Guidescope: How Optional "Referer" Blocking Works

How Optional "Referer" Blocking Works

What are "Referers"?

Whenever you click on a hyperlink to go to a new Web page, your browser automatically sends the URL of the page you came from to the next Web site. The URL of the page you came from is known as the "referer" and is passed in the "header", a hidden part of the conversation between your browser and the Web server providing the new page. ("Referer" is a misspelling that somehow became a codified part of the HTTP protocol.)

Why does this matter?

Sometimes Web sites encode part of the information you have provided them in the URL of the page that you are on. A common example of this is search engines. Most search engines present the results of a search on a customized page whose URL contains the words that you searched for. For example, if you used www.myfavoritesearcher.com to search for "referer filtering", you might be given the results on a page whose URL is:

http://www.myfavoritesearcher.com/search?q=referer+filtering

When you click on one of the search links, this URL is sent to the new page, thereby "leaking" to it the fact that you were searching for "referer filtering". While this example might not seem like a serious leak, there have been cases where personal financial data was leaked like this. For example, see the CNET article here.

How do you (optionally) block Referers?

The default behavior is to pass referers unchanged. (Earlier versions of the Guidescope service automatically replaced referers by default. When more and more websites required valid referers before they would provide content, the default was changed.)

You can block referers by using the optional Configuration File to filter referers, either removing them from the header or replacing them in the header.

Removing referers from the header works for many sites, but some sites won't serve all of their content if the referer is missing. For example, some weather sites use the referer to make sure that you are loading their weather maps as part of one of their pages. If the referer is missing, they won't serve the map.

The second option, replacing the referer in the header with the URL of the current request, satisfies Web sites that refuse to serve content unless the referer is their own site, while still effectively removing the referer information from the header. However, even this filtering technique won't satisfy all web sites.

If you have enabled referer filtering and find that you can't access a particular page unless blocking is off, then you should consider not filtering referers.

If you do filter referers using the configuration file options, then referers will be filtered whenever ad blocking is on. When ad blocking is off, all optional referer filtering is also turned off.

SSL and Referers

To protect your privacy and maintain security, Guidescope does not block referers or examine data streams associated with pages of Internet sites that use SSL (Secure Sockets Layer), an option commonly used on order forms that collect personal information such as credit card numbers.