Referrer Control Explained: Where Bought Visits Come From

When a browser follows a link from page A to page B, it can include a request header naming page A. That header is spelled Referer, with one r in the middle, and has been since HTTP/1.0 was written up as RFC 1945 in 1996. The typo was spotted during review, by which point too much software already depended on the exact string.

The misspelling survives only in the request header. Everything specified afterwards spells it properly: the JavaScript property is document.referrer, the response header that governs behavior is Referrer-Policy, and the per-element attribute is referrerpolicy. If you are searching documentation and getting nothing back, that mismatch is usually why.

Three consequences follow, and each one matters later.

• The source page decides, not the destination. Your site cannot ask an incoming visit to reveal where it came from. Whatever the previous page's policy allowed is all you ever get.
• It is a hint, not an audit trail. Any client that speaks HTTP can put any string in that header. Nothing on the receiving end verifies it.
• No link, no referrer. A URL typed into the address bar, opened from a bookmark, or launched from a desktop application carries no Referer at all.

That last point is the entire reason a direct channel exists.

Browsers used to send the full referring URL, query string included. That stopped being the default years ago, and the shift is why referrer data is thinner now than most reporting habits assume.

strict-origin-when-cross-origin resolves three different ways depending on the hop:

• Same origin: the full URL, path and query included.
• Cross origin at the same security level, so HTTPS to HTTPS: the origin only, meaning https://example.sparkcliks.com/ with nothing after the slash.
• HTTPS down to HTTP: nothing at all.

The practical version: a real cross-site visit tells you the domain it came from and not one character more.

Three levels exist, and the most specific one wins: the Referrer-Policy response header, a tag in the document, and a referrerpolicy attribute on an individual link, image or iframe. Adding rel="noreferrer" to a link is the shorthand for sending nothing on that one link, and it implies noopener as well.

One correction worth making, because it comes up in nearly every discussion of this: rel="nofollow" does nothing to the referrer. It is an instruction to crawlers. A nofollowed link still sends whatever the page's referrer policy permits.

Direct is not the channel for people who typed your domain. It is the bucket for every session that arrived without a usable referrer and without campaign parameters:

• typed URLs and bookmarks
• links opened from a mobile or desktop app, including messaging apps and PDF readers
• links clicked in a native email client rather than webmail
• an HTTPS page linking to an HTTP page, where every modern default drops the referrer
• links carrying rel="noreferrer" or sitting on a page with a no-referrer policy
• some meta refresh and JavaScript redirects, which lose the referrer in transit
• QR codes and anything else that starts offline

On most sites the app category alone outweighs everything else on that list, which is why direct is normally the biggest unexplained channel in a healthy account. Worth knowing before you read a direct spike as evidence of anything. Our breakdown of organic, social and referral traffic covers how the other channels get populated.

GA4 does not report the raw referrer string. It converts what arrives into session_source and session_medium, then files the session into a channel using the default channel group.

Two rules get misread constantly.

Campaign parameters beat the referrer. When the landing URL carries utm_source and utm_medium, GA4 uses those for source assignment and the referring domain stops mattering. That single rule is what the segmentation section below is built on.

Direct and unattributed are not the same thing. A session with no referrer is reported as Direct in Traffic acquisition, but GA4's conversion attribution models discount direct touchpoints when the same user had an earlier non-direct one inside the lookback window. A batch of referrer-free visits can therefore be plainly visible in the session report while conversion credit stays parked on an older source. The GA4 guide covers the report layout in more detail.

Every automated traffic tool exposes the same lever: set the Referer header the browser sends as it navigates to your URL. Across the SparkCliks products that shows up as:

• Website Traffic: campaign controls include a referrer list rotated round-robin across visits, a keyword list rotated the same way, plus device, language and country. Referral, organic and social traffic types are listed features of the paid plans.
• Realistic Traffic: identical referrer and keyword control, with on-page behavior added on top. The comparison between the two sets out what that extra behavior does and does not change.
• Sparky Traffic Bot: the referrer is set per visit, and a session can instead arrive by keyword search flow or by direct navigation with no referrer at all.
• SERP Clicks: a different mechanism entirely. Paid people run the search themselves and click the listing, so the referrer is whatever the search engine genuinely sends. Nothing is being set.

That distinction is the one to hold on to. On the automated products, referrer control means choosing a string in a header. On the crowd-sourced one, a real navigation produces a real referrer as a side effect.

Setting the referrer to a search engine domain does make GA4 file the session under Organic Search. Be clear about what that is: it misrepresents the source of the visit inside your own reporting. No search ran, no query matched, and your Organic Search row is now part fiction. Anyone else reading it, a client, a colleague, whoever sets next quarter's budget, is working from a false input you created.

There is a technical problem with it too. Google moved organic search to HTTPS and stopped passing the query in the referring URL, for signed-in users in 2011 and for everyone by 2013. A genuine organic visit from Google today arrives as https://www.google.com/ and nothing after the slash, which is precisely why Search Console had to exist. A fabricated referrer carrying ?q=your+keyword is not more convincing, it is the one shape a real search referral can no longer take.

