diff --git a/pages/faq.md b/pages/faq.md index 49c2e71..e59aadf 100644 --- a/pages/faq.md +++ b/pages/faq.md @@ -87,9 +87,9 @@ However, this means that if a website migrates to HTTPS, any HTTP sites it links Website owners who wish to continue sending outbound referrer information to linked HTTP sites can use **[Referrer Policy](https://www.w3.org/TR/referrer-policy/)** to override browser default behavior, while retaining the privacy of HTTPS URLs. -To do this, websites **should use** the [`origin-when-cross-origin`](https://www.w3.org/TR/referrer-policy/#referrer-policy-origin-when-cross-origin) policy. This will allow supporting browsers to send **only the origin** as the `Referer` header when going from an HTTPS site to an HTTP site. +To do this, websites **should use** the [`origin-when-cross-origin`](https://www.w3.org/TR/referrer-policy/#referrer-policy-origin-when-cross-origin) policy. This will allow supporting browsers to send **only the origin** as the `Referer` header. This limited referral information applies even if both sites use HTTPS. -For example, if a user is on `https://agency.gov/help/aids.html` and clicks a link to `http://moreinformation.com`, then if `origin-when-cross-origin` is set, the browser will make an HTTP request to `http://moreinformation.com` with a `Referer` header of `https://agency.gov`. +For example, if a user is on `https://agency.gov/help/aids.html` and clicks a link to `https://moreinformation.com`, then if `origin-when-cross-origin` is set, the browser will make an HTTP request to `https://moreinformation.com` with a `Referer` header of `https://agency.gov`. The simplest way to set this policy is by including a `` tag in the body of the HTTPS website: