Referer

If you have followed a hyperlink or URL to this page, you are using an application or webpage that we have automatically blocked for violating OpenStreetMap's tile usage policy.

If you are a user of the application/website

If you are using a mobile or desktop application, please check if there is a new version of the application that fixes the map. Otherwise, if there are no updates yet, or if you are using a Web application or webpage, please contact its author and let them know about the problem. You may wish to link them to this page you are currently reading.

How to contact the software's developers

Whilst we do not hold contact details for developers using our tiles, you may be able to contact the developer of your website or application using the below general tips.

• Android Applications: Contact details for application developers can be found on the Google Play store under the "App support" section. You can long-press an application icon on the home screen, then tap "App info", then follow the "App details" link to access the Google Play Store page for an application. (Other application stores and non-stock Android may have slightly different processes.)
• Apple applications: Contact details for application developers can be found on the Apple App store under the "Information" section ("App Support" link).
• Websites: Attempt to contact the website's support team via their "Contact us", "Help", "Support" or other systems/tools they recommend on their website.

If you need the map urgently or are unable to reach the developer, please see a list of available OpenStreetMap-based applications for Android, iOS and iPadOS, or other operating system platforms.

Privacy settings & extensions

In the event you are using enhanced privacy settings and/or extensions in your browser or anti-virus software, these might be the cause of the block you can observe. More specifically:

• Antivirus/privacy software: anti-tracker settings may remove Referer from requests made to websites, preventing OSM maps from working. Please disable those functions or add an exception for tile.openstreetmap.org.
• All browsers: you must send a valid User-Agent
• All browsers: caching of content must be enabled, but still may be cleared by the end of session (private browsing) or manual cache cleanup
• On Firefox, if you changed the network.http.sendRefererHeader configuration option to any value other than 2 then you might see the error described on this page.
  • The Tor Browser stopped sending Referer headers when on .onion domains since 2017. The only workaround that site developers can use is to add the X-Requested-With header to their requests or switch to an alternate map tile provider instead.

If you are the owner/a developer of the application/website

If the block mentions "Referer is required" then please ensure the HTTP Referer header is included with every tile request. For more details, see the MDN article covering this header.

In native application contexts, consult your map provider library's documentation, or set the Referer header yourself on requests you emit.

In web contexts existence of Referer in requests is controlled by the Referrer-Policy header generally, and by Request.referrerPolicy when using the Fetch JavaScript API.

For OpenStreetMap tile usage policy compliance, your Referrer-Policy should

• Be one of: no-referrer-when-downgrade, origin, origin-when-cross-origin, strict-origin, strict-origin-when-cross-origin
• Not be one of: no-referrer, same-origin

If none of the above methods work for you, you can add the header X-Requested-With and specify the name of your application in the value. This method can be useful, for example, for HTML pages that you open with a URL like file:///

Library specifics

Leaflet

For Leaflet versions released after May 2026, no additional steps are required (referrer policy is automatically set to strict-origin-when-cross-origin since PR #9897 was merged).

If you are using an older version of Leaflet, you should specify something like:

const attribution = '&copy; <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors'

new L.TileLayer(osmUrl, {
  ...
  referrerPolicy: 'strict-origin-when-cross-origin',
  attribution: attribution
})

https://leafletjs.com/reference.html#tilelayer-referrerpolicy

If you are using Leaflet older than 1.8.0, you will need to update it first. Or change the Referrer-Policy for your website globally.

If you open a page at file://, add the X-Requested-With header, for example using plugins: https://github.com/jaq316/leaflet-header

django-leaflet

There is a currently open Pull Request at https://github.com/makinacorpus/django-leaflet/pull/405 to automatically set the referrer policy to strict-origin when using the default layer.

OpenLayers

Make sure you are using the latest version of the library.

If your users open your page at file:/// you should configure the X-Requested-With header to be sent.

Example:

const s = new ol.source.OSM();
s.setTileLoadFunction(function tileLoader(tile, src) {
    const client = new XMLHttpRequest();

    client.open("GET", src);
    client.responseType = "arraybuffer";
    client.setRequestHeader("Accept", "image/*");
    client.setRequestHeader("Content-Type", "text/plain");
    client.setRequestHeader("X-Requested-With", "⚠️YOUR APP NAME⚠️");

    client.onload = function () {
        const blob = new Blob([this.response], {
            type: "image/png",
        });
        const imageUrl = window.URL.createObjectURL(blob);
        // since we are not calling revokeObjectURL anywhere, 
        // this leads to a memory leak.
        // But it's unlikely that this is critical for you
        tile.getImage().src = imageUrl;
    };

    client.send();
});
...

MapLibre GL JS

If your users open your page at file:/// you should configure the X-Requested-With header to be sent.

Example:

const map = new maplibregl.Map({
   ...
   attributionControl: true,
});
map.setTransformRequest((url, resourceType) => {
  if (resourceType === 'Tile' && url.startsWith('https://tile.openstreetmap.org/')) {
    return {
      url: url,
      headers: { 'X-Requested-With': "⚠️YOUR MAPLIBRE APP NAME⚠️" },
    }
  }
});