Add check HTTP Referrer policy

Problem/Motivation

Many Drupal sites do not explicitly configure an HTTP Referrer-Policy header, which means the browser’s default behavior decides how much referrer information (full URL, path, query parameters) is sent to other origins. This can lead to unintentional leakage of sensitive data in URLs (tokens, internal paths, identifiers) to third-party sites, reducing user privacy and potentially aiding attackers in mapping or exploiting the application. A consistent, explicit Referrer-Policy is needed to align the site with modern security and privacy best practices.

Steps to reproduce

Proposed resolution

Add a new Security FitCheck plugin ReferrerPolicyHeader that inspects outgoing responses for the Referrer-Policy header and validates its value against a recommended, configurable set of secure policies (for example strict-origin-when-cross-origin, same-origin, or no-referrer). The plugin should:

• Detect when the header is missing, misspelled, or set to weak/legacy values (such as no-referrer-when-downgrade or overly permissive variants) and mark this as a finding with an appropriate severity.
• Include in the FitResult a summary of the current state (detected value or “not set”), an explanation of why it is problematic, and concrete remediation guidance, such as recommended header values and example configuration for Drupal (e.g. via security modules or response event subscribers) and/or for common web servers.

Remaining tasks

User interface changes

API changes

Data model changes