How to see where your website visitors come from

Facts checked on October 22, 2026, each against its source. Every number links to where it came from.

The referrer: what the browser says

When someone clicks a link to your site, their browser usually tells your site where the click came from. That's the Referer header, which lets a server identify the pages people are visiting from (the misspelling is official)¹.

It tells you less than it used to. Since Chrome 85, in August 2020, a link from another site sends only that site's address, not the page², and browsers now do the same by default, and send nothing at all from a secure page to an insecure one³. So you'll see that a visitor came from a newspaper's site, but not which article linked to you.

Search: the site, not the words

Google appears as a source, but the words people searched don't reach your site. They're in Google Search Console: its Performance report groups clicks, impressions and average position by the query people typed⁴. Its table leaves out rare queries, though they stay in the chart's totals⁵, so the rows won't add up to the total.

Visits from Google's AI Overviews and AI Mode are counted in the same report, under the Web search type⁶. For Bing, Bing Webmaster Tools shows clicks, impressions and position by page and by keyword, with up to 16 months of history⁷.

What Direct means

Direct means your analytics had nothing to go on. Google's own help page lists the usual causes: links without campaign tags, redirects and link shorteners that strip them, people typing your address, links in PDFs and Word documents, and ad blockers⁸.

Some links arrive with no referrer at all, sometimes on purpose. When Facebook started hiding where its users had clicked from, its engineers wrote in 2010 that the blank referrer was "good for privacy, but bad for" the receiving site's "ability to understand where its traffic comes from"⁹.

So a big Direct number often includes visitors from places that don't say where they came from, not only people typing your address.

Tag the links you control

You can't make other sites send a referrer, but you can label your own links. Add three tags to the end of the address: Google's guidance is to always use utm_source, utm_medium and utm_campaign¹⁰. A link in your newsletter might look like this:

https://example.com/?utm_source=newsletter&utm_medium=email&utm_campaign=spring-sale

Worth tagging:

• Links in your emails and newsletters.
• The link in your social media bios and posts.
• The website link on your Google Business Profile.
• QR codes on flyers, vans, signs and receipts. Nothing else tells you a visit came from print.
• Any ad that doesn't tag its own links.

Pick one spelling and keep it: "facebook" and "Facebook" can show up as two sources. And keep a short list of the tags you've used, so next year's links match this year's.

Your Google Business Profile also keeps its own count: its Performance view shows website clicks, the number of times people clicked the website link on your profile¹¹. You can compare it with what your analytics records from the tagged link.

Reading your sources

• Look at what each source brings, not only how much. A source with fewer visitors who often get in touch is worth more than a big one whose visitors leave.
• Compare like with like. A week with a newsletter looks different from a week without. Compare the same weeks or months.
• Don't chase small numbers. A source that sent a handful of visitors and one inquiry doesn't tell you much yet.

How Nodium counts it

Nodium gives each visitor one source a day, from their first page: an ad, then the link's utm_source tag, then the site that linked to you, or Direct when there's none of these. It shows how often each source's visitors reached out once it has 30 visitors to go on¹². The full rules are on how we count.