What Is Referral Traffic? (And Where the Referrer Goes)
- Referral traffic is a visit that arrives from a link on another site, and the browser labels it by sending a referrer header with the request.
- The header goes missing a lot: on HTTPS to HTTP clicks, on links marked rel=noreferrer, and in many email and chat apps.
- On a site we run, 856 visits in 7 days (53%) arrived with no referrer and no campaign tag. Of those, 798 (93%) started somewhere other than the homepage.
- 360 visits in 30 days carried utm_source=chatgpt.com and no referrer. A tool that reads only the header counts all of them as direct.
- Tagging the links you share is the one part of this you fully control.
Referral traffic is a visit that arrives from a link on another site, and the browser marks it by sending a referrer header along with the request. Your analytics reads that header and credits the source. That is the whole mechanism. No shared registry, no lookup table, no handshake between sites. One header, sent or not sent.
The definition is easy. The trouble is everything that happens after the header fails to arrive.
What the referrer header actually sends
Most sites never set a policy, and the browser falls back to a default. That default is strict-origin-when-cross-origin, documented by MDN's Referrer-Policy reference. It behaves differently depending on where the click came from.
On a same-origin request, the browser sends the origin, the path and the query string. On a cross-origin request where both sides stay on HTTPS, it sends the origin only, so you learn the domain and lose the page. From HTTPS to HTTP it sends no Referer header at all. A link marked rel=noreferrer sends nothing either.
Here is the whole picture in one table.
| Situation | What the browser sends | What you see in analytics |
|---|---|---|
| Click from one page to another on your site | origin, path and query string | no outside referrer |
| Click from another HTTPS site to your HTTPS site | that site's origin only | the referring domain, no page path |
| Click from an HTTPS page to an HTTP page | no Referer header | nothing |
| Link marked rel=noreferrer | nothing | nothing |
| Link opened inside many email and chat apps | often nothing | nothing |
| Link in a ChatGPT answer | no referrer, plus utm_source=chatgpt.com | direct, unless your tool reads the tag |
Two rows in that table deserve a second look. The first one explains why pageview counts and visit counts tell different stories, which trips people up constantly. If you want the groundwork on how visits get counted in general, Analytics basics covers it.
The last row is the one that is quietly growing.
Many apps open links with no referrer
Email clients and chat apps often send none. Native mobile apps often send none. That is not a bug you can fix on your end. The link opened, the page loaded, and the browser never had a referring page to name.
Your analytics still records the visit. It just files it somewhere else, and that somewhere is usually direct.
What Google Analytics calls direct
The Google Analytics 4 default channel group defines the Direct channel as source exactly '(direct)' and medium '(not set)' or '(none)'. Google describes Direct as people arriving from a saved link or by typing your URL. Unassigned is the value Analytics uses when no other channel rule matches the event data.
That definition covers a wide range of visits. A bookmark and a click from a chat app both land there, and Analytics has no way to separate them from the data it holds.
Why so much of your direct traffic is a hidden referral
We looked at one of our own sites. Over 7 days it recorded 5,774 pageviews and 1,628 visits, where a visit is a run of pageviews with gaps of 30 minutes or less.
Counted by pageview, 3,841 pageviews (66.5%) had no outside referrer. That number is inflated, and the reason is boring: a click from one page to another on the same site carries no referrer either, so most internal navigation looks anonymous by this measure.
Counted by visit, 856 visits (53%) arrived with no referrer and no campaign tag.
Of those 856 visits, 798 (93%) started on a page other than the homepage. The other 58 started on the homepage. Over 30 days the pattern held: 6,745 visits, of which 3,035 (45%) had no referrer and no tag. 2,802 of those (92%) began on a page other than the homepage, and 233 began on the homepage.
A deep landing page is a clue, not a name
People rarely type a long address by hand. When a visit starts three levels into your site with no referrer and no tag, the likeliest explanation is a link someone shared, in an app that sent nothing.
That is all it is, though: a clue. The browser told you nothing about the app, the site or the person. Analytics can show that the visit came from a link rather than a bookmark, because it started on a page other than the homepage, and it can show which page the visit landed on. It cannot name the source. Any tool that claims otherwise is guessing politely.
Matching visits to AI reads by timing does not work
The first instinct is to reverse-engineer it. If an AI assistant read a page and a direct visit shows up moments later, connect the two.
We tried that. We matched direct visits against an AI assistant's read of the same page in the 10 minutes before the visit. It found only 1 to 2% more matches than chance, with no peak in the first 2 minutes. Timing cannot tell you which direct visits came from AI. Treat any tool that sells you this signal with real suspicion.
Tag the links you control
You cannot fix the apps. You can fix your own links.
Add UTM parameters to the links you share and the visit arrives carrying its own label, whether or not the browser sends a referrer. ChatGPT already does a version of this: it appends utm_source=chatgpt.com to links in its answers. On that same site, 360 visits in 30 days (5.3%) carried utm_source=chatgpt.com and no referrer. A tool that reads only the referrer would have filed every one of those as direct.
Kymo reads the utm_source parameter and reports campaign source, medium and campaign, so those 360 visits land in their own bucket. That is one small, checkable win against a growing blind spot.
AI crawlers and AI referrals are separate things
A crawler visiting your site and a person arriving from an AI answer are two different events, and it helps to keep them apart.
PerplexityBot builds a search index for later answers. It can lead to referral traffic. Perplexity has no training crawler, so both of its agents are retrieval agents. ClaudeBot (Anthropic's training crawler) gathers training data and sends no traffic. Neither does Bytespider (ByteDance). Their visits still tell you whether AI systems are reading your pages, which is a separate question from whether they send anyone back.
If the distinction between indexing, live fetches and training crawls is new to you, AI visibility, explained walks through it. And if you have been told to publish an llms.txt file, keep expectations level: adoption is partial, no major operator has publicly committed to honouring it, and publishing the file is not the same as a crawler fetching it. Only your own server sees which of those happened. Kymo's free llms.txt generator and validator will build and check one in a few minutes. It is a cheap bet, never a requirement.
Kymo starts at $9 a month on Solo (up to 10,000 events) or $29 a month on Studio (up to 100,000 events), and AI crawler tracking does not count against your event limit.
What I would do this week
Tag every link you share, in email, in chat, in your social bios, in partner posts. Pull up your direct traffic and sort by landing page. If a page deep in your site is pulling steady direct visits, something is linking to it without a label.
Do that if you're a small team with no analyst and a nagging feeling that your best traffic is arriving anonymously. Then read AEO vs GEO: Two Acronyms, One Shift if you want the wider picture, and AI Overview Tracking: Why the Same Search Shows New Answers for what happens when those answers shift under you. The Small Business Guide to AEO is the practical starting point.
Stop guessing. Watch.
Point Kymo at your site and the dashboard shows which pages AI engines read, how many people AI answers send there, and which of those people completed a goal, next to your normal traffic numbers. A visit carrying utm_source=chatgpt.com shows up as a campaign instead of vanishing into direct. That is measured from your own server logs, not from asking a chatbot what it thinks of you.
Start free → 14-day free trial. No card required.