Deutsch
Log data & formats

Referrer

The referrer is the address of the page from which a visitor reached the current page. The browser sends it in the HTTP header Referer, so the target server learns where the request came from. MDN names analytics, logging and caching optimization as typical uses.

How does it work?

When someone clicks a link, the browser can include the URL of the originating page in the header. Server logs and analytics tools then show which page referred the visit. If someone types an address or opens a bookmark, there is no originating page and therefore no referrer.

The header name is a historic misspelling. The specification spells it Referer with one r, while the concept and the Referrer-Policy header use two.

The header can contain origin, path and query string, but not the fragment or login data. Because URLs can hold sensitive information, RFC 9110 points to privacy risks and to policies that limit when the header is sent. The Referrer-Policy header controls how much is sent. It can be set as an HTTP header, with a meta tag or as an attribute on a single element. Without a setting, browsers use strict-origin-when-cross-origin according to MDN. Within the same origin the full URL is sent. To other origins only the origin is sent, and nothing is sent when the connection drops from HTTPS to HTTP.

Example

Code
Referer: https://www.example.com/guides/
HTML
<meta name="referrer" content="origin">

With origin the browser only sends https://www.example.com/. On a single link, rel="noreferrer" switches the header off.

Relevance for SEO

Analytics tools and the Combined Log Format use the referrer to assign visits to sources such as other websites or search engines. Stricter policies reduce how much detail arrives.

One log line in Combined Log Format, field by fieldSample line from an access log in Combined Log Format, split into IP address, identity and user, timestamp, request line, status code, bytes, referrer and user agent. The user agent claims to be Googlebot, but the IP address comes from a range reserved for documentation. Only a DNS or IP list check shows whether Google made the request.access.log, one line (wrapped)203.0.113.7 - - [08/Oct/2026:10:15:32 +0200] "GET /en/glossary/ HTTP/1.1" 200 5120 "-""Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"IP address203.0.113.7client, or the proxy in betweenIdentity, user- -“-” means not availableTimestamp[08/Oct/2026:10:15:32 +0200]when the request arrivedRequest"GET /en/glossary/ HTTP/1.1"method, path, protocolStatus200status code of the responseBytes5120size without headers, “-” if emptyReferrer"-"referring page, none hereUser agentline 2what the client says about itselfThe user agent claims to be Googlebot, but the IP is in a range reserved for documentation (RFC 5737).Only a DNS or IP list check shows whether Google made the request.
Apache and nginx write the same fields in the same order in the “combined” format. IP addresses can be personal data (CJEU, judgment of 19 October 2016, C-582/14). Not legal advice. Sources: Apache HTTP Server: Log Files (Combined Log Format); nginx: Module ngx_http_log_module (log_format combined); RFC 5737: IPv4 Address Blocks Reserved for Documentation; CJEU: Press release 112/16 on judgment C-582/14.

Common mistakes

  • Mixing the spellings. The request header is Referer, the policy header is Referrer-Policy. Server rules and log formats need the matching spelling.
  • Confusing noreferrer and no-referrer. On a link it is rel="noreferrer" without a hyphen. In the meta tag and the header it is no-referrer with a hyphen (MDN).
  • Setting a strict policy without considering the effects. With no-referrer the header is omitted entirely, and with same-origin it is missing for requests to other origins. Target pages and their analytics then see no source.
  • Treating a missing referrer as “direct”. Besides typed addresses and bookmarks, a policy can suppress the header too.

FAQ

What is an HTTP referrer? The header that names the previous page of a request.

Can the referrer be spoofed? Yes. Like the user agent, clients can set it freely, so it is not proof of origin.

Sources

  1. Referer header – MDN Web Docsdeveloper.mozilla.org
  2. Referrer-Policy header – MDN Web Docsdeveloper.mozilla.org
  3. RFC 9110, section 10.1.3 Referer – IETFrfc-editor.org
  4. Referrer – Seobility Wiki (secondary)seobility.net

Last updated: