Image Referrer-Policy Checker

Line	Page	Image	Policy	Status	Context	Bytes	Notes
3	https://example.com/pricing	https://assets.partner.net/banner.jpg	unsafe-url	200	pricing hero	260.0 KB	unsafe-url may expose full URL and query strings to third-party origins. Policy unsafe-url is outside your cross-origin allowlist. Critical policy-risk bytes on this page total 260.0 KB, above 240.0 KB.
5	https://example.com/account	http://cdn.example.com/avatar.jpg	no-referrer-when-downgrade	403	profile avatar critical	95.0 KB	Policy no-referrer-when-downgrade is outside your cross-origin allowlist. Image is served over HTTP; downgrade requests can drop referrer context. Status 403 indicates redirect/error risk for image delivery.
4	https://example.com/docs	https://example.com/images/diagram.png	(missing)	302	docs image	88.0 KB	Status 302 indicates redirect/error risk for image delivery.
1	https://example.com/	https://cdn.example.com/home/hero.avif	strict-origin-when-cross-origin	200	hero lcp	180.0 KB	No major referrer-policy risks detected for this row.
2	https://example.com/blog	https://img.example.com/posts/chart.webp	origin-when-cross-origin	200	article image	120.0 KB	No major referrer-policy risks detected for this row.

Line

Page

Image

Policy

Status

Context

Bytes

Notes

https://example.com/pricing

https://assets.partner.net/banner.jpg

unsafe-url

200

pricing hero

260.0 KB

unsafe-url may expose full URL and query strings to third-party origins. Policy unsafe-url is outside your cross-origin allowlist. Critical policy-risk bytes on this page total 260.0 KB, above 240.0 KB.

https://example.com/account

http://cdn.example.com/avatar.jpg

no-referrer-when-downgrade

403

profile avatar critical

95.0 KB

Policy no-referrer-when-downgrade is outside your cross-origin allowlist. Image is served over HTTP; downgrade requests can drop referrer context. Status 403 indicates redirect/error risk for image delivery.

https://example.com/docs

https://example.com/images/diagram.png

(missing)

302

docs image

88.0 KB

Status 302 indicates redirect/error risk for image delivery.

https://example.com/

https://cdn.example.com/home/hero.avif

strict-origin-when-cross-origin

200

hero lcp

180.0 KB

No major referrer-policy risks detected for this row.

https://example.com/blog

https://img.example.com/posts/chart.webp

origin-when-cross-origin

200

article image

120.0 KB

No major referrer-policy risks detected for this row.

About this tool

Review image exports before deployment so cross-origin image requests use explicit, predictable referrer policies and avoid leakage patterns that can create privacy and governance risk.

Image Referrer Policy Checker is useful when image requests need the right privacy and request-context behavior across analytics, embeds, or third-party services. It helps teams review whether the chosen referrer policy matches how much page context should travel with image requests.

Parses rows in URL|image-url|referrerpolicy|status|context|bytes format and normalizes relative paths with an optional base URL.
Flags missing/invalid referrerpolicy values, unsafe-url usage, and legacy no-referrer-when-downgrade defaults.
Surfaces critical-image weak-policy byte overflow pages to prioritize fixes with the highest delivery impact first.

How to use Image Referrer-Policy

Inspect the image markup or policy value, review the expected request behavior, and compare it with the privacy or compatibility goal of the integration. If the image is served by a third party, verify the policy against both privacy expectations and any vendor requirements before changing it broadly.

When this tool is useful

Parses rows in URL|image-url|referrerpolicy|status|context|bytes format and normalizes relative paths with an optional base URL.
Flags missing/invalid referrerpolicy values, unsafe-url usage, and legacy no-referrer-when-downgrade defaults.
Surfaces critical-image weak-policy byte overflow pages to prioritize fixes with the highest delivery impact first.

Practical tips

Why people use this tool

People look for referrer policy checks when image integrations behave unexpectedly or policy reviews become more detailed. The page is strongest when it makes a low-level attribute understandable enough to support practical front-end decisions.

Related search intents

image referrer policy checker, img referrerpolicy audit, image privacy header tool, referrer policy image tag, request policy validator.

Frequently asked questions

What input format does this image referrer-policy checker expect?

Why set explicit referrerpolicy values on cross-origin images?

Explicit policies prevent silent browser-default drift and let teams enforce consistent privacy and attribution behavior across CDN and third-party image hosts.

What referrer leakage risks apply specifically to images?

When images are loaded from third-party hosts, the browser may send the full page URL in the Referer header, potentially exposing sensitive path segments, query parameters, or internal page structures to external image servers. The checker flags policies that permit this leakage.

Which referrer-policy value is recommended for cross-origin images?

The recommended value is 'strict-origin-when-cross-origin', which sends only the origin (not the full URL) to cross-origin image hosts and sends the full URL only to same-origin requests. This balances analytics needs with privacy protection.

Does the per-element referrerpolicy attribute override the page-level meta tag?

Yes, a referrerpolicy attribute set directly on an img element takes precedence over the page-level meta name='referrer' tag. The checker audits both levels and flags elements where the per-image policy is weaker than the page-level default, creating unintended leakage.

Line	Page	Image	Policy	Status	Context	Bytes	Notes
3	https://example.com/pricing	https://assets.partner.net/banner.jpg	unsafe-url	200	pricing hero	260.0 KB	unsafe-url may expose full URL and query strings to third-party origins. Policy unsafe-url is outside your cross-origin allowlist. Critical policy-risk bytes on this page total 260.0 KB, above 240.0 KB.
5	https://example.com/account	http://cdn.example.com/avatar.jpg	no-referrer-when-downgrade	403	profile avatar critical	95.0 KB	Policy no-referrer-when-downgrade is outside your cross-origin allowlist. Image is served over HTTP; downgrade requests can drop referrer context. Status 403 indicates redirect/error risk for image delivery.
4	https://example.com/docs	https://example.com/images/diagram.png	(missing)	302	docs image	88.0 KB	Status 302 indicates redirect/error risk for image delivery.
1	https://example.com/	https://cdn.example.com/home/hero.avif	strict-origin-when-cross-origin	200	hero lcp	180.0 KB	No major referrer-policy risks detected for this row.
2	https://example.com/blog	https://img.example.com/posts/chart.webp	origin-when-cross-origin	200	article image	120.0 KB	No major referrer-policy risks detected for this row.

Line

Page

Image

Policy

Status

Context

Bytes

Notes

https://example.com/pricing

https://assets.partner.net/banner.jpg

unsafe-url

200

pricing hero

260.0 KB

https://example.com/account

http://cdn.example.com/avatar.jpg

no-referrer-when-downgrade

403

profile avatar critical

95.0 KB

https://example.com/docs

https://example.com/images/diagram.png

(missing)

302

docs image

88.0 KB

Status 302 indicates redirect/error risk for image delivery.

https://example.com/

https://cdn.example.com/home/hero.avif

strict-origin-when-cross-origin

200

hero lcp

180.0 KB

No major referrer-policy risks detected for this row.

https://example.com/blog

https://img.example.com/posts/chart.webp

origin-when-cross-origin

200

article image

120.0 KB

No major referrer-policy risks detected for this row.