Referrer policy and Direct traffic
Why most of your traffic might show as Direct, how referrer policies on your site and on other sites affect sources, and how UTM parameters fix attribution.
Sources come from document.referrer, which the previous site's
browser policy controls.
Your own policy#
Your own Referrer-Policy controls what your pages send to the sites
they link to, not what you receive. If a site of yours sends
Referrer-Policy: no-referrer (or same-origin), links from it to your
other properties (blog → app) arrive without a referrer and show as
Direct there.
The browser default, strict-origin-when-cross-origin, is fine: other
sites send their origin (https://news.example/). Privatus Analytics
stores the referrer's host and path when the browser sends them, and
never its query string.
Verify installation warns when your pages send no-referrer or
same-origin.
Other sites' policies#
Many sites and apps send no referrer at all: mobile apps, email clients, messaging apps, some social networks, and links opened from documents. That traffic lands in Direct. Use UTM parameters on links you control (newsletters, social posts, ads) so it's attributed correctly: see Campaigns.
HTTPS → HTTP#
With the default policy, browsers send no referrer from an https page
to an http page. Serve your site over HTTPS.