Defaults.Exposed › October 2026 census › v10 registry › Referrer-Policy
Referrer-Policy
Methodology v10 · canonical ID referrer-policy · Web Security · scored
Controls what address info leaks to other sites when visitors click away.
Referrer-Policy: definition
| Canonical ID | referrer-policy |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The site sends a Referrer-Policy header. |
| Fail | The header is absent. |
| Example (passing) | Referrer-Policy: strict-origin-when-cross-origin |
Referrer-Policy across the census
8.86% of domains whose page returned a 2xx response send a Referrer-Policy header (11,749,665 of 132,559,479, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
Referrer-Policy is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 199,932,840 of the 332,492,319 graded domains had no determinable result for this check: the four response-header checks run only where the page returned a 2xx response; redirects, errors and unanswered fetches return N/A.
Every outcome in the census
| Outcome | Domains | Share of domains whose page returned a 2xx response | In the headline figure |
|---|---|---|---|
| Referrer-Policy header sent | 11,749,665 | 8.86% | Yes |
| Header absent | 120,809,814 | 91.1% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of domains whose page returned a 2xx response that send a Referrer-Policy header by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 89,943,208 domains | 8.90% | .shop 27.2%, .app 25.6%, .dev 21.2% | .xyz 2.71%, .top 4.02%, .cyou 5.66% |
| Country-code TLDs (ccTLDs): 167 TLDs, 42,370,451 domains | 8.77% | .ai 28.0%, .kr 25.9%, .si 21.3% | .jp 4.00%, .xn--p1ai 4.78%, .cn 4.87% |
The largest TLD in this base, .com, stands at 8.52% (4,967,699 of 58,295,711).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 132,313,659 of the 132,559,479 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 Web Security checks with a published figure, Referrer-Policy has the 5th highest pass share. Next above it is Clickjacking protection: 15.9% of domains whose page returned a 2xx response. Next below it is Content-Security-Policy: 2.85% of domains that sent a Server, Content-Security-Policy or X-Powered-By header. Across every check with a published figure it ranks 21st of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Referrer-Policy
Cite this check
Defaults.Exposed, "Referrer-Policy (referrer-policy)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/referrer-policy
Permalink: https://defaults.exposed/methodology/referrer-policy ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data