What Is a Referrer? The One Header Your Analytics Depends On

A referrer is the URL of the page a visitor was on before they clicked through to yours, and your analytics lives or dies on whether that URL arrives. If you have ever asked what is a referrer URL and got an answer full of HTTP spec jargon, this is the plain version. One header, one string, and a surprising amount of your traffic reporting hanging off it.

The header is spelled wrong and everyone lives with it

The HTTP specification named the field Referer. Not Referrer. The misspelling shipped in the 1990s, got baked into browsers and servers, and correcting it would have broken the web. So the misspelling is the standard, and every analytics tool you use reads the misspelled name. When someone writes "referrer" in prose, they mean the same thing.

What lands in that header is governed by the browser's referrer policy. Per MDN's page on Referrer-Policy, the default when a site sets nothing is strict-origin-when-cross-origin. That default is why your referral reports look thinner than they used to.

Read the second row again. A visitor clicking from another site to yours usually sends you a domain and nothing else. Your tool knows they came from somewhere. It does not know which page sent them.

Why analytics depends on this one string

The referrer is how a tool decides where a visit came from. No referrer means no source to report, and the tool has to guess or give up.

Google Analytics 4 gives up in a specific way. Per Google Analytics 4 default channel group, the Direct channel is defined as source exactly (direct) and medium (not set) or (none). Google describes Direct as users arriving via a saved link or by entering your URL. Unassigned is the value Analytics uses when no other channel rule matches the event data.

That is the whole definition. Direct means the tool found no referrer and no campaign tag it recognised. It does not mean a human typed your address.

What a missing referrer actually looks like

Three things strip it, and only one of them involves a person typing.

Many apps open links with no referrer. Email clients, chat apps and native mobile apps often send none. Someone taps a link in a message, arrives on your pricing page, and your analytics files it under Direct. The visit was real. The attribution was not.

ChatGPT does the opposite. It adds utm_source=chatgpt.com to the links in its answers. A visit that arrives with that tag and no referrer is not direct traffic if your tool reads utm_source. Most tools read it. A tool that reads only the referrer does not.

The third case is the honest one: someone saved your URL or typed it. That is what Direct was designed for.

The numbers from a site we run

We pulled seven days from one of our own sites. It served 5,774 pageviews across 1,628 visits, where a visit is a run of pageviews with gaps of 30 minutes or less.

Counted by pageview, 3,841 pageviews (66.5%) had no outside referrer. That figure is inflated by internal navigation: a click from one page to another on the same site carries no referrer, so most of it is people already on the site. Our own how Kymo counts visits and their sources page explains the visit-versus-pageview distinction.

Counted by visit, 856 visits (53%) arrived with no referrer and no campaign tag. That is the number worth caring about.

Of those 856, 798 (93%) started on a page other than the homepage. Just 58 started on the homepage. People rarely type a deep address by hand. Most of that "direct" traffic was a link whose referrer went missing somewhere between the sender and your server.

We ran the same check over 30 days. 6,745 visits, of which 3,035 (45%) arrived with no referrer and no tag. 2,802 of them (92%) started on a page other than the homepage, and 233 on the homepage.

Then the AI slice. Over 30 days, 360 visits (5.3%) carried utm_source=chatgpt.com and no referrer. A tool that reads only the referrer would have counted every one of them as direct. That is traffic an assistant sent you, filed under "someone typed it."

Timing will not rescue the missing ones

We tried to identify AI-sent visits inside direct traffic by matching a direct visit to an AI assistant's read of the same page in the 10 minutes before. It found only 1 to 2% more matches than chance, with no peak in the first 2 minutes. Timing cannot tell you which direct visits came from AI, and we are not going to pretend otherwise.

What a tool can tell you about a visit with no referrer is smaller and more useful: that it came from a link rather than a typed address, and which page it landed on. Kymo flags the first by checking whether the visit started somewhere other than the homepage, and shows the second. The landing page is a clue to the source. It is never a name for it. The cookieless identity doc covers how visits get counted without cookies in the first place.

Where this bites you now

Search is splitting. Google still sends referral traffic you can see in a referrer report. AI answers increasingly send traffic you cannot, because the link arrives from an app with no referrer, or with a tag only if the platform bothers to add one. You cannot improve what you do not measure, and a report that lumps assistant traffic in with typed URLs tells you nothing.

That is why Kymo tracks the crawler side too. A server-side receiver classifies crawler user agents, so you can see reads by category rather than guessing from traffic. The AI visibility, explained page covers the three categories, and ClaudeBot vs Claude-SearchBot: What Each One Does on Your Site shows why an indexer and a live fetcher behave differently. Reading the AI report walks through the per-page view: how often AI engines read a page, how many people AI answers sent there, and which of those people completed a goal.

Two things worth knowing before you act on any of it. First, a crawler read and a click are separate events, and only your own server sees both. Second, publishing an llms.txt file is not the same as a crawler fetching it. Adoption is partial and no major operator documents it as a signal. It costs a few minutes, so treat it as a cheap bet. llms.txt vs robots.txt vs sitemap.xml lays out what each file does. If you want the strategic side rather than the file side, The Small Business Guide to AEO is the place to start.

For the language around scores, AI Visibility Score: What It Measures and What's a Good One is honest about the limits. The Kymo documentation has the rest. Pricing is $9 a month or $90 a year on Solo for up to 10,000 events a month, and $29 a month or $290 a year on Studio for up to 100,000 events a month, with every feature on both plans and AI crawler hits outside the event limit. Both plans start with 14 days free, no card required.

Stop guessing. Watch.

Tag every link you control with UTMs, because a tag survives where a referrer does not. Then start tracking it so you can see what AI engines actually do on your own site: which pages they read, how many people AI answers send there, and which of those people buy. That beats asking a chatbot about your brand and calling the answer research.

Start free → 14-day free trial. No card required.