webzod
account

Set a valid Referrer-Policy

headers.referrer.invalid · effort: minutes

Why it matters

The Referrer-Policy value is not one browsers recognise, so they ignore it and use their own default. Use a standard value such as strict-origin-when-cross-origin.

The fix

  1. Replace the value with one of the standard policies; strict-origin-when-cross-origin suits most sites, no-referrer or same-origin are stricter.
  2. Check for typos and for a second copy from another layer, and keep one place that sets it.
http 
Referrer-Policy: strict-origin-when-cross-origin

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.