The same trap sits in referral. Because the browser default is origin-only cross-site, a real visit from a partner's blog post arrives as https://partner.sparkcliks.com/, not as the article URL. A bought referrer with a deep path and a query string implicitly claims the referring site has set unsafe-url, which almost nobody has. Origin-only strings are both more honest and more plausible.

The opposite failure is a campaign that sends every visit with no referrer at all. That draws a direct-channel line with a shape real traffic does not have: it starts at a specific hour, holds a flat rate, and stops. Six months later the step is still in the chart with nothing attached to explain it. That is the practical case for a mix rather than one setting, and for tagging everything so the mix never has to be untangled by hand. If you are still deciding what to run, the referrer dropdown is the wrong end of the problem. Start with whether to buy at all, then with where the budget should go.

This works because of the GA4 rule from earlier: campaign parameters beat the referrer. You can set the referrer for plausibility and still control exactly which channel the session lands in, because the landing URL wins the argument.

Step 1. Tag the landing URLs. Put campaign parameters on the URLs you hand the traffic tool, and pick a medium that GA4's default channel group does not recognize:

https://www.sparkcliks.com/landing-page/?utm_source=sparkcliks&utm_medium=bought-traffic&utm_campaign=aug-2026-test

Avoid utm_medium=organic and utm_medium=referral. Those are the exact strings that push sessions into Organic Search and Referral. An unrecognized medium falls into Unassigned, which looks untidy and is correct: it is visible, and it is not sitting inside a channel you report on.

The tagged URLs will not fragment your content reports either. GA4's Page path and screen class dimension drops the query string while Page location keeps it, so the campaign stays separable without splitting your page rows.

Step 2. Give it a channel of its own. Admin, then Data display, then Channel groups. Copy the default group, add a channel called Bought traffic with the condition Session medium exactly matches bought-traffic, and move it to the top. GA4 evaluates channels in order and the first match wins, so a channel sitting below Referral never gets a chance to catch anything.

Step 3. Keep a clean organic view. In Explore, build a Free form exploration with a segment that excludes sessions where Session medium exactly matches bought-traffic. Save it, and use it for anything you report as organic performance.

Step 4. Split the property if other people read the numbers. Segments and channel groups are reporting-layer fixes. The sessions are still in the property, and anyone opening a standard report without your segment sees the blended figure. If a client or a board reads these reports, route the tagged sessions to a second GA4 property: add a condition in your tag manager that swaps the measurement ID when the landing URL carries utm_medium=bought-traffic. Store that flag on entry, usually in a first-party cookie, because only the first page view carries the parameter and the swap has to hold for the whole session.

Step 5. Write the dates down. Fix a baseline window before the first visit lands, a campaign window of the same length, and a control set of pages you deliberately keep out of the campaign. If your property has GA4 annotations, mark the start and end dates. Keep the same dates in whatever document your team actually opens. Six months on, that note is the only thing standing between a future reader and a mystery.

These are the misunderstandings that cost money, so they are worth stating flatly.

• It does not touch rankings. The Referer header goes from the browser to your web server. A search engine crawler never receives it, and no search engine has described referrer strings as a ranking input. Setting a referrer to a search engine domain creates no impression, no query and no position.
• It does not appear in Search Console. Search Console counts impressions and clicks recorded on the results page itself. A visit that never came from a results page is not in that data set, whatever header it carried. That is also why Search Console stays a clean control while a campaign runs, and why measuring organic CTR there is unaffected by any of this.
• It does not make traffic valid for ad networks. Automated visits counted as ad impressions are invalid traffic under every major ad network's rules, and the consequence lands on your account rather than the vendor's. A referrer setting changes the label, not the classification.
• It does not survive your own tagging. Add UTM parameters and GA4 stops consulting the referrer for source assignment. That is the point here, and it still catches out people who configure both and then wonder why the referral row is empty.

Run this before a campaign starts, not while you are trying to explain the chart afterwards.

1. Decide which channel the visits should appear in and write down the reason. If the reason is that organic will look better, stop there.
2. Set the referrer to something that could plausibly be true: a site that actually links to you, or nothing at all.
3. Use origin-only strings such as https://partner.sparkcliks.com/ rather than deep article URLs with query strings. That is what a real browser sends under the current defaults.
4. Tag every landing URL with utm_source and a utm_medium that no default channel matches.
5. Build the Bought traffic channel in a custom channel group and place it above the defaults.
6. Check your own site's Referrer-Policy while you are in there. If it is unsafe-url, you are handing full URLs with query strings to every site you link out to.
7. Record the start date, the end date and the control pages, then annotate them.
8. After 48 hours, open Traffic acquisition, switch the primary dimension to Session source / medium, and confirm the rows say what you configured. If they do not, the tool is not sending what you think it is. Confirming the header landed is a narrower check than judging the traffic itself, which is a separate job covered in how to spot bought traffic in analytics.