Referer
Tracking where a request came from is a core need for analytics and access control. The Referer request header identifies the address of the resource from which the current request originated.
Usage
The Referer header is sent by clients (browsers, HTTP
libraries) to indicate the URL of the page or resource
linking to the requested resource. When a user clicks a
link on https://example.re/page, the browser sends the
address of the linking page in the Referer header with the
subsequent request.
The header serves multiple purposes. Analytics systems rely on the referrer to track traffic sources. Servers use the value for logging and access control. Search engines historically used referrer data to understand link relationships between pages.
The Referrer-Policy response header
controls how much information the Referer header
includes. Policies range from sending the full URL
(unsafe-url) to sending only the origin
(origin) to omitting the header entirely
(no-referrer). Most browsers default to
strict-origin-when-cross-origin, which sends the full URL
for same-origin requests and only the origin for
cross-origin requests.
The Referer header is not sent on a request from an HTTPS page to an HTTP page (a downgrade) under the default policy. Fragment identifiers and credentials are never included in the value.
Values
Absolute URL
The full URL including scheme, host, path, and query string. Same-origin requests typically include the complete URL.
Referer: https://example.re/articles/http-headers?page=2
Origin only
The scheme and host without path or query string. Sent for cross-origin requests under the default browser policy.
Referer: https://example.re/
Empty or absent
The header is omitted entirely when the
Referrer-Policy is set to no-referrer,
when the request comes from a bookmarked URL, when typing a
URL directly into the address bar, or during HTTPS-to-HTTP
downgrades under the default policy.
Example
A browser following a link from a search results page sends the search URL as the referrer. The server receiving the request sees where the visitor came from.
Referer: https://search.example.re/results?q=http+headers
A cross-origin request from a secure page sends only the
origin portion under the default
strict-origin-when-cross-origin policy.
Referer: https://example.re/
A resource loaded on the same origin includes the full path and query string in the referrer value.
Referer: https://example.re/docs/guide?section=headers
Crawlers and Referer
Organic-traffic reporting runs on this header.
Google's results pages send an origin-only referrer
(https://www.google.com/), which is exactly the
signal analytics packages match to classify a visit
as organic search, and the reason the search query
itself never arrives in the referrer. A destination
page seeing no Referer at all gets filed as
direct traffic.
Verified crawler probe
Probe data from verified crawler traffic (September 2026 snapshot) shows which bots send Referer when requesting pages. Yes marks the header on at least nine of ten sampled requests from the bot, Sometimes marks a smaller share, and No marks absence.
| Crawler | Sends Referer |
|---|---|
| Amazonbot | No |
| Applebot | No |
| Baiduspider | No |
| Bingbot | No |
| ClaudeBot | No |
| DuckDuckBot | Yes |
| GPTBot | Sometimes |
| Googlebot | No |
| Googlebot (smartphone) | No |
| Googlebot-Image | No |
| Meta-ExternalAgent | No |
| Meta-WebIndexer | No |
| OAI-SearchBot | Sometimes |
| SeznamBot | No |
| YandexBot | No |
| YandexFavicons | No |
