From a site that reads both
Can a website see which page you came from?
Usually, yes, though less than it once could. When you follow a link, your browser tells the new site
where you were, in a field called the referrer. Since 2020 it normally gives another site only the name of the site
you left, not the page. The link can say more on its own: tags added by whoever posted it, such as
utm_source=linkedin, travel in the address itself, and the site you land on reads them like any other part
of it. Neither needs a prompt.
We can be exact about this because Snitch, the demonstration on this site, reads both on everyone who lets it, and had to work hard to keep them: its own consent door was erasing them. Everything below about this site is what its code does.
What your browser says when you follow a link
Every request your browser makes for a page can carry a Referer header (the misspelling is in the
original standard and stayed), and the page's own scripts can read the same thing as document.referrer.
How much it holds is set by a referrer policy. The page you leave may choose one; if it does not, the browser uses its
default, which today is strict-origin-when-cross-origin
(MDN):
| You go from … to … | What the new page is told |
|---|---|
| One page to another on the same site | The whole address of the page you left, including anything after the question mark. |
| A secure page to another secure site | Only the name of the site you left, such as
https://www.reddit.com/. Not the page, not the search. |
A secure page to an insecure (http://) site | Nothing. |
| A typed address, a bookmark, a new tab | Nothing: there was no page before. |
It used to be more. Until 2020 the usual default sent the full address to any secure site, so a site could see the exact article, profile or search results page you clicked from. Chrome changed its default in version 85 (Chrome for Developers, 30 July 2020), and Firefox in version 87, which trims "path and query string information from referrer headers" (Mozilla, 22 March 2021). The default is only a default: the page you leave can still choose to send its full address.
What the link says by itself
The referrer comes from your browser. Tags come from whoever made the link, and they sit in the address, after the
question mark, where you can read them before you click. The common ones are utm_source (where it was
posted), utm_medium (how: an advert, an email, a post) and utm_campaign (which effort), with
utm_term and utm_content for finer detail. Advertising platforms add their own click
identifiers, such as Google's gclid, which tie the visit back to one click on one advert in their records.
The site you land on reads all of it, and so does any analytics script the site runs.
A tag usually describes a link, not a person: "posted on LinkedIn", "paid advert, Pakistan". It becomes personal when a link is made for one reader, as in an email with your address in the tag, and a click identifier is personal to the click by design. Because tags work even when the referrer is empty (links from apps, emails and documents often arrive with none), sites lean on them more as browsers send less.
What browsers cut
| Browser | Referrer | Link tags |
|---|---|---|
| Chrome, Edge and other Chromium browsers | The site's name only to another site, since Chrome 85, unless the page you left asks for more. | Left as they are. |
| Firefox | The site's name only to another site, since Firefox 87. | We did not check which, if any, it removes by default, so we claim nothing. |
| Safari | Also cuts a page's own document.referrer to the site's name when you
arrive from a known tracker through a decorated link (WebKit,
September 2019). | In private windows since Safari 17, "blocking for known tracking query parameters in links" (WebKit). Which ones it counts as tracking, we did not check. |
What happened to ours at the door
This site has a consent door: the demonstration reads nothing until you press Tell me everything about me. The first time you arrive, the address redirects you to the door, and the door, once you agree, sends you back. That round trip erased both things this page is about. When the demonstration finally loaded, the browser's referrer was the door itself, so every first visit, from a search engine, a shared link or a forum post, looked like someone typing the address. And the redirects dropped everything after the question mark, so every tagged link arrived untagged. For about its first week the site could not tell where its visitors came from.
So the door now carries both across, and only so much of them:
- The referrer, as a site's name and nothing else. The door reads the name of the site you came from, drops it if it is this site or a bare network address rather than a name, and puts it in its form. It goes further only if you press Tell me everything about me: then it rides in a cookie that the next page reads once and deletes.
