What are the Referer header and Referrer-Policy?

Short answer

Referer is the request header that states from which page the browser initiated a request (its name is historically written with a single r in the standard); in a request made to a link or an image on a page, the address of that page is sent. Referrer-Policy, on the other hand, is the header that the server sends with the response and that determines how much information the browser will share in Referer. In TR7, Referer is listed in the Traffic view of the vService Report as the addresses that referred the request, can be made a decision criterion with the HTTP Header condition (e.g. hotlink protection), and is inspected according to the URI format in the default header rules of the WAF. Referrer-Policy is added to the response through the Manage HTTP Security Headers action: in its Response Headers field, Referrer-Policy (no-referrer-when-downgrade) is selected.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Load Balancer vService List → vService → Report → Traffic	Referer	Which pages the requests come from
Load Balancer → Conditions (Policy Match) → HTTP Header condition	Header Name: Referer	A decision based on Referer (e.g. hotlink protection)
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers action	Response Headers → Referrer-Policy (no-referrer-when-downgrade)	Adding the Referrer-Policy header to the response
Load Balancer → Profiles (L4-L7 Behavior Sets) → Logs → log format	Apache Combined Log Format ( Standard + Referrer + User Agent ), Apache VHost Log Format ( Vhost + Standard + Referrer + User Agent )	Writing Referer to the log line
WAF → WAF-Protected vService List → WAF Management → Any Paths rule → Header	Default Header Rules → referer	Inspecting whether the Referer value conforms to the URI format and to a length of at most 4096 characters
Bot/DDoS → Bot/DDoS Protected vService List → Bot/DDoS Management → Bot Protection → Factors	Behavioral Analysis → No Referer On Mutation	Reflecting the absence of Referer in a POST, PUT, PATCH or DELETE request in the bot score

The Referrer-Policy (no-referrer-when-downgrade) value does not send Referer in requests made from an HTTPS page to an HTTP address; in other requests, it sends the full address (Referrer Policy · W3C). Adding the security headers together: Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?

Common Misconceptions

• "Referer is reliable source information." Its value is written by the client; it can be changed or not sent at all. In decisions such as hotlink protection, it is a supporting criterion; on its own, it is not sufficient for access control.
• "Referrer-Policy affects the request." Referrer-Policy is a response header; it determines how the browser will send Referer in the subsequent requests from that page. The Manage HTTP Security Headers action works only at the response stage, and without a condition.
• "Referer and Referrer are spelled the same." The standard name of the request header is Referer (single r); the policy header is written as Referrer-Policy, with a double r.

How it is done in the documentation

• HTTP header condition · Scenario 5: Referer-Based Hotlink Protection
• Manage HTTP Security Headers · The Security Headers That Can Be Selected
• Report · HTML Report
• Header · Default Header Rules

Related questions

• What are the default header rules?
• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?
• What are HTTP security headers?
• What is an HTTP Header?