Referer Reality

Hacker News Top News

Summary

The article discusses the limitations of relying on the Referrer header for tracking traffic sources, noting that many modern apps do not send this header. It advocates for using custom query strings as a form of digital etiquette to ensure link attribution remains legible across different platforms.

No content available
Original Article
View Cached Full Text

Cached at: 05/13/26, 03:10 AM

# Referer reality Source: [https://www.robinsloan.com/lab/referer/](https://www.robinsloan.com/lab/referer/) May 10, 2026Chris Morgan is[tired of people tacking query strings](https://chrismorgan.info/no-query-strings)onto hisURLs —e\.g\.`www\.robinsloan\.com/lab/?like=this&and=this`—so he’s con­fig­ured his web­site to reject those requests outright, rather than suffer in silence\. Naturally, any­body is free to set up their server in any way they like … however, Chris writes this: > If I wanted to know \[where a vis­itor came from\] I’d look at the Ref­erer header; and if it isn’t there, it’s prob­ably for a good reason\. which isn’t really true anymore\. For most web­sites, themajority —not just the plurality, but themajority —of vis­itors arrive by fol­lowing a link inside an email or an app \(e\.g\. Instagram, Mes­sages on iOS, the Sub­stack app\), nei­ther of which set a`Ref­erer`header; so, all of those vis­itors are lumped into a vast slab called*Direct*or*Unknown*\. This broken mech­a­nism pro­vides the impetus for the custom query string I append to all out­going links,`utm\_source=Robin\_Sloan\_sent\_me`: under­standing that many/most clicks on links I share will come from my email newsletter, I want the source to be legible, par­tic­u­larly in con­texts such as, e\.g\., Shopify\. This isn’t an argu­ment that Chris Morgan should do any­thingdifferent —opinionated oper­ator deci­sions make the internet goround —but rather an oppor­tu­nity for clar­i­fi­ca­tion about the cur­rent state of play\. I don’t col­lect or review ana­lytics of any kind on my web­sites, so I’m not a con­sumer of this kind of referral info\. Even so, my custom query string is, in my calculation, an expres­sion of dig­ital etiquette: rather than dump a load of anony­mous traffic on your doorstep, I reveal who’s linking, so a web­site or online shop oper­ator can trace it back and get in touch, if wanted or needed\. \(Memorably, this was useful when the[Abrams Planetarium](https://abramsplanetarium.natsci.msu.edu/sky-calendar/index.aspx?utm_source=Robin_Sloan_sent_me)received a wave of new sub­scrip­tions and weren’t sure if they were legitimate; a brief email cor­re­spon­dence assured them that yes, these people were real … they were nerdy … they wanted the Sky Calendar\!\) Note that a handful of sites do choke on unex­pected query strings, including YouTube \(\!\), so I main­tain a list of exceptions, to which`chrismorgan\.info`is now added\. [To the blog home page](https://www.robinsloan.com/lab/)

Similar Articles

Zen Reports

Product Hunt

Zen Reports is a product that allows website owners to track and analyze traffic originating from ChatGPT.

RealityTest: How People Probe AI Identity and Whether Models Disclose It

arXiv cs.CL

This paper introduces RealityTest, a multimodal, multilingual benchmark to evaluate whether AI systems disclose their identity when probed by users, based on real human queries collected across 49 countries. It finds that only 31% of people ask directly about identity, and that human questions are more diverse than synthetic ones, revealing that phrasing and context matter more for disclosure than the specific model.

Browser identification through header order

Lobsters Hottest

This article discusses passive browser identification techniques using HTTP header order, IP options, user-agent strings, and random number generator patterns.