Losing referrer data on http link that redirects to an https site when on an https site. Is this typical or is something else going on here?

[Velir]

I am trying to resolve a referral data issue. Our client noticed that their referrals from one of their sites to another had dropped to almost nothing from being their top referrer. The referring site SiteA which is an HTTPs site, held a link to SiteB, which is also an HTTPs site, so there should be no loss, however the link to SiteB on SiteA had the HTTP protocol. When we changed the link to the HTTPs protocol, the referrals started flowing in.

Is this typical? If the 301 redirect is properly in place for SiteB, why would we lose the referral data?

[Velir]

Thanks! That's exactly what I was looking to confirm. And thanks for the tip on HSTS, I'll look into that!

[ThompsonPaul]

Referrer data is stripped when the referral is coming from HTTPS to HTTP. That's a security measure that Google has had in place for some time. Because the link is hitting the HTTP first, it is negotiating its initial connection over an unsecure channel, so the referrer is being stripped. (The incoming connection is being initiated over HTTP before it is ever able to detect and process the redirect.)

So yea, expected behavior. One way around the issue that I'm pretty sure would work is if you implement HSTS for the receiving site. That forces the initial connection over HTTPS regardless of the incoming request's protocol.

Hope that helps?

Paul

[Velir]

I mean the automatic referrer data that gets us information like what website someone was referred from/clicked from which in GA would show up under the acquisition referrals report. We are not using UTM parameters to designate this traffic. In this case I think the server and browser should be able to communicate that data without dropping it because of the redirect (I know it would get dropped if we were actually going from https to http, but because of the redirect we are going from https to https), but that's not what's happening. The data gets dropped unless we change the link (which redirects to https) from http to https. It's an easy fix obviously, but I'm interested to know why this is happening so we can advise clients on how these issues can be avoided in the future.