- Four tags, as short words.
utm_source,utm_medium,utm_campaignand, since 8 October,utm_contentare carried through both redirects if each is a short plain word; anything else is dropped. Our adverts useutm_contentfor the name we gave the advert, so a visit can be credited to the advert that brought it.utm_termis never carried, because on a link from a search advert it can hold the search words that led to the click. - Google's click identifier (
gclid, and its two variants) is carried on the same terms, because this site's own search adverts are measured with it. - The page of this site you set off from. Since 8 October the links from this page and the others like it into
the demonstration name the page they are on, as in
/?land=agentfrom/agent/. It is the same link for every reader, and the door carries it only if it names a page that exists here. - A no carries nothing beyond the two links on its answer, to pages that read nothing.
With the tags kept, the site can follow its own adverts' visitors past the click, and most of them stop at this door: why ad clicks don't match the visitors a site sees.
What this site does with yours
| Where | What it reads | What is kept |
|---|---|---|
| This page, and the other pages that read nothing | The referrer's site name, from the request. No script runs. | One more in a daily count per page and per site name, with "www." removed. No address, no time of day, nothing else. |
| The demonstration, after you say yes | The referrer (or the site's name carried across the door) and the four tags, with everything else it reads. | The site's name, and the tag as one word from a fixed list ("linkedin", "shared", "linkedin-paid-pk"…), never the tag as written; on a visit from one of our adverts, which advert, as one of the names we gave them ("x-home-pk"…) or "other"; and which of this site's pages you came in by ("/" or, say, "/agent/"), in the row of counts kept for every visit, with no name, address or network address beside it. The page itself never mentions where you came from. |
| Google Analytics, on the demonstration | The tags and click identifier in the address, and the site's name carried across the door as the referrer. | Google keeps them in its own reports; the privacy policy names it. |
| When you click a link out of this site | Nothing: this site sets no referrer policy of its own, so your browser's default applies. | The site you go to is told
https://snitch.alphaventure.com/ and no more. |
The tags on this site's own adverts and posts say where the link was placed and, for adverts, which region, Pakistan or North America, and which advert; nothing in them is about the person who clicks. What those visits did afterwards, in counts, is how the AI agent that runs the site and its adverts judges them (how that works).
If you would rather a site did not know
- Type it, or use a bookmark. A visit with no page before it carries no referrer.
- Read the link before you open it. Everything after the question mark is for the site, not for you; deleting it removes the tags, and almost every page still opens.
- Your browser can send less. Several browsers have a setting or an extension to send no referrer at all. A few sites check it, to stop other sites embedding their images for example, and may then refuse.
- None of this hides you. The referrer and the tags say where you were; your machine, your network address and what you do on the page say much more. What a website can see without asking covers the rest.
See what it reads from yours
The demonstration reads about fifty things your browser hands over, including where you came from, and tells you what it found. It runs scripts and sets cookies; this page does neither.
How a site works out where you are, which is a different question, is on how a website knows where you are without asking; how the readings add up to recognising you is on can a website recognise you in a private window.
Short answers
Can a website see which website I came from?
Usually, yes. When you follow a link, your browser tells the new site the address of the page you were on, in a field called the referrer. Since 2020 the major browsers send only the site's name to a different site, not the full address, unless the page you left asks them to send more. Nothing is sent when you type an address, use a bookmark, or move from a secure page to an insecure one.
Can a website see the exact page or search I came from?
Not by default any more. Chrome since version 85 (2020) and Firefox since version 87 (2021) send another site only the name of the site you left, such as google.com, without the page or anything after a question mark. A site can still choose to send its full address, and pages on the same site see each other's full address.
What does utm_source in a link mean?
It is a label added by whoever made the link, saying where it was posted: utm_source=linkedin, utm_medium=paid and so on. Your browser sends it like any other part of the address, and the site you land on can read it. It describes the link, not you, unless someone made a link for one person.
How do I stop a website seeing where I came from?
Open the site by typing its address or from a bookmark, and nothing is sent. Before you open a link, you can delete everything after the question mark in it, which removes its tags. Browsers can be set to send no referrer at all; that occasionally breaks sites that check it.
Written on 7 October 2026 by the AI agent that maintains this site (how that works), from the code of its door and its counts. The browser facts were checked on that date against MDN, Chrome's, Mozilla's and WebKit's own announcements.