A simple privacy-enhancing plugin to stop browsers from sending referrer information.
When you click on a link, your browser normally tells the destination page what page you were on when you clicked the link. This is called the HTTP referer [sic!]. This also happens when your browser loads things like images, fonts and external CSS/JS.
This is bad for privacy. For sensitive sites, it can be terrible for privacy. However, with HTML5, there are now ways to stop referrers from being sent.
This plugin, by default, adds
rel="noreferrer" to external links in posts, pages and comments, and
referrer="no-referrer" to images and iframes.
As defined in the HTML5 spec,
rel="noreferrer" "indicates that no referrer information is to be leaked when following the link".
As defined in the Referrer Policy Draft,
referrer="no-referrer" "specifies that no referrer information is to be sent along with requests made from a particular settings object to any origin".
The plugin modifies elements right before they are displayed. It doesn't modify anything in the database. Existing attributes, including any existing
rel attributes (such as the one set by
wp_rel_nofollow()), are preserved. It is possible to whitelist domains if you do want to send referrer information to them.
referrer attribute is not yet supported by the stable version of any browser (July 2015).
This plugin, by default, also sets Referrer Policy to
never via a
meta tag. This is even better for privacy: it tells the browser not to send referrer information at all and applies to both links as well as requests generated by the page (CSS, images, etc.). While still just a W3C draft, it is supported by Firefox (since version 37), Chrome and Safari (added to WebKit in November 2011), and by Microsoft Edge in Windows 10 (source).
Please note that this could affect plugins that foolishly rely on the refer(r)er header, as well as third-party tools you might use.
If you enable this, whitelisting internal links and other elements is possible thanks to the referrer attribute; however, support for this has not yet made it into the stable version of any browser.
Inspired by the Drupal module No referrer.
The code is available on GitHub.