1

I have a Wordpress site hosted on Vultr, using Plesk Onyx with Apache + Nginx. I've done this same setup for other sites and never had issues, but for this new site I am seeing some odd behavior when clicking links to the site.

I noticed because Google Analytics never flags any traffic as being from a referral source. All the traffic I expect to show as Referral is showing as Direct. After looking at my Apache access logs, it seems when I click a link from some other websites, there is no referrer being logged.

This isn't the case for all links. Social platforms like Twitter, Instagram, and Facebook all get logged with the expected referrer information. Also, organic traffic and CPC/Ads traffic is also showing up as expected. It's just a handful of links from other sites that aren't logging.

Here are a few example entries from the access logs. Some contain a valid referrer (Twitter, for example) while others just contain a -. For some of these cases, I was tailing the access log while clicking a link from another site so I know it should have a valid referrer:

X.X.X.X - - [10/Jun/2019:03:06:10 +0000] "GET / HTTP/1.0" 200 12153 "https://twitter.com/PxJVBrEB7T" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"
X.X.X.X - - [10/Jun/2019:03:12:37 +0000] "GET / HTTP/1.0" 200 13535 "https://twitter.com/PTVIpLWqE9" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"
X.X.X.X - - [10/Jun/2019:03:50:39 +0000] "GET / HTTP/1.0" 200 12308 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"

Is it possible Apache is misconfigured and dropping the referrer information? Or is it possible it's something to do with the referring websites?

There are multiple referring websites where links aren't showing up properly in the access log, so I suspect it's on the server side but I'm not sure what more to check.

Improve this question
2
  • Do you have access to the server config?
    – MrWhite
    Jun 10, 2019 at 15:48
  • I do. Wordpress is installed via Plesk Onyx but I can access the underlying the Apache and Nginx configs.
    – Mike
    Jun 10, 2019 at 16:15

1 Answer 1

Reset to default
1

...clicking a link from another site so I know it should have a valid referrer

The only way to "know" whether it should have a valid referrer logged is if you see the HTTP Referer header as part of the request.

Whilst it's possible for the user to simply block the Referer header that the browser sends (probably not the issue in your case), the website can also trivially block the sending of the Referer header using the Referrer-Policy HTTP response header. Or simply adding the rel="noreferrer" attribute directly to the anchor. These techniques are supported by all major browsers these days.

Note that, by default, the browser will not send the Referer header when you navigate from HTTPS to HTTP. Which corresponds to Referrer-Policy: no-referrer-when-downgrade. (Although this doesn't seem to be the problem in your case, looking at your log extract.)

This is the most probable cause of the Referer not be logged - it's not being sent in the request. Particularly since you are seeing the Referer being logged for some sites.

Whilst it is technically possible on Apache to have a custom log format based on different requests - this seems very unlikely to be the cause. This would be a very deliberate action, rather than a simple "misconfiguration" IMO.

Improve this answer
8
  • Thanks for the background, I was not too familiar with the Referrer-Policy header and it might be playing a role. The new site is returning no-referrer-when-downgrade but both sites that link back to it are https, so I would think in this case it's not the issue since the new site is also https. I did also check both links to the site, one does have rel="noreferrer" and the other does not, but they both have the same behavior of not sending a referrer.
    – Mike
    Jun 10, 2019 at 16:15
  • "The new site is returning no-referrer-when-downgrade" - It's the site that is linking to your "new site" that you need to check. eg. Referrer-Policy: same-origin (or no-referrer) would block the Referer header on all external links. This can also be specified directly on the anchor with the referrerpolicy attribute. You can examine the network traffic in Chrome's dev tools ("Network" tab) and see exactly what headers your browser is sending when following the link. Presumably you see the Referer logged when following internal links on your own site?
    – MrWhite
    Jun 10, 2019 at 16:46
  • I see. Neither of the linking sites is setting the referrer attribute on the anchor element. Looking at chrome dev tools, when I click the link it sends the Referer header and the value is what I would expect (it also sends the Host header but not sure if that players a role at all). This all makes me think something on the new server is causing the problem. The site with the link is my own work portfolio. I link to all the sites I build. And every other one properly tags the click as a Referral with the URL of my site; only this new site is dropping Referrer details.
    – Mike
    Jun 10, 2019 at 17:43
  • 1
    The Host header is essential to make a valid request. Is your "new site" using a front-end proxy of some kind? Although if it is a server issue, it's difficult to imagine how/why it would effect some requests (or some referrers) and not others. You could test some "fake" requests using CURL and set any Referer you like, you could then manually set the Referer to something like https://twitter.com/PxJVBrEB7T and see if it makes a difference.
    – MrWhite
    Jun 10, 2019 at 17:54
  • 1
    So turns out I picked the 2 worst links to look at. The first one, from my site, was indeed add rel="noreferrer"; it's a Wordpress site and one of the latest updates added a new "feature" where all external links that open in a new tab get that attribute. The other site was linking to a http and www version of our URL, which was causing 301 redirects and thus losing the referrer. Once I had them update to use https and drop the www, the referrer was passed along as expected. Thanks for the help!
    – Mike
    Jun 12, 2019 at 2:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.