Referring URL: How the Value Is Built, Trimmed and Reported

A referring URL is the web address of the page a visitor was on immediately before they landed on yours. Your server and analytics tool read it from the browser's Referer field, and privacy defaults now trim most of it to a bare domain.

Key Takeaways

• The field carrying that address is spelled Referer — a typo baked into the HTTP standard since 1996 and preserved in RFC 9110.
• Chrome switched its baseline to strict-origin-when-cross-origin in version 85 (stable, August 2020), so cross-site referrers now arrive as an origin only, with no path and no query string.
• There are 8 valid Referrer-Policy values, and the field has been available across all major browsers since January 2020.
• Roughly 50% of a site's visitors can be attributed to one upstream source in a clean referral report — but only when the referring URL survives the hop.
• Paid clicks are the biggest blind spot: Google Ads auto-tagging appends a gclid parameter, and the referring URL you see is a Google redirect, not the ad.

The definition, in one paragraph

A referring URL (or referrer URL) is the full web address of the previous page in a visitor's navigation path, transmitted by their browser to the destination server inside the HTTP request. It exists so the receiving site can tell where inbound traffic, external links and clicked link paths came from. It is a reporting signal, not an identity signal.

Every such address breaks into the same parts, and privacy rules cut it at different points:

Rule 1 — the value is generated by the browser, never by your site. You can influence other sites' behaviour only by asking them to change their setting, while you control only how much your own pages leak outward. The mechanics are documented in the MDN entry for the Referer request header.

Referring URL vs referrer vs Referer header vs referral source

4 terms describe the same journey at different layers. Mixing them up is how reporting arguments start.

Fact 2 — the protocol spells it with 1 r, not 2. The field is Referer; the settings header, the DOM property and the concept all use the correct double-r spelling. The current definition lives in RFC 9110, and the misspelling has survived every revision since. The client-side equivalent is documented under Document.referrer.

How the browser decides how much to send

6 steps sit between the click and the row in your report. Only step 4 is under the destination site's control.

Engineering guidance on the trade-offs is collected in Referrer best practices on web.dev, which notes that analytics services use these values to establish claims such as 50% of one site's visitors arriving from a single social network.

The 8 Referrer-Policy values, decoded

This field turns a full address into a domain, or into nothing at all.

Limit 3: just 1 of the 8 values hands over your full address, and its name is a warning. The complete reference sits in MDN's reference for the header, which records availability across browsers since January 2020; the normative rules are in the W3C Referrer Policy spec. A single link can opt out with rel="noreferrer".

What changed in Chrome 85, and why your referral report shrank

If your reports stopped showing inbound paths, this is why.

Trap 4 — the change was announced as low-impact, and it still broke dashboards. Chrome's own new default referrer setting announcement says user-visible breakage was expected to be limited based on the Chrome 84 experiment — true for users, painful for anyone whose reports keyed on the referring page path rather than the inbound source.

Where these values surface in analytics, and how far to trust it

Not 1 analytics platform shows you the raw header. They show a derived model of it.

The dimension definitions are listed in the reference for Analytics dimensions and metrics, and the grouping logic that turns an inbound source into a channel is documented in the guide to channel definitions. Turning that into decisions is the job of a measurement and data intelligence setup rather than a single report.

Why paid clicks almost never show the source you expect

Ad platforms route clicks through their own redirect infrastructure, so the value you receive describes the redirect, not the placement.

Rule 5 — never audit paid performance from referral data. The documentation for auto-tagging explains that the click identifier, not the referrer, links a session back to a campaign, and our breakdown of current Google Ads benchmarks shows how far off channel reporting drifts when the two are confused. For campaign structure questions, that belongs with paid growth strategy.

The 6 situations where the value simply is not there

Blank values are the default in 6 common places, more than most reports admit, and each one lands in direct traffic.

Fact 6 — a request that arrives with no referrer is indistinguishable from a bookmark. That is why a growing direct-traffic line is usually a tagging problem, not a brand-strength story. Canonical and redirect handling interacts with this, covered in the guidance on consolidating duplicate URLs. To reconstruct how a page looked at the time of a link, the techniques in our guide to checking Google's cache help.

Referrer authentication, and why it fails as a security control

Some systems still grant access based on this header. The web.dev guidance is blunt about the limits.

Limit 7: if a check breaks when the field is missing, the check is broken. web.dev's advice is to expect either no Referer at all or an origin-only value, then verify properly. Anything stricter belongs in your web development layer, not in a marketing report.

How to read referral data without fooling yourself

5 checks, in order, resolve almost every referral reporting dispute.

Trap 8 — comparing referral numbers across a defaults change is comparing two different metrics. Annotate the switch date, then compare tagged traffic instead. If link acquisition is the reason you care, pair this with our work on anchor text and link profiles, and browse the rest of the Web Tonic blog for the wider measurement series.

FAQ

What is a referring URL in simple terms?

It is the address of the page a user was on before they clicked through to yours. The user's browser sends it to your web server automatically, and analytics tools group those addresses into referral traffic.

What is the difference between a referring URL and the HTTP referrer?

The first is the value; the HTTP Referer field is the container that carries it. The field is spelled with one r because of a 1996 misspelling that RFC 9110 still preserves.

Why do so many inbound sources only show a domain?

Because Chrome and other browsers now baseline to strict-origin-when-cross-origin, which trims the path and query string on cross-site requests. Chrome made that switch in version 85.

Can this header be faked or blocked?

Yes to both. Any client can set no-referrer or send an arbitrary value, which is why such checks are unreliable as access control and should never be a lone defence.

Why does paid traffic show up as a strange source?

Ad clicks pass through platform redirects, so you receive the redirector's origin rather than the placement. Use the click identifier added by auto-tagging or your own campaign parameters instead.

Sources

_{MDN Web Docs — Referer header, Referrer-Policy reference, Document.referrer, rel=noreferrer · W3C Referrer Policy spec · RFC 9110 (HTTP Semantics) · web.dev Referrer best practices · Chrome Developers blog, new cross-site default · Google Analytics Help, dimensions and metrics and default channel definitions · Google Ads Help, auto-tagging · Google Search Central, consolidate duplicate URLs · Wikipedia, HTTP referer. All sources verified live 2026-08-06.}