Why referrers go missing

A big “Direct” slice does not mean people are typing your URL. It means the browser sent no referrer, and that happens for many legitimate reasons.

• Key takeaways
• Apps, strict Referrer-Policy, HTTPS→HTTP, bookmarks, and privacy browsers all strip referrers.
• UTM parameters restore attribution for traffic you control, and we strip them from stored URLs.
• Watch Direct's share over time; spikes usually follow a campaign in disguise.

Where referrers get stripped

• Native apps: links tapped in Slack, WhatsApp, Instagram, or most email apps arrive referrer-less.
• HTTPS → HTTP transitions (keep everything on HTTPS).
• Referrer-Policy headers on the linking site, increasingly set to strict values by default.
• Privacy browsers and extensions that trim or remove referrers.
• Bookmarks, QR codes, and typed URLs, genuine direct.

Getting attribution back

For traffic you control, add UTM parameters: ?utm_source=newsletter&utm_medium=email. BobRay reads the standard UTM set and files the visit under the declared source while stripping the parameters from stored URLs. For everything else, accept that some “dark” traffic is the modern web being polite about privacy.

Reading Direct honestly

Watch Direct's share over time rather than its absolute size. A spike in Direct right after a newsletter send or a podcast mention is usually that campaign wearing a trench coat.

Common pitfalls

The mistakes we see most often on this topic, so you can skip them entirely.

• Buying attribution tooling to explain a Slack-share spike.
• Tagging internal links with UTMs and shredding your own source data.
• Assuming Direct = typed; most is referrer-stripped.

Quick reference