Referrer-Policy header lacks a scanner-recognised policy value
The fetched content response included Referrer-Policy, but none of its comma-separated values matched ShipReady's supported policy list.
Why it matters
A response header can be present while still requiring configuration review. This finding identifies an observed value outside ShipReady's recognised Referrer-Policy list; it does not measure a browser's handling of a real request.
How ShipReady detects it
What it inspects
ShipReady reads the normalized Referrer-Policy header from a successfully fetched, readable, same-site content-serving response.
What triggers a finding
For a non-empty header, ShipReady splits comma-separated values, trims and lowercases them, and triggers when none matches its supported Referrer-Policy set. A list with at least one supported value does not trigger.
What the evidence shows
The fetched response supplied Referrer-Policy values that did not match ShipReady's supported list after its bounded parsing.
Limits of this check
ShipReady does not execute browser navigation, observe referrer data, test every route, or provide a complete browser or standards-conformance analysis beyond the supported values it checks.
How to fix it
Set a supported policy value
Review the deployed header configuration and set an intentional Referrer-Policy value supported by the browsers and flows the application serves.
Test relevant navigation flows
Verify external navigation and embedded-resource flows after changing the policy. ShipReady does not perform those browser-flow tests.
How to verify the change
Inspect the final deployed header
Request a representative deployed content URL and inspect its final Referrer-Policy header.
Expected: The header includes at least one policy value intended for the deployment and recognised by ShipReady's parser.