Old HTTP Links Can Hide AI Referrals: Check Your Landing Pages

Yes, a visit from an AI assistant can lose its referrer when the link points to an insecure address. That visit then lands in your direct traffic, and your AI referral count looks smaller than it is. The fix is simple: make sure every address that AI answers might cite begins with https.

This post explains the browser rule behind the gap, shows you how to test for it, and gives you a short routine to keep your numbers cleaner.

The Rule That Removes the Referrer

When a visitor clicks a link, the browser can tell your site where the click came from. That information travels in a request header named Referer. The name is a historic misspelling, and it is the field your traffic report reads to label a visit as coming from an AI assistant.

Browsers decide how much to send using a referrer policy. According to MDN Web Docs, the default policy is strict-origin-when-cross-origin. For a click that moves from one secure site to another, the browser sends the origin of the source page, such as its domain name.

The same documentation says the browser sends nothing when a link goes from a secure page to an insecure one. In MDN's example, a link from an https page to an http address carries no referrer at all. The source is secure, the destination is not, and the header is dropped.

Why This Matters for AI Visits

An assistant that shows a source link is usually running on a secure page. If the link it shows points to an http version of your page, the browser follows that rule. Your server sees a visit with no referrer, and your report files it under direct.

This is a quiet error. Nothing breaks, the visitor still reaches your page, and the page may even redirect to https right away. But the referrer was already dropped at the first step, so the redirect cannot bring it back.

The result is a lower AI referral count and a higher direct count. If you read those two lines side by side, you may decide AI answers send you little traffic when the real number is higher.

Where Old HTTP Addresses Come From

Most sites moved to https years ago, yet old http addresses still circulate. An assistant can pick up an address from any page it has read, including old directory listings, press mentions and archived copies of your own pages.

Common sources include:

• Business listings and profiles that you created before you installed a security certificate.
• Old blog posts or news items on other sites that link to your http address.
• Printed or emailed links that were later copied onto web pages.
• Internal links, canonical tags or sitemap entries on your own site that still say http.

You control the last item fully, and you can often edit the first two. The third is the hardest to change, so focus on what you can fix.

A Five-Step Test You Can Run This Week

1. Ask real questions. Open two or three AI assistants and ask questions a customer would ask about your service or business. Write down every link that points to your site.
2. Read the full address. Copy each link and check whether it starts with https or http. Note the exact page too, because older pages are more likely to carry old addresses.
3. Check your own signals. Open your sitemap, your canonical tags and your main navigation. Confirm each address uses https and your preferred domain name.
4. Look at direct traffic by landing page. In your report, filter direct visits and list the top landing pages. Compare them with the pages you saw cited in the assistants.
5. Record the result. Keep a dated note of what you found and fixed, so you can explain later changes in your report.

If a cited page shows high direct traffic and an http address, you have a likely match. It is not proof, but it is a strong clue worth acting on.

What You Can Fix and What You Cannot

Fix your own pages first. Update internal links, canonical tags and sitemap entries to the https version. Then ask the owners of outside listings to update their links to your https address, starting with the ones you control.

A server redirect from http to https is still worth having. It protects visitors who arrive by an old link, and it helps search engines settle on one version of each page. Just remember that it does not recover the referrer for a visit that already lost it.

You cannot fix every case. Some assistants and apps send no referrer for reasons unrelated to https, and some visitors copy a link and paste it into a new tab. That is why a careful reader treats an AI referral count as a floor, not a total.

A Common Mix-Up About Referrer-Policy

Many owners hear about the Referrer-Policy header and assume they can set it to receive more data. They cannot. Your header controls what your pages send to other sites when a visitor leaves. It has no effect on what arrives when someone comes to you.

The policy that matters for inbound visits belongs to the page that holds the link. You do not control it, so your best move is to make the destination address secure and consistent.

Separate This From Bot Traffic

This problem concerns human clicks that lose their label. It is different from automated fetches. OpenAI's crawler documentation states that ChatGPT-User is not used to crawl the web automatically, and that because users start those actions, robots.txt rules may not apply.

That means a fetch by an assistant on a person's behalf appears in your server logs, not in your referral report. Keep the two sets of numbers apart. A click from a person with a missing referrer and a fetch by a user-triggered agent are different events with different fixes.

Turn the Findings Into Decisions

Once you have checked your cited pages, use the results to guide a few concrete actions.

• If cited pages carry http addresses, update your own links and request fixes on outside listings.
• If direct traffic drops on those pages after the fix and AI referrals rise, note the shift in your report.
• If nothing changes, your gap likely comes from apps that send no referrer. Record that as a known limit.
• Keep prioritizing the pages that assistants cite most often, because they already earn attention.

Avoid claiming a precise share of AI traffic from this exercise. You can say how many visits you can see and which causes of loss you have removed. That is an honest statement, and it holds up when someone questions the numbers.

A Monthly Routine in Fifteen Minutes

Repeat the test once a month. Ask the same questions, check the cited addresses, and scan your sitemap and canonical tags for any http entries that crept back in.

Add one line to your report each month: how many cited addresses used https, and how many did not. Over time that line shows whether your fixes are working. It also reminds readers that the visible AI count is a minimum, shaped by rules you can partly control.