# No \`Referer:\`, no embedding

**URL:** https://meta.discourse.org/t/no-referer-no-embedding/163524
**Category:** Support
**Created:** [September 9, 2020, 3:38pm UTC](https://meta.discourse.org/t/no-referer-no-embedding/163524 "2020-09-09T15:38:34Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![AxelN](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/axeln/32/120662_2.png) [@AxelN](https://meta.discourse.org/u/AxelN)
#### Post date: [September 14, 2020, 9:58am UTC](https://meta.discourse.org/t/no-referer-no-embedding/163524/4 "2020-09-14T09:58:59Z")

</div>

Hi,

I now have a way simpler solution. It’s something that should probably be called out in [Embed Discourse comments on another website via Javascript](https://meta.discourse.org/t/embedding-discourse-comments-via-javascript/31963) :

For cross-site embedding, in the embedding pages, add either

- `<meta name="referrer" content="strict-origin">` with `Path Allowlist` set to `/.*` (because no path will be provided), or
- `<meta name="referrer" content="no-referrer-when-downgrade">` with the actual `Path Allowlist`.

As mentioned in [Referrer-Policy header - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy), “There is effort from browsers in moving to a stricter default value,” and Discourse embedding relies on the old default for cross-host embedding.

Cheers, Axel.

---

_[View the full topic](https://meta.discourse.org/t/no-referer-no-embedding/163524)._