Referrer Policy Best Practices for Magento &

Introduction

The Referrer‑Policy header tells browsers what information to include in the Referer request header when navigating from one page to another. A well‑chosen policy safeguards sensitive query parameters (e.g., search terms, coupon codes) while ensuring search engines can still understand site structure—both important for SEO and security.

1. Why Referrer‑Policy Matters

Impact	Explanation
Privacy	Prevents leaking personal data (search queries, email hashes) to third‑party sites.
Security	Stops malicious sites from harvesting campaign parameters that could be used for phishing.
SEO	Allows Googlebot to see the originating URL, preserving link equity and crawl context.

2. Common Referrer‑Policy Values

Value	Behavior
`no-referrer`	No Referer header is sent at all. Highest privacy, but search engines lose referral data.
`no-referrer-when-downgrade` (default in many browsers)	Sends full URL to HTTPS → HTTPS, but strips it when navigating to HTTP.
`origin`	Sends only the scheme + host (e.g., `https://example.com`).
`origin-when-cross-origin`	Sends full URL for same‑origin requests, origin only for cross‑origin.
`strict-origin-when-cross-origin` (recommended)	Full URL for same‑origin, origin only for cross‑origin, and never sends on HTTPS → HTTP.
`unsafe-url`	Sends full URL to any destination (least privacy).

3. Implementing Referrer‑Policy on Magento 2

3.1 Apache/Nginx Header Configuration

Add the header to your web server configuration:

Header always set Referrer-Policy "strict-origin-when-cross-origin"

or for Nginx:

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

3.2 Magento Middleware (Optional)

If you need per‑store or per‑page policies, create a simple middleware module:

<?php
namespace Vendor\ReferrerPolicy\Plugin;
class AddHeader {
    public function beforeDispatch(
        \Magento\Framework\App\FrontControllerInterface $subject,
        \Magento\Framework\App\RequestInterface $request
    ) {
        $response = $subject->getResponse();
        $response->setHeader('Referrer-Policy', 'strict-origin-when-cross-origin', true);
        return [$request];
    }
}

Deploy and run setup:upgrade.

4. Implementing Referrer‑Policy on Shopify

Shopify’s hosted environment automatically sets Referrer-Policy: strict-origin-when-cross-origin for most themes. To enforce or customize it: 1. Edit theme.liquid and add a meta tag (browsers treat it like a header):

<meta name="referrer" content="strict-origin-when-cross-origin">

Shopify Plus – Edge Middleware (beta) – Use a Shopify Function to inject the header on the edge:

export default async function handler(request) {
  const response = await fetch(request);
  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
  return response;
}

Deploy via shopify function push.

5. SEO Implications

Preserves Link Equity: Search engines still see inbound link structure because the origin is sent.
Avoids Crawl Errors: No accidental leakage of URL fragments that could be treated as duplicate content.
Enhances Trust: Users see a padlock with privacy‑enhancing headers, improving click‑through rates.

6. Testing & Validation

Use cURL to verify the header:

curl -I https://shop.example.com | grep Referrer-Policy

Chrome DevTools → Network panel → inspect response headers.
Run Lighthouse; the “Secure Headers” audit will flag missing or weak policies.

7. Checklist

Set Referrer-Policy: strict-origin-when-cross-origin at the web‑server level.
Verify the header is present on all pages (including checkout).
Test with cURL and Chrome DevTools.
Run Lighthouse to ensure the Secure Headers audit passes.
Monitor Search Console for any crawl issues after deployment.

Conclusion & Call‑to‑Action

A proper Referrer‑Policy protects your customers, hardens your Magento or Shopify store, and keeps search engines happy. Ready to tighten privacy while preserving SEO value? Click the “Start a project” button in the MODRACX portfolio, and let’s implement a robust Referrer‑Policy together.

Kenneth D’Silva – Magento & Shopify specialist, MODRACX

Referrer Policy Best Practices for Magento & Shopify