About this tool
Review image exports before deployment so cross-origin image requests use explicit, predictable referrer policies and avoid leakage patterns that can create privacy and governance risk.
The Image Referrer-Policy Checker audits image request privacy by reviewing per-image referrerpolicy values, page-level defaults, response status, context, and transferred bytes. It flags unsafe policies such as unsafe-url, missing cross-origin controls, and legacy no-referrer-when-downgrade behavior that can leak page paths or query strings to external image hosts. The report helps SEO, privacy, and frontend teams align image delivery with modern request-governance expectations before publishing.
- Parses rows in URL|image-url|referrerpolicy|status|context|bytes format and normalizes relative paths with an optional base URL.
- Flags missing/invalid referrerpolicy values, unsafe-url usage, and legacy no-referrer-when-downgrade defaults.
- Surfaces critical-image weak-policy byte overflow pages to prioritize fixes with the highest delivery impact first.
How to use Image Referrer-Policy
Paste rows with the page URL, image URL, referrerpolicy value, status code, context, and byte size. The checker normalizes image URLs, identifies cross-origin requests, and ranks rows where weak policies affect critical or high-byte images. Use the findings to update img attributes, page-level referrer defaults, CDN templates, or third-party embed rules so image requests expose only the referrer detail you intend.
When this tool is useful
- Audit cross-origin image requests before adding third-party image hosts, embeds, or CDN templates.
- Catch unsafe-url, missing, or legacy referrer policies that can expose full page URLs.
- Prioritize high-byte and above-fold images where weak policies appear across many production pages.
Practical tips
- Use strict-origin-when-cross-origin as a balanced default for most public pages unless a stricter policy is required.
- Avoid unsafe-url on images because it can send full URLs, including path and query data, to external hosts.
- Review referrerpolicy together with crossorigin and CDN host checks when adding or replacing image providers.
Examples you can test
These examples show the kind of real input and reviewed output this tool is designed to support. Use them as a starting point before pasting your own production content, then compare the output with the destination system that will use the result. The goal is not only to produce a value, but to make the input assumptions, output format, and review step clear enough that the result can be trusted in a real workflow.
Find full URL leakage to a third-party host
Example input
URL: /pricing?plan=enterprise | Image: https://media.vendor.com/badge.png | referrerpolicy: unsafe-url | status: 200 | context: badge | size: 18 KB
Expected output
Privacy risk: unsafe-url may send the full page URL, including query parameters, to the image host.
Use a stricter policy such as strict-origin-when-cross-origin or no-referrer depending on the integration.
Catch missing policy on critical CDN images
Example input
URL: / | Image: https://cdn.example.com/hero.webp | referrerpolicy: missing | status: 200 | context: hero | size: 260 KB
Expected output
Governance gap: a critical cross-origin image relies on browser or page defaults rather than an explicit policy.
Explicit policies make CDN and template behavior easier to audit when pages or providers change.
Validation checklist
Run through these checks before copying the result into a CMS, codebase, spreadsheet, campaign, support ticket, or production document. Small formatting differences, unit assumptions, hidden whitespace, and platform-specific rules are common sources of mistakes in quick browser tools, so the final review should happen in the same context where the output will be used.
- Confirm cross-origin images do not use unsafe-url unless a documented integration requires full referrer data.
- Prefer strict-origin-when-cross-origin or stricter policies for public pages with third-party image hosts.
- Check whether per-image referrerpolicy values weaken the page-level referrer default.
- Group weak-policy findings by host and page template so shared image components can be fixed once.
Why people use this tool
Images often load from CDNs, analytics vendors, marketplace media hosts, or user-generated asset domains. Without a clear referrer policy, those requests may reveal full page URLs, search parameters, campaign identifiers, or private content paths to services that do not need them. Tightening image request privacy supports user trust, reduces accidental data exposure, and reinforces the policy quality signals expected from a site seeking durable search and AdSense approval.
Related search intents
image referrer policy checker, img referrerpolicy audit, image privacy header tool, referrer policy image tag, request policy validator.