Link Shim

A link shim is an intermediate redirect page that a platform inserts between a click and the destination website. Facebook’s link shim is the best known example: every outbound link on Facebook is rewritten to pass through l.facebook.com first, where the destination is checked against malicious-URL lists and the referrer is trimmed before the visitor is forwarded. The visitor sees a flash of a redirect, and the destination site sees a referrer that says Facebook sent the traffic without saying where on Facebook it came from.

Facebook introduced the link shim in a January 2012 security note titled “Link Shim: Protecting the People who Use Facebook from Malicious URLs”. Meta, LinkedIn, and Twitter all run equivalent systems.

How the Facebook Link Shim Works

Facebook rewrites the link before you ever click it. A post linking to a product page does not carry the product URL in its href. It carries this:

https://l.facebook.com/l.php?u=https%3A%2F%2Fexample.com%2Fsummer-sale&h=AT1nK9pQ...

Two parameters do the work:

• u holds the URL-encoded destination. This is the address the visitor actually wanted.
• h holds a signed hash. It proves Facebook generated this particular pairing of shim and destination, which stops the URL being reused as an open redirect pointing anywhere.

On click, Facebook resolves the hash, compares the destination against its internal blocklist plus partner feeds (Facebook named McAfee, Google, Web of Trust, and Websense in the original announcement), and either shows a warning interstitial or issues a redirect to the destination.

That round trip cost roughly a second on slow connections. Meta’s engineering team rewrote it in September 2012 to scan every link before the page is sent to the browser and to use the HTML meta referrer feature for referrer control, so most modern browsers skip the extra hop entirely. Browsers that lack support fall back to the older l.php path, which is why the shim domain still shows up in analytics.

Link Shim Domains in Analytics

Each surface uses its own shim host, and each arrives as a separate traffic source:

Domain	Where the click came from
l.facebook.com	Facebook desktop web
lm.facebook.com	Facebook mobile web and in-app browser
m.facebook.com	Facebook mobile site
l.messenger.com	Messenger
l.instagram.com	Instagram

One campaign posted to Facebook and Instagram can therefore split across five referral rows. None of them tells you which post, ad, or audience produced the click.

Why the Link Shim Strips the Referrer

Privacy is the stated reason. A full referrer header from Facebook would leak the exact page, group, or profile a person was browsing when they clicked. The shim replaces it with the bare shim domain, so the destination learns that Facebook sent the visit and nothing more. Facebook’s current implementation sets this through a referrer policy rather than a redirect wherever the browser supports it.

Three consequences follow for marketers:

1. Fragmented referral data. Facebook traffic scatters across several shim domains instead of consolidating under one source.
2. Direct traffic inflation. When the referrer is dropped entirely, usually from in-app browsers or an HTTPS to HTTP hop, the session is classified as direct. This is a major contributor to dark social.
3. No campaign detail. The fbclid parameter Facebook appends survives the redirect, but GA4 does not use fbclid for attribution. Only Google’s own click IDs are read that way.

How to Fix Link Shim Traffic in GA4

Tag the links. UTM parameters travel inside the u parameter, survive the shim redirect, and override the referrer in GA4’s attribution logic. This is the only reliable fix.

1. Add UTMs to every Facebook and Instagram destination URL. Use utm_source=facebook, and utm_medium=paid-social for ads or social for organic posts. GA4 assigns the Paid Social channel only when the medium matches its expected values. The Facebook UTM builder at linkutm produces correctly formatted links for both cases.
2. Tag organic posts and bio links too. Ads managers often cover paid placements and leave page posts, Stories, and profile links untagged, which is exactly where the shim domains come from.
3. Confirm the parameters land. Click the live post, then read the address bar after the redirect resolves. Both the UTM values and fbclid should be present.
4. Group the shim domains. Create a custom channel group in GA4 that maps l.facebook.com, lm.facebook.com, m.facebook.com, and l.instagram.com into one Facebook channel, so historical untagged traffic reads sensibly.
5. Never add shim domains to the referral exclusion list. Exclusion sends those sessions to direct rather than to Facebook, which makes the reporting worse.

Common Link Shim Misconceptions

• It is not link cloaking. Cloaking hides the destination from the user or from crawlers. The shim shows the destination in the warning interstitial and exists to protect the person clicking.
• It is not something you can opt out of. There is no setting, publisher header, or domain allowlist that removes the shim from your links.
• It passes no SEO value. Outbound links on Facebook are nofollow, and the shim adds a redirect on top. No link equity reaches the destination either way.
• It is not the cause of missing conversions. The shim forwards the full destination URL, including parameters. Lost data comes from untagged links, not from the redirect itself.

Frequently Asked Questions

What is a link shim?

A link shim is a redirect layer that a platform places between an outbound click and its destination. Facebook’s version checks the destination URL against malicious-link databases and removes identifying referrer detail before forwarding the visitor. The destination site receives the traffic with a shim domain such as l.facebook.com as the referrer.

What does l.php mean?

The l.php is the script on Facebook’s servers that handles outbound link redirects, where “l” stands for link. It takes the encoded destination in the u parameter and a signature in the h parameter. Facebook validates the signature, screens the destination, and then redirects.

Why does Facebook strip the referrer?

To stop external sites learning which page, group, or profile a person was viewing when they clicked. A full referrer would expose that context to every site a user visits from Facebook. The shim replaces it with a generic Facebook domain, which preserves the source signal but removes the detail.

Why does l.facebook.com show up in Google Analytics?

It appears when a visitor arrives from Facebook through an untagged link. GA4 falls back to the referrer, and the referrer is the shim domain rather than facebook.com. Adding UTM parameters to the link replaces that reading with your own source and medium values.

Is the link shim the same as a URL shortener?

No. A shortener is created by the person sharing the link, shortens the address, and reports clicks back to them. A link shim is applied by the platform, is invisible in the visible post text, and reports nothing to the publisher.

To see how much of your social traffic still arrives without campaign tags, review the source breakdown in linkutm’s link analytics.