": true,
    "inheritsPolicy": false
  }
}

Limitations and assumptions

The present flag distinguishes an absent attribute from a present empty value. Keyword matching folds ASCII uppercase without trimming. No referrer URL is computed, and document headers, noreferrer and the effective default policy are not combined.

The tool does not fetch a page, run a browser or validate an entire HTML document. Malformed tool requests produce input errors; valid requests can still report unrecognized values or failed local checks.

Alternative or Complementary methods

Choose target=_blank rel=opener Security Check when you need its operation: Resolves opener behavior requested by an anchor with target=_blank under modern HTML rules. Implicit noopener applies unless opener is present; noreferrer or noopener takes precedence. Choose crossorigin anonymous/use-credentials Table for the complementary operation: Resolves a CORS settings attribute and potential-CORS request credentials mode for img/media without the same-origin fallback flag. Missing attribute means no-cors/include; empty or invalid present values mean cors/same-origin. Always-CORS features use a different mapping.

Background reference: HTML Standard: referrerpolicy Values Table.

References

HTML Standard: referrerpolicy Values Table — WHATWG

Similar or alternative tools

target=_blank rel=opener Security Check
Resolves opener behavior requested by an anchor with target=_blank under modern HTML rules. Implicit noopener applies unless opener is present; noreferrer or noopener takes precedence.
crossorigin anonymous/use-credentials Table
Resolves a CORS settings attribute and potential-CORS request credentials mode for img/media without the same-origin fallback flag. Missing attribute means no-cors/include; empty or invalid present values mean cors/same-origin. Always-CORS features use a different mapping.