Referrer-Policy header is absent from the fetched content response
The fetched final content response did not include a non-empty Referrer-Policy header.
Why it matters
Referrer-Policy is a response-header setting that controls browser referrer handling. Its absence on an observed response is a configuration signal to review without establishing what any browser sent for a particular navigation or resource request.
How ShipReady detects it
What it inspects
ShipReady reads normalized headers from a successfully fetched, readable, same-site content-serving response.
What triggers a finding
The rule triggers when that response has no Referrer-Policy header or its value is empty.
What the evidence shows
ShipReady did not receive a non-empty Referrer-Policy header on the fetched content response.
Limits of this check
ShipReady checks the fetched response rather than redirect hops or every route. It does not execute a browser request, observe referrer values, determine browser defaults, or establish disclosure of any particular URL data.
How to fix it
Select and send an intentional policy
Choose a Referrer-Policy value that matches the application's navigation and integration needs, then configure the application, proxy, or CDN to send it on relevant content responses.
Review sensitive URL data separately
Avoid placing sensitive values in URLs where possible and test the chosen policy with the application flows that rely on external navigation or resources.
How to verify the change
Inspect deployed response headers
Request representative deployed content URLs and inspect their final response headers.
Expected: The intended responses include the chosen non-empty Referrer-Policy header.