From a glance at MDN [1] and specs [3] it seems at least we can still opt-in our sites to suggest visitors user agent to pass full referrer address along outgoi

From a glance at MDN [1] and specs [3] it seems at least we can still opt-in our sites to suggest visitors user agent to pass full referrer address along outgoing links; there seems to be three ways to do so: # 1. Apache conf Header set Referrer-Policy "no-referrer-when-downgrade" <!-- 2. meta HTML head with same effect [2] --> <meta name="referrer" content="no-referrer-when-downgrade"> <!-- 3. HTML anchor attribute --> <a href="https://…" referrerpolicy="no-referrer-when-downgrade"> This will pass full path and query when navigating between HTTPS to foreign origin. I guess it will be lost in http: to https: redirects. `unsafe-url` value would do it even for HTTP. (Funny all three have different spelling, and that in effect they direct value of a single HTTP header with inherently erroneous spelling.) [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... [2] my guess using `<meta http-equiv="Referrer-Policy" content="no-referrer-when-downgrade">` should do the same, but is not explicitly mentioned anywhere. [3] https://w3c.github.io/webappsec-referrer-policy/ https://w3c.github.io/webappsec-referrer-policy/