Ping-From
When a browser performs hyperlink auditing, the Ping-From request header identifies the URL of the page where the link was clicked.
Usage
The Ping-From header is part of the HTML Standard's hyperlink
auditing feature. When a user clicks a link with the ping
attribute, the browser sends POST requests to the URLs listed in
the ping attribute. These requests include Ping-From to specify
the source page and Ping-To to specify the
destination URL.
The ping attribute exists to let servers track link activation without relying on redirects or JavaScript event handlers. The browser handles the entire process. The hyperlink audit requests run in the background, separate from the main navigation. The user moves directly to the linked page while the auditing requests complete asynchronously.
The Ping-From header contains the full URL of the document where the hyperlink was activated. This allows tracking servers to record the origin of the click and correlate the click with the destination in Ping-To.
Hyperlink auditing is supported by Chromium-based browsers and Safari. Firefox includes the capability but ships it disabled by default. Different browsers implement varying privacy controls around the ping attribute. Some block cross-origin ping requests by default or require secure contexts.
Per the HTML Standard, the Ping-From header is included for same-origin pings and for cross-origin pings where the source page is not served over HTTPS. Cross-origin pings from HTTPS pages omit Ping-From to prevent the browsing context URL from leaking across origins.
Values
Source URL
The value is the full URL of the page containing the clicked hyperlink. The URL includes the scheme, host, path, and any query string or fragment identifier present at the time of activation.
Example
A user clicks a link on an article page with a
ping="https://analytics.example.re/track" attribute. The browser
sends the navigation request to the linked destination and a
separate POST request to the analytics endpoint.
POST /track HTTP/1.1
Host: analytics.example.re
Ping-From: https://news.example.re/article/123
Ping-To: https://external.example.re/resource
Content-Type: text/ping
The referrer substitute with referrer rules
Hyperlink audit requests suppress the ordinary Referer header, and Ping-From exists to carry the same information under the auditing protocol's own rules. The value names the page containing the clicked link, and the header follows the suppression logic referrers use: present when the page and the ping endpoint share an origin, or when the linking page is plain HTTP, and omitted where an HTTPS page pings a different origin.
Ping-To has no such condition and arrives on every audit, so an endpoint receiving pings from HTTPS pages cross-origin sees the click destination while losing the click source, exactly as a downgraded referrer policy hides the referring page.
The audit request itself is fixed in shape: a
POST carrying text/ping and the literal
body PING, cookies included, response discarded.
Endpoint code needs nothing beyond logging, and
answering with redirects or content wastes the
bytes, since the browser is required to ignore the
body and permitted to drop the connection once a
response begins.
