A referrer is the address of the web page that led a browser to make a request: the page holding the link that was clicked, or the page that loaded an image, script or advertising tag. Browsers pass it to the receiving server in an HTTP request header spelled Referer, a misspelling preserved in the standard for three decades, and expose it to page scripts as document.referrer. It exists so that a server can learn where a request came from. Almost every traffic-source report in web analytics, from "referral" to "organic search" to "direct", is built on reading it or noticing that it is missing.

The definition currently in force sits in RFC 9110, the Internet Engineering Task Force (IETF) specification of HTTP semantics published in June 2022. It describes the field as a way for the user agent "to specify a URI reference for the resource from which the target URI was obtained (i.e., the 'referrer', though the field name is misspelled)". It lists the intended uses as "simple analytics, logging, optimized caching, etc." and warns of the privacy risk.

How the referrer travels

A user on https://news.example/story?id=42 clicks a link to https://shop.example/. The browser applies a referrer policy, adds a line such as Referer: https://news.example/ to the request, and the shop's server records it in its access log. When the page loads, analytics tags read the same value through document.referrer; in Google Analytics 4 (GA4) it travels as the page_referrer parameter.

What arrives depends on the policy. The Fetch standard of the Web Hypertext Application Technology Working Group (WHATWG) and the World Wide Web Consortium (W3C) Referrer Policy specification define eight values. The main ones are:

  • strict-origin-when-cross-origin: the full address for links within the same site, only the origin (scheme and host, such as https://news.example/) for links to other sites, and nothing at all when moving from HTTPS to plain HTTP. This has been the default in major browsers since 2020 and 2021.
  • no-referrer-when-downgrade: the full address, including path and query string, to every secure destination. This was the old default.
  • no-referrer: nothing at all.
  • unsafe-url: the full address to any destination.

Site owners set a policy through a Referrer-Policy response header, a <meta name="referrer"> tag, a referrerpolicy attribute or the rel="noreferrer" link attribute. RFC 9110 adds fixed rules: the # fragment and any username:password component are never sent, and a typed or bookmarked address gets no referrer, or about:blank.

Analytics software turns the result into a channel. Absent campaign tags, a referrer from a known search engine such as google.com is classed as organic search, one from facebook.com or linkedin.com as social, one from an AI assistant such as chatgpt.com, since May 13, 2026 in GA4, as AI Assistant traffic, and any other external site as a referral. A visit with no referrer and no campaign parameters becomes direct, shown in GA4 as "(direct) / (none)". Urchin Tracking Module (UTM) parameters and click identifiers such as Google's gclid override the referrer when present, carrying source information the header cannot be relied upon to deliver. GA4 also lets each property list unwanted referrals, so payment or login services that bounce users back do not take credit for the session.

In advertising transactions

When an ad tag on a publisher page calls an ad server or supply-side platform (SSP), the browser attaches the page's address as the referrer of that call. The SSP then describes the impression to bidders in an OpenRTB bid request. The OpenRTB 2.6 site object, maintained by IAB Tech Lab, holds two related fields: page, the "URL of the page where the impression will be shown", and ref, the "Referrer URL that caused navigation to the current page". Buyers use them for contextual targeting, brand safety and fraud screening; Prebid.js, the open-source header bidding wrapper, passes similar data to bidders in a refererInfo object.

Google's AdSense for Search (AFS) takes the idea further: publishers that buy traffic and land it on "related search" pages must declare the upstream ad text in a field named referrerAdCreative, and from November 1, 2025, omitting it became a policy violation.

Origin and evolution

The header is older than most of the web's commercial infrastructure. It was documented in RFC 1945, the informational description of HTTP/1.0 published in May 1996 by Tim Berners-Lee, Roy Fielding and Henrik Frystyk, and carried into HTTP/1.1 in RFC 2068 in 1997 and RFC 2616 in 1999. The misspelling is generally attributed to Phillip Hallam-Baker, who proposed the field, and it was noticed only after implementations had shipped. Every later revision, including RFC 7231 in 2014, kept it and added "[sic]"; newer specifications spell it correctly, hence Referrer-Policy and document.referrer.

For 15 years the referrer was generous: search engines put the query in the results page address, so the header handed destination sites the exact search terms. That changed on October 18, 2011, when Google began encrypting searches for signed-in users and stopped passing queries to destination sites, creating the "(not provided)" keyword line in Google Analytics. By September 2013 the change covered all Google searches. Paid search advertisers kept receiving query data through Google's ad reports, a distinction that drew criticism at the time.

Browsers then turned to the path and query string. The W3C Referrer Policy specification, edited by Jochen Eisinger and Emily Stark of Google, reached Candidate Recommendation in January 2017. Defaults followed. Chrome 85, shipped in August 2020, switched from no-referrer-when-downgrade to strict-origin-when-cross-origin, a change Google's Chrome developer blog said would leave server-side analytics relying on full addresses "impacted by reduced granularity". The Fetch standard followed in November 2020 and Firefox 87 in March 2021, according to Mozilla's release notes.

Apple moved earlier and further. Intelligent Tracking Prevention (ITP) 2.3, announced on September 23, 2019, cut document.referrer to the registrable domain when a known tracker sent users onward with decorated links. A WebKit update in December 2019 extended referrer trimming to all cross-site requests regardless of classification. Google's web.dev guidance calls Safari's behaviour "similar to strict-origin-when-cross-origin, with some specificities".

