Glossary Term

Referrer Header

glossary referrer header featured

The referrer header is an HTTP request header that tells a web server which page the visitor came from. Browsers attach it automatically when someone clicks a link, loads an image, or submits a form that points to another page. Analytics tools read it to classify referral traffic, which is why a missing referrer usually ends up filed as direct traffic.

Referer vs Referrer

The header is spelled Referer, with one “r” in the middle. That is a misspelling, and it is permanent.

Phillip Hallam-Baker introduced the field in the early 1990s and the typo was standardized in RFC 1945 in May 1996. By the time anyone noticed, too many servers depended on the exact string to change it. Every specification since has kept the error.

Later additions use the correct spelling, which is why both appear in the same codebase:

  • Referer (one r): the HTTP request header itself.
  • Referrer-Policy (two r): the response header that controls how much of the referrer is sent.
  • document.referrer (two r): the JavaScript property that reads the value in the browser.
  • referrerPolicy (two r): the option in fetch() and on DOM elements.

What the Referrer Header Looks Like

The header carries a single URL, sent by the browser with the request:

GET /glossary/referrer-header HTTP/1.1
Host: linkutm.com
Referer: https://www.google.com/

Client-side code reads the same value through document.referrer, which returns an empty string when nothing was sent:

console.log(document.referrer);
// "https://www.google.com/"
// "" when the browser sent no referrer

The value is set by the browser, not by the site being visited. It can be spoofed by any script or command line client, so it is evidence of origin, not proof of it.

How Much of the URL Gets Sent

Modern browsers no longer send the full URL across sites. Chrome 85 made strict-origin-when-cross-origin the default policy in August 2020, and Firefox 87 followed in March 2021.

Under that default:

  • Same-origin requests receive the full URL, including path and query string.
  • Cross-origin requests receive only the origin: https://www.google.com/ instead of the full search URL.
  • Requests that downgrade from HTTPS to HTTP receive nothing at all.

This is why search engine referrers no longer reveal keywords, and why a referring page’s exact path is often unavailable.

Controlling What Gets Sent

The Referrer-Policy response header overrides the browser default. Eight values are defined, ranging from no-referrer (send nothing, ever) to unsafe-url (always send the full URL, which leaks paths and query strings). The full list and what each one sends is covered in referrer policy.

Set the policy site-wide as a response header, per page with a meta tag, or per link:

Referrer-Policy: strict-origin-when-cross-origin

<meta name="referrer" content="origin-when-cross-origin">
<a href="https://partner.example.com" rel="noreferrer">Partner site</a>

Why the Referrer Header Matters

Attribution depends on it. GA4 reads the referrer to decide whether a session belongs in Referral, Organic Search, or Organic Social, and it applies the referral exclusion list to the same value. Without a referrer and without campaign tags, the session becomes (direct) / (none).

Beyond analytics, the header drives hotlink protection, affiliate validation, and legacy cross-site request checks. It also powers referring-domain reports in most link tools, which is useful when the referrer survives but the UTM parameters were never added.

Use it for measurement and convenience. Do not use it for security. CSRF protection needs tokens or SameSite cookies, because a referrer check can be defeated by anyone sending their own header.

Why the Referrer Header Is Missing

An empty document.referrer is common and rarely a bug. Usual causes:

  • No previous page. Typed URLs, bookmarks, and QR code scans have no referrer to send.
  • HTTPS to HTTP downgrade. Every strict policy suppresses the header entirely.
  • rel="noreferrer on the link. Note that rel="noopener alone does not strip it. Only noreferrer does.
  • A restrictive policy set by the linking site, such as no-referrer on a whole domain.
  • Apps and in-app browsers. WhatsApp, Slack, Telegram, and native mobile apps frequently pass no referrer, which is the mechanism behind dark social.
  • Desktop email clients and PDFs. Links opened from Outlook or a document arrive with nothing attached.
  • Meta refresh and some redirect chains, which can drop the original referrer along the way.

The fix is not to recover the header. It is to stop depending on it. UTM parameters live in the URL itself, so they survive every case above except manual retyping.

Frequently Asked Questions

What is a referrer header?

A referrer header is an HTTP request header, spelled Referer, that identifies the page a visitor navigated from. The browser adds it automatically to link clicks, form submissions, and subresource requests. Servers and analytics platforms use it to attribute traffic to a source. Since 2020 most browsers trim it to the origin on cross-site requests.

What is the difference between referer and referrer?

Nothing in meaning. Referer is the misspelled HTTP header name fixed by RFC 1945 in 1996, and “referrer” is the correct English spelling used everywhere the name was not already locked in. Referrer-Policy and document.referrer both use the correct spelling because they were specified much later.

How do you check the referrer of a page?

Type document.referrer in the browser console on the destination page. For the raw header, open DevTools, go to the Network tab, select the document request, and look under Request Headers for Referer. Server access logs record the same field, and GA4 exposes it as the Page referrer dimension.

Why is document.referrer empty?

Because no referrer was sent. That happens with direct visits, bookmarks, HTTPS to HTTP downgrades, rel="noreferrer links, sites running a no-referrer policy, and most in-app browsers. An empty string is the specified return value in all of these cases, not an error.

Can the referrer header be trusted?

Not for anything that matters. The value is supplied by the client and any script or HTTP tool can forge it. Treat it as an analytics signal and use tokens or SameSite cookies for access and CSRF decisions.

Tag your campaign links so attribution holds even when the referrer does not, using the free UTM builder at linkutm.

Back to Glossary