# Referrer (HTTP Referer): how browsers report the linking page

Source: https://analyzine.com/explained/referrer/  
Author: Hasan Misbah  
Updated: 2026-11-02

Quick answer

A referrer is the address of the web page that sent a visitor to your page. Browsers pass it in the HTTP Referer header (spelt with one "r", a mistake from the 1990s that stuck), and analytics tools read it to tell whether a visit came from search, social, another website or nowhere known.

## How the referrer works

When you click a link, your browser asks the next site for a page. Along with that request it sends a few lines of background information called headers. One of them, Referer, says which page the click happened on.

Say someone is reading a cycling blog and clicks a link to a WooCommerce shop that sells bike lights. The shop's server receives a request for the product page, and the Referer header says the visitor came from the cycling blog. The shop's analytics reads that value, sees a domain that isn't a search engine or social network, and files the visit as [referral traffic](https://analyzine.com/explained/referral-traffic/).

The same information is available to scripts on the page through a property called document.referrer, which is how many JavaScript-based analytics trackers pick it up. Browsers also send the header when loading images, scripts and fonts from other sites, which matters for privacy, as you'll see below.

## Referer vs referrer: the famous misspelling

The header is spelt "Referer", with a single "r" in the middle. The correct English word is "referrer". The misspelling was written into the early HTTP specifications in the mid-1990s, and by the time anyone noticed, browsers and servers all over the web depended on it. Fixing the spelling would have broken them, so it stayed.

Newer things got the spelling right, which is why you'll see both:

- **Referer** (one r): the HTTP header itself, and server log fields named after it
- **Referrer** (two rs): the Referrer-Policy header, the document.referrer property, the rel="noreferrer" link attribute and the word in normal writing

Both are correct in their own place. If you're configuring a server or reading a log, use the header's spelling. Everywhere else, use the dictionary one.

## Referrer policies: how much gets sent

Early browsers sent the full address of the previous page almost every time, including the path and any query string. That leaked a lot. Today, a referrer policy decides how much of the address goes along with each request.

There are three possible levels of detail:

- **Full URL:** https://cyclingblog.example/reviews/best-commuter-lights/
- **Origin only:** https://cyclingblog.example/
- **Nothing at all**

The main policies are:

| Policy | What it sends |
| --- | --- |
| no-referrer | Nothing, ever |
| origin | Only the origin, on every request |
| same-origin | Full URL within your own site, nothing to other sites |
| strict-origin | Origin only, and nothing when going from HTTPS to HTTP |
| strict-origin-when-cross-origin | Full URL within your own site, origin only to other sites, nothing from HTTPS to HTTP |
| no-referrer-when-downgrade | Full URL everywhere except HTTPS to HTTP (the old default) |
| unsafe-url | Full URL everywhere, even to insecure sites |

Since around 2020 and 2021, the major browsers have used **strict-origin-when-cross-origin** as the default when a site doesn't choose a policy. In plain terms: when a visitor clicks from someone else's site to yours, you usually learn which site they came from, but not which page. Some privacy-focused browsers and settings trim it further, whatever the linking site asks for.

A site can set its policy in three ways: a Referrer-Policy header sent by the server, a meta tag in the page's head, or a policy attribute on individual links. Adding rel="noreferrer" to a single link removes it for that link alone.

## Why referrers go missing

Visits that arrive with no source page attached end up as [direct traffic](https://analyzine.com/explained/direct-traffic/). The usual reasons:

1. **There was no page.** The visitor typed the address, used a bookmark, scanned a QR code, or clicked inside an email app, a chat app or a PDF.
2. **HTTPS to HTTP.** Under the default policy, a secure page linking to an insecure one sends nothing.
3. **The linking site chose not to send it.** A no-referrer policy or a noreferrer attribute on the link.
4. **Privacy tools.** Some browsers, extensions and VPN-style services strip or shorten it.
5. **Redirects.** Some redirect chains, link shorteners and script-based redirects lose the original value.

Some arrive deliberately thin. Google and most other large search engines send only their origin, so a visit from Google shows "google.com" and nothing about the search phrase. That's why search phrases live in Google Search Console, not in your analytics.

## What it's used for

- **Analytics.** Sorting visits into organic search, social, referral and direct. It's one of the two main clues for [traffic source](https://analyzine.com/explained/traffic-source/) reports, the other being campaign tags.
- **Server logs.** Most web servers record the header for every request, which helps with debugging broken links.
- **Hotlink protection.** Stopping other sites embedding your images directly, by refusing requests whose Referer isn't your own domain.
- **Basic security checks.** Some sites check that a form submission came from one of their own pages, though this should never be the only safeguard.

## Is it reliable?

For counting visits, mostly yes, with gaps. For security decisions, no.

The header is just text the browser chooses to send. Any script, bot or command-line tool can set it to whatever it likes, which is exactly how referral spam works: a bot visits your site and claims it came from a domain the spammer wants you to look up. So treat it as a helpful hint about where real people came from, filter out obvious junk, and never use it alone to decide who's allowed to do something.

Because so many are trimmed or missing, the most dependable way to know where your own links were clicked is to add [UTM parameters](https://analyzine.com/explained/utm-parameters/). They live in the landing page address, so no policy or app can strip them on the way. Analyzine reads both the referrer and UTM tags to sort visits into organic search, direct, social and referral, and keeps that data in your own WordPress database.

## The privacy angle

The defaults were tightened for good reason. A full referring URL can reveal far more than "came from a blog". It might include a search phrase, an order number, a password-reset token, a member-only page path or, on badly built sites, an email address in the query string. Those details would then be sent to every other site the page links to or loads a file from.

For your own WordPress site, three habits help:

- **Keep the browser default or go stricter.** strict-origin-when-cross-origin is a sensible baseline. You can send a Referrer-Policy header through your host's server settings or a security plugin if you want something tighter.
- **Keep personal data out of URLs.** Don't put names, email addresses or order details in query strings, on your own pages or in links you send.
- **Store less.** If your analytics records where visits came from, the domain and path are plenty. Query strings rarely add value and can carry personal data.

Next time you review your traffic report, open the list of referring domains, spot any you don't recognise, and check them carefully before you decide whether they're real.

## Frequently asked questions

### Why is the HTTP Referer header misspelled?

The misspelling made it into the early HTTP specifications in the 1990s. By the time it was noticed, browsers, servers and tools relied on the one-r spelling, so changing it would have broken them. Later additions such as the Referrer-Policy header use the correct spelling.

### Can the Referer header be spoofed?

Yes, easily. Any bot, script or command-line tool can send whatever value it wants. That's fine for rough analytics, but you shouldn't rely on it for security, and it's how referral spam gets into reports.

### Does the referrer include the full path?

Within your own site, usually yes. When the visitor comes from another site, the default policy in modern browsers sends only the origin, such as https://example.com/, with no path or query string. Some sites choose to send nothing at all.

### Is the HTTP referer reliable for analytics?

It's reliable enough to show which sites and search engines are sending people, but it's often trimmed or missing. Emails, apps, documents and privacy tools all remove it, which inflates direct traffic. Tagging your own links with UTM parameters fills most of the gap.

### How do I change the referrer policy on a WordPress site?

You can send a Referrer-Policy header from your server configuration or through a security or headers plugin, or add a meta tag to your theme's head. For most sites the browser default, strict-origin-when-cross-origin, is already a sensible choice.