Why it matters for marketing

The referrer is the cheapest attribution signal on the web. It needs no tagging and no cooperation from the sending platform, which makes it the default way to learn which outside sites send audiences. Cloudflare's crawl-to-referral ratio, for example, divides AI crawler requests by requests whose Referer header names the same AI platform. Microsoft Clarity's scrape-to-referral card, added on August 13, 2026, uses the same arithmetic.

It is also the signal most easily lost. When Google's AI Mode launched in the US in May 2025, its links carried noreferrer attributes, and clicks showed up as direct or unknown until Google called it a bug on May 23, 2025. The broader AI referral traffic category depends on assistants either preserving referrers or adding UTM tags. OpenAI added UTM parameters to ChatGPT's "More" links in June 2025. Google's Gemini dropped UTM tags from cited links after three weeks, leaving the referrer to carry the attribution alone.

Limitations and disputes

The first limitation is loss. Native apps, email clients, messaging apps and PDF documents generally send no referrer, so their visits land in direct traffic. Redirect chains can replace the original referrer with the last hop. Similarweb's panel study of US desktop users found that among visits influenced by an AI recommendation, only 8.8% arrived as a direct AI referral.

The second is falsification. The client supplies the header, and scripts and bots can send any value. That is the basis of referrer spam, in which fake sessions carrying a promotional domain pollute analytics reports. In advertising, a forged referrer or site.ref value can support domain spoofing, so verification vendors treat it as one signal among several.

The third is a genuine conflict of interest between privacy and measurement. RFC 9110 itself says a user agent "SHOULD NOT" send the referrer from a secure page to a different origin unless the referring page "explicitly allows" it. Today's defaults are a compromise: enough to identify the sending site, not the article or search query. Publishers and advertisers that used full referrer paths lost that granularity in 2020 and 2021. Privacy advocates say the origin still reveals too much; some measurement vendors argue the trimming pushed the industry towards link decoration and click identifiers that are more invasive, not less.

Not the same as

  • Referral: the analytics channel, or the visit, that results from an external referrer. The referrer is the data; the referral is the classification built on it.
  • Referrer policy: the rule that decides how much of the referrer a browser sends. It controls the referrer but is a separate header and setting.
  • Origin header: a separate HTTP header carrying only scheme, host and port, used mainly for security checks on cross-origin requests. It is not intended for analytics.
  • Install referrer: a string the Google Play Store passes to an Android app at first launch, describing the campaign that drove the install. Despite the name it is an app-store API, now extended to Google Play Games on PC, not the browser header.

Recent developments

Search links are the newest pressure point. Google confirmed in August 2026 that organic and paid results now route through google.com/goto redirects; Brodie Clark documented a 302 response carrying visitors to the destination, and the change forced Sistrix into a costlier tracking workaround. Google has not documented what referrer destination sites receive after the hop, and as of November 2026 no header-level analysis had been published. AI assistants, agentic browsers and in-app browsers keep adding paths on which the referrer is trimmed or dropped, and no standard requires any of them to send one.

Timeline

  • May 1996: RFC 1945 documents the Referer header, misspelling included, for HTTP/1.0.
  • January 1997: RFC 2068 carries the header into HTTP/1.1.
  • June 1999: RFC 2616 revises HTTP/1.1, keeping the field unchanged.
  • October 18, 2011: Google starts encrypting signed-in searches and withholding queries from referrers, producing "(not provided)".
  • September 2013: Google extends encrypted search to all users.
  • June 2014: RFC 7231 marks the field name "[sic]".
  • January 2017: W3C Referrer Policy reaches Candidate Recommendation.
  • September 23, 2019: WebKit announces ITP 2.3, trimming document.referrer after decorated tracker navigations.
  • December 2019: WebKit extends referrer trimming to all cross-site requests.
  • August 2020: Chrome 85 makes strict-origin-when-cross-origin the default.
  • November 2020: The Fetch standard adopts the same default.
  • March 2021: Firefox 87 switches to strict-origin-when-cross-origin.
  • June 2022: RFC 9110 replaces RFC 7231 as the definition of HTTP semantics.
  • May 2025: Google's AI Mode links strip referrers; Google confirms a bug on May 23.
  • June 2025: ChatGPT adds UTM parameters to "More" links.
  • November 1, 2025: AdSense for Search enforces referrerAdCreative requirements.
  • May 13, 2026: GA4 adds an AI Assistant default channel based on referrer matching.
  • August 13, 2026: Microsoft Clarity adds its AI scrape-to-referral card.
  • August 26, 2026: Google confirms the rollout of google.com/goto redirects in search results.

Summary

Who: Browsers (Chrome, Safari, Firefox, Edge) generate referrers under rules set by the IETF, WHATWG and W3C; web servers, analytics tools such as GA4, ad servers, SSPs and bidders read them; site owners control them through referrer policies.

What: The address of the page that led to a request, sent in the misspelled HTTP Referer header and exposed as document.referrer, used to classify traffic sources and describe ad impressions.

When: Documented in RFC 1945 in May 1996, stripped of search queries by Google from October 2011, and trimmed to the origin for cross-site requests by default in Chrome 85 (August 2020) and Firefox 87 (March 2021).

Where: In every HTTP request a browser makes for a page, image, script or ad call, in server logs and analytics reports, and in the OpenRTB site.ref field of bid requests.

Why: It is the web's built-in, tag-free signal of where visitors come from. Its gradual trimming for privacy, frequent loss in apps and redirects, and ease of forgery make it both the foundation of traffic attribution and one of its weakest points.