I have a domain lets say www.domain.com which i am redirecting to www.whatismyreferer.com to check referer. When i redirect page using PHP headers it shows No referer / hidden in result. I want to set referer as www.domain.com on whatismyrefer.com
<?php
header("Referrer-Policy: origin");
header("Location: https://www.whatismyreferer.com",true, 302);
?>
I have also tried referrer-policy: unsafe-url but still gets no referer
<meta name="referrer" content="origin">
<meta http-equiv="refresh" content="0;https://www.whatismyreferer.com">
then it shows referrer. I dont want to do it with meta tags, i want to do it with header location
I think the problem is probably how you are testing it. The 3xx redirect preserves the original Referer - the browser won't set a new Referer on the redirect itself. So, if you are directly requesting .index.php on your site (no referer) then there will also be no referer on the redirected request.
The meta refresh is not a 3xx HTTP redirect and behaves like you are following a regular anchor/link, so the browser generates a Referer.
Instead, you would need to test with a secondary file (eg. test-referer.html) that links to index.php in order to generate a Referer before testing your redirect/Referrer-Policy header.
<!-- test-referer.html -->
<a href="/index.php">index.php</a>
UPDATE:
The Referrer-Policy header works correctly for me when tested in this way.
I want to set referer as www.domain.com on whatismyrefer.com
In that case, you can't simply use 3xx HTTP redirects (without an initial referrer) because 3xx redirects don't themselves generate a referrer (as mentioned above). If 3xx redirects generated a Referer then sites would have problems with lost referrers all the time due to canonical redirects etc.
You will need to use a meta refresh (as you suggested) or perhaps a JavaScript "redirect" (untested). Or you could perhaps use CURL if the intention is to simply "fake" the Referer - although this won't directly result in a redirect.