# referrer (/en/docs/web-security/policies/content-security-policy/directives/referrer) The `referrer` Content Security Policy (CSP) directive was a pre-CSP3 experimental directive for controlling the `Referer` header a page sends with outgoing requests. It was never standardized and has been removed from browsers. `referrer` was an experimental directive that never made it into the CSP specification. The platform standardized referrer control as the dedicated [Referrer-Policy](/en/docs/web-security/security-headers/referrer-policy) header instead of a CSP directive, so browsers removed `referrer`. Set `Referrer-Policy` in its place. Use the replacement instead: ```http Referrer-Policy: strict-origin-when-cross-origin ``` ## What you should do instead [#what-you-should-do-instead] Referrer behavior got its own header. Set [Referrer-Policy](/en/docs/web-security/security-headers/referrer-policy) on your responses; the OWASP HTTP Headers cheat sheet recommends `strict-origin-when-cross-origin`, the value shown above. Delete `referrer` from any policy that still carries it; it controls nothing in current browsers. You can check which security headers a live page sends, including `Referrer-Policy`, with the [security headers scanner](/tools/security-headers). ## Why it was removed [#why-it-was-removed] `referrer` predates CSP Level 3 and was only ever an experiment. The platform standardized referrer control as a dedicated `Referrer-Policy` header rather than a CSP directive, so the directive was dropped and browsers removed it. ## Browser support [#browser-support] No current browser supports the `referrer` directive. Use the `Referrer-Policy` header, which is widely supported. ## See also [#see-also] * [Directives index](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives) * [Evaluate a policy](/tools/csp-evaluator) with the CSP evaluator * [Scan a page's security headers](/tools/security-headers) ## Sources [#sources] * [MDN, Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy) * [OWASP, HTTP Headers cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html)