diff --git a/lib/web/fetch/util.js b/lib/web/fetch/util.js
index eb0ece355b7..20cbb5c58f6 100644
--- a/lib/web/fetch/util.js
+++ b/lib/web/fetch/util.js
@@ -227,14 +227,19 @@ function TAOCheck () {
   return 'success'
 }
 
+// https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request
 function appendFetchMetadata (httpRequest) {
+  //  1. If r’s url is not a potentially trustworthy URL, return.
+  if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+    return
+  }
+
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-dest-header
   //  TODO
 
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header
 
   //  1. Assert: r’s url is a potentially trustworthy URL.
-  //  TODO
 
   //  2. Let header be a Structured Header whose value is a token.
   let header = null
diff --git a/test/web-platform-tests/expectation.json b/test/web-platform-tests/expectation.json
index 34e2cb82957..a3171c7bcdc 100644
--- a/test/web-platform-tests/expectation.json
+++ b/test/web-platform-tests/expectation.json
@@ -18298,18 +18298,15 @@
             },
             {
               "name": "sec-fetch-mode - Not sent to non-trustworthy same-origin destination, no init",
-              "success": false,
-              "message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
+              "success": true
             },
             {
               "name": "sec-fetch-mode - Not sent to non-trustworthy same-site destination, no init",
-              "success": false,
-              "message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
+              "success": true
             },
             {
               "name": "sec-fetch-mode - Not sent to non-trustworthy cross-site destination, no init",
-              "success": false,
-              "message": "assert_not_own_property: unexpected property \"sec-fetch-mode\" is found on object"
+              "success": true
             },
             {
               "name": "sec-fetch-dest - Not sent to non-trustworthy same-origin destination, no init",