The case against storing referrer URLs

A referrer header carries the whole address of the page somebody arrived from. Most analytics store all of it, and it is worth thinking about what that means in practice.

Search engines strip their query strings now, so the days of reading keywords out of a referrer are over. What remains is the interesting part: the hostname, and occasionally a path that tells you which article linked to you.

The rest is risk. Private forums, internal wikis, password reset pages, staging sites with the client’s name in the URL. All of it arrives unbidden and all of it ends up in a table somebody will eventually export to a spreadsheet.

We keep the hostname and the channel it maps to. It answers every question we have ever actually been asked about traffic sources, and it cannot leak somebody’s intranet.