Web browsers can send information to websites about clicks on links to them using “Referrers”. This can help websites identify where their traffic is coming from, but it can also bring privacy risks for the people doing the clicking.

By default, Mastodon asks web browsers not to send any information at all in Referrers.

On servers running Mastodon version 4.4.0 or newer, server admins are given the option to allow referrers to send the domain of the site where the click happened (such as example.com). If an admin activates this it would show sites being clicked on that their clicks came from that server, but would not by itself give any other kind of info.

The option for referrers is off by default, it will only be active if the admin switches it on. Each server admin has to decide for themselves if they activate it.

How can a Mastodon server admin activate referrers?

1. Log in with your admin account on your Mastodon server website
2. Click ⋯ More (if you’re on the mobile web click ☰ first)
3. Click Administration
4. Click Server Settings
5. Click Discovery tab at the top
6. Scroll down to Privacy section and tick the box marked Allow external sites to see your Mastodon server as a traffic source
7. Click Save Changes button at the bottom of the screen

What’s the case for switching on referrers?

By switching on link referrers, the admin will make all of their server’s clicks show up as coming from their server, and help give Mastodon visibility in click stats that it didn’t have before.

The optional referrer used by Mastodon just says the domain name of the server, it doesn’t by itself give any other information. It does not say who clicked a link, it doesn’t even say whether the person was a member of the server or a non-member who was just randomly browsing the server’s website.

What’s the case against switching on referrers?

By themselves domain referrers don’t give much information. The most significant problems come from sites that use cookies and other methods to track people across the internet. These kinds of data-hungry privacy-busting sites usually cross-reference their many different data sources to try to build up a picture of individuals they track.

If a link being clicked on belongs to a website that tracks people like this, identifying the domain in the referrer may tell the clicked site that a particular person has clicked on a link on that server’s website. They may then add this to their data on that individual.

Is there any way for individuals who don’t own servers to make their own decisions about this?

Yes. You can set your web browser not to send info through referrers at all, and this will override whatever websites or social networks tell them to do. Usually this is in the privacy settings of the browser and called something like “Strict protection” or similar.

What information does a referrer send about a click on Mastodon?

In the case of Mastodon, by default it asks browsers not to send any information in referrers.

The optional referrer setting available to admins would tell the browser to include the domain name of the server but nothing else. This is off by default.

Does one server’s decision about referrers affect clicks taking place on other servers?

No. As far as referrers go, federated posts are treated the same way as local posts, they’re all just links on the server’s website.

Why are Mastodon’s developers forcing domain referrers onto us?

They’re not, the domain referrer option is switched off by default. It’s your server admin who decides whether to activate domain referrers or not.

What about UTM codes in links? Don’t those show referrals from Mastodon? Why not just use those?

UTM codes are optional bits at the end of links that can be used to show where a click came from. However, they are relatively rare for Mastodon as they require the source of the link to include them. Also, quite often people either use another platform’s UTM code when sharing links or strip out all UTM codes completely.

HTTP referrers are more consistent in providing information about the actual source of clicks.

Back to the front page