Google Documents Its Search Referer Values; 28% of Top-Site Redirects Dropped gclid

Ras Al Khaimah, United Arab Emirates, 12 November 2026.

Google added a new page to its Search Central documentation on 12 November, Identify Google Search traffic in your web analytics or server logs, which lists the HTTP Referer values Google Search sends when someone clicks a result and explains why those visits often fail to match Search Console clicks. The Search documentation changelog logs it as a new page about identifying traffic from Google Search with Referer headers.

The page is short, but it is the first time Google has put the exact Referer formats for the web, the Android app and the iOS app in one official place. It also names redirects as a cause of lost data. We tested that claim against 1,000 of the web's most popular domains.

What Google's new page says

Google Search uses the origin referrer policy, so the Referer header carries only the scheme and host of the Google page, never the path or the query string. Google says plainly that the header does not include the search query and points site owners to the Performance report in Search Console for query data.

Where the click happened	Referer value Google lists
Google Search on the web	https://www.google.com/ or a local Google domain such as https://www.google.co.uk/
Google app on Android	android-app://com.google.android.googlequicksearchbox/https/www.google.com when the app opens the link in a browser tab, otherwise https://www.google.com/ or a local domain
Google app on iOS	https://www.google.com/ or a local Google domain
Discover	The same value as the surface where Discover was viewed

The page adds three practical points:

• Images and other Google services served from the same origins, such as Google Images, send the same values, so a Referer match counts that traffic too.
• Blank Referers are normal. Private browsing, anti-fingerprinting protections, some new-tab behaviour, native search widgets that hand off to a browser, and privacy extensions can all remove the header.
• Only count landing pages. Browsers also send a Referer for images, CSS and JavaScript, but that value is your own page URL, so log analysis should look at document requests only.

On mismatches with Search Console, Google lists privacy settings and consent choices, client-side redirects that replace the Referer with your own URL, redirects that drop query parameters such as gclid, redirects that send a stricter Referrer-Policy header, different measurement methods (a click versus a page that loaded and ran its tag) and paid traffic mixed into analytics totals.

What we checked

We confirmed two details on Google's own pages and then measured the two redirect problems the new page describes.

• The policy is live. The google.com homepage we fetched on 12 November carries a <meta name="referrer" content="origin"> tag, matching the documentation.
• "A local Google domain" covers a lot of hosts. Google's own supported domains list held 187 entries when we pulled it, from .google.com to .google.ad. A log filter written only for www.google.com will miss most of them; matching any host that starts with www.google. and appears on that list is safer.
• Stricter policies on redirects are rare. Across 517 redirect responses in our crawl, only 6 sent no-referrer or same-origin, the two values that strip a cross-site Referer. They came from 4 of the 389 homepages that redirected.
• Dropped parameters are not rare. 108 of those 389 redirect chains (27.8%) ended on a URL that no longer carried the gclid value we sent.

To check that a stripping header really hides Google as the source, we loaded the four stripping homepages in headless Chromium with a Google Referer. On three of them (gandi.net, lencr.org and threema.ch) document.referrer came back empty after the redirect. The fourth, trendyol.com, served the browser a shorter redirect path and kept the Google value, as did our controls, wikipedia.org and github.com.

Longer redirect chains lose more parameters

Most redirecting homepages (287 of 389) needed only one hop, typically from the bare domain to www or to a language path. Losses rose sharply once a second hop was involved.

Even the simplest case is not safe: 39 of the 258 homepages that ended on the www version of the same domain still lost the parameter on the way.

Referrer-Policy sent on the redirect response	Redirect responses	Strips a Google Referer?
No header	467	No (browser default applies)
strict-origin-when-cross-origin	22	No, keeps the origin on HTTPS
no-referrer-when-downgrade	14	No, on HTTPS
strict-origin, origin, origin-when-cross-origin, unsafe-url	8	No, on HTTPS
same-origin	3	Yes
no-referrer	3	Yes

How each value behaves is defined in the W3C Referrer Policy specification, which also lets a policy delivered on a redirect response change the Referer the browser sends to the next URL.

Why it matters now

Referer-based attribution has come under pressure from several directions in recent weeks. We reported when Gemini dropped its utm_source tag after three weeks, and covered a Search Console click spike in which 82% of one site's clicked queries ranked beyond page two. Google's new page does not change how Search sends traffic; it documents behaviour that analytics teams have had to reverse-engineer, and it gives them an official reference when explaining gaps between Search Console and analytics to clients. For the analytics side of that explanation, Google keeps a separate guide to data discrepancies between Google Analytics and Search Console.

The page also follows Google's warning that CDN moves can swamp origin servers, another piece of monitoring advice rather than a policy change.

What SEO teams should do

1. Fix the host match in log filters. Match the Referer host against Google's supported domains list plus the android-app://com.google.android.googlequicksearchbox/ prefix, and count only HTML document requests.
2. Audit redirect chains on landing pages. Request your top landing URLs with a test parameter (for example ?gclid=test) and confirm it survives every hop. Two-hop chains, such as the bare domain to www and then to a language folder, lost the parameter about half the time in our sample; collapse them into one hop.
3. Check the Referrer-Policy on redirects, not just pages. A no-referrer or same-origin header on a 301 or 302 hides Google as the source on the next request. Security headers added at the CDN or load balancer are the usual culprit.
4. Replace client-side redirects. JavaScript and meta refresh redirects can swap the Google Referer for your own URL. Use server-side 301 or 308 redirects instead.
5. Set expectations. Treat Search Console as the source of truth for clicks and queries, and expect analytics to show fewer organic sessions, with some landing in direct.

Methodology

On 12 November 2026 (17:17 UTC) we took the top 1,000 domains from the Tranco list (ID PY2NJ) and requested https://[domain]/?gclid=slbtest123 with a desktop Chrome user agent and a https://www.google.com/ Referer, following up to ten redirects by hand and recording each hop's status code and Referrer-Policy header. 502 domains returned an HTML page with status 200; the rest failed, blocked us or returned errors and were excluded. A chain counted as losing the parameter when the final URL's query string no longer held gclid=slbtest123 as its own parameter (cases where it survived only inside another encoded parameter count as lost). The browser check used Playwright with Chromium, loading each homepage with a Google Referer and reading document.referrer. Google's referrer meta tag and the supported domains list were fetched the same day.

Conclusion

Google's new page confirms what many log analysts assumed: Search sends only its origin, never the query, and plenty of legitimate visits arrive with no Referer at all. The part site owners control is what happens after the click. In our crawl, stripping Referrer-Policy headers on redirects were rare, but lost parameters were common, and a second hop more than doubled the risk. A redirect audit is the cheapest way to narrow the gap between Search Console and analytics.

Questions and answers

What Referer does Google Search send?

Google Search uses the origin referrer policy, so the Referer contains only the scheme and host, such as https://www.google.com/ or a local Google domain. Clicks from the Google app on Android can arrive as android-app://com.google.android.googlequicksearchbox/https/www.google.com, according to Google's documentation.

Does the Google Referer include the search query?

No. Google's documentation says the Referer header does not include the query the user typed and directs site owners to the Search Console Performance report for query data.

Why do analytics sessions not match Search Console clicks?

Google lists privacy settings, consent choices and ad blockers, client-side redirects, redirects that drop query parameters, redirects that send a stricter Referrer-Policy, different measurement methods and paid traffic as common reasons.

How often do redirects drop tracking parameters?

In our 12 November crawl of 502 top-site homepages, 108 of the 389 that redirected (27.8%) lost a gclid test parameter. The rate was 20% for one redirect and 49% for two.

###