webzod
account

Set a valid Referrer-Policy on nginx

headers.referrer.invalid · effort: minutes

Why it matters

The Referrer-Policy value is not one browsers recognise, so they ignore it and use their own default. Use a standard value such as strict-origin-when-cross-origin.

The fix

  1. Hide the application's copy and set one valid value, run sudo nginx -t and reload. Use fastcgi_hide_header for PHP-FPM.
nginx 
proxy_hide_header Referrer-Policy;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.