https to http: Secure-to-Nonsecure Referrer Loss

The Google Analytics Referrals report is quite straightforward. It lists all traffic that came to your site from:

• Non-search engine websites
• Links to your site in which referral was not overwritten as the campaign source

As a marketer, it’s important to know where your traffic comes from to make decisions on optimization and ROI. If you know what source is providing the most valuable traffic, you can increase spend on these sources and/or work on partnerships to increase traffic from them. While knowing where the least valuable traffic is coming from will inform you to cut spend from these sources and allow you to focus elsewhere.

Unfortunately, some referral traffic may be missing from the Referrals report. This could impact your numbers and ability to optimize based on referrals, so as a marketer, it’s important to know how your referral information is affected. In this post, we’d like to go over how http to https traffic might remove referral information.

Below is an example of a report showing referral traffic.

Referrer Read from the HTTP Header

Google Analytics populates the Referral report based on referral information in the HTTP header.

Using the HTTP Headers extension for Chrome, we can see the referrer (or referer) in the request.

But what if the referral information is missing from the page request? This is actually the case for default https-to-http (secure-to-nonsecure) links.

For most https-to-http requests, the referrer details are blocked.

Some of your referral traffic may appear as direct in Google Analytics, just because there is no referral information to work with.

Most of the https-to-http traffic to your site is likely appearing as direct in Google Analtyics.

How much of a problem is this?

If all the pages on your site are accessible only through https protocol, you aren’t losing any referral information, since referral loss can occur when the visitor comes from an https page, not to an https page. If, on the other hand, your pages are accessed through http, you can at least quickly survey the number of secure inbound links by performing a Google search using advanced operators in the format link:www.mysite.com inurl:https, which will show inbound links to your domain that contain https as in the example below (though Google link searches often omit some matching occurrences).

Using the inurl operator in a Google search, we can list some of the inbound links from secure pages.

How can we address this issue?

The control is not completely in the hands of the other websites that are linking to you. If most of the pages on your site are accesed through http, and if any referrer information is too valuable for you to lose, you can consider serving your site through https to make sure that all referrer details are preserved.

Otherwise, this issue is determined by that pages that contain your inbound links. If those pages contain the HTML5 tag <meta name="referrer" content="always" /> – which may be the case for an https-hosted blog that wants to receive pingbacks from http-hosted blogs – the header information will still be passed, but the use of the referrer meta tag probably remains quite rare, and it is supported only in Chrome and Safari at this point (with Firefox support forthcoming).

At a minimum, we should remain aware of this https-to-http referral loss. Perform the Google search described above (using your own home page); if you see results, and your site is accessed through http, understand that some portion of your inbound clickhtroughs from https pages will appear in Google Analytics as direct.