What is an HTTP referrer?

By Nik Andreev, Founder & SEO specialist · Last reviewed · Editorial policy

The HTTP referrer is the address of the page a request came from, sent by the browser in the Referer request header. The header name is a historic misspelling of "referrer". What it contains is set by the page's Referrer-Policy: by default, other sites get only your origin, and HTTPS-to-HTTP requests get nothing.

At a glance

Header name
Referer (a misspelling kept for compatibility)
Can contain
Origin, path and query string, depending on policy
Never contains
URL fragments (#section) or username:password
Controlled by
Referrer-Policy header, meta tag or link attributes
Default policy
strict-origin-when-cross-origin
Default cross-site value
Origin only over HTTPS, nothing when HTTPS goes to HTTP

How it works

  • The browser sets it: when someone clicks a link or a page loads an image or script, the browser can send the current page’s address in Referer.
  • The policy trims it: Referrer-Policy decides how much is sent. Under the default, same-origin requests get the full URL, cross-origin HTTPS requests get only the origin, and HTTPS-to-HTTP requests get no header.
  • Links can opt out: rel="noreferrer" or referrerpolicy="no-referrer" on a link stops the header for that click.
Referer: https://chatgpt.com/
Referrer-Policy: strict-origin-when-cross-origin

Where referrers matter

AI referral traffic Visitors from AI assistants are identified mainly by their referrer hostname. Server log The Combined Log Format records the Referer header for every request. User agent The other self-reported request header. Like the referrer, it can be faked.

Quick answers

Why is the referrer empty for some visits?

The source may use a no-referrer policy, the click may come from an app with no page to report, or the request went from HTTPS to HTTP. Analytics then counts the visit as Direct.

Is it spelled referer or referrer?

Both. The HTTP header is Referer, a misspelling from the original spec. The Referrer-Policy header and the JavaScript document.referrer property use the correct spelling.

Can the referrer be trusted?

Not as proof. Any client can set or omit the header, so treat it as a hint.

Sources