Hide Referrer on click
Solution 1:
As of 2015 this is how you prevent sending the Referer header:
<meta name="referrer" content="no-referrer" />
Just add this to the head section of the web page. Works both for links and for Ajax requests.
Solution 2:
In HTML 5 links should support rel="noreferrer" for this purpose.
Solution 3:
Here is a fool proof way to do this. I use this script in an app that sometimes links to 3rd-party websites from pages who's URLs need to be kept private.
<?php
session_start();
/**
Setp 1. Get the query string variable and set it in a session, then remove it from the URL.
*/
if (isset($_GET['to']) && !isset($_SESSION['to'])) {
$_SESSION['to'] = urldecode($_GET['to']);
header('Location: http://yoursite.com/path/to/this-script.php');// Must be THIS script
exit();
}
/**
Step 2. The page has now been reloaded, replacing the original referer with what ever this script is called.
Make sure the session variable is set and the query string has been removed, then redirect to the intended location.
*/
if (!isset($_GET['to']) && isset($_SESSION['to'])) {
$output = '<!DOCTYPE html>
<html>
<head>
<meta name="robots" content="none">
<title>Referral Mask</title>
</head>
<body>
<h3>Redirecting...</h3>
<script>window.location.href="'.$_SESSION['to'].'"</script>
<a href="'.$_SESSION['to'].'">Here is your link</a>
</body>
</html>' . "\n";
unset($_SESSION['to']);
echo $output;
exit();
}
?>
<!DOCTYPE html>
<html>
<head>
<meta name="robots" content="none">
<title>Referral Mask</title>
</head>
<body>
<h1>Referral Mask</h1>
<p>This resource is used to change the HTTP Referral header of a link clicked from within our secure pages.</p>
</body>
</html>
This script uses both PHP and JavaScript to reliably remove the original referrer from the headers.
Solution 4:
Work-around, not a solution:
generate all such links through tinyurl.com or similar service.
Take <url> you want to redirect to, and raw-url-encode it. Generate some random string of say 10-15 chars (to ensure it's availability) lest call it <alias>.
Then call http://tinyurl.com/create.php?alias=<alias>&url=<url>
E.g. http://tinyurl.com/create.php?alias=ahdiwabdoubiadasd&url=http%3A%2F%2Fwww.whatismyreferer.com%2F
Now you can verify that http://tinyurl.com/ahdiwabdoubiadasd leads to www.whatismyreferer.com with referrer disguised
Solution 5:
In addition to jimps' answer i created a one file .php solution that will work with both HTTPS and HTTP. It uses two steps (and so it will call anonym.php twice). First a javascript redirect, second a php header location redirect. I personally needed this to test posted urls from within an admin area. Enjoy!
<?php
// anonym.php
if ($_SERVER['QUERY_STRING']) {
if (stripos($_SERVER['QUERY_STRING'], 'anonym2=') === FALSE) {
echo '<script>document.location.replace("anonym.php?anonym2=' .$_SERVER['QUERY_STRING']. '");</script>';
} else {
header('Location: ' . str_replace('anonym2=', '', $_SERVER['QUERY_STRING']));
}
exit();
}
?>
In adition to