Re: how we use referer header to track users

deepak wrote:
"how we use referer header to track users"

"We" don't. Referer is easy to spoof. And "users" don't like being
tracked without asking them.

What you want to do is probably either evil (such as denying access to
stuff based on source URL) or better done another way (such as with a
session cookie and a server side session such as a "shopping cart", to
persist session state). The one legitimate use I can think of is finding
out which links internal to your site are heavily used and who's
referring you traffic. You'll get semi-reliable statistics on the latter
just by collecting referer[sic] headers and dumping the ones with your
own domain name, then examining the rest, probably as a histogram by
domain name. What you'll probably find is that the top referrer is
Google. :)

For internal link-usage, your safest bet is to not rely on spoofable
headers at all, and instead to note sequential page accesses by a single
IP. If 121.102.133.234 accesses page A at 15:11, then page B at 15:12
and page C at 15:14 and A links to B and B links to C, you can guess
that those two links were used once each by a user. This kind of
chaining lets you build up a histogram of usage of your internal links
per month, which may be useful for guiding changes to the site's
navigation design. Anywhere people go to but don't follow internal links
from is somewhere they either jump offsite, find to be a dead end, or
consider to be an actual destination. The middle of the three, and maybe
the former, could indicate users are having trouble navigating your
site. Even this data, though unaffected by referrer spoofing, is going
to have wonkiness due to browser caches -- in the example above, the
user may actually have back-buttoned from B to A, then followed a direct
link (if one exists) from A to C. Referrers can be combined with
timestamps and URLs to try to figure out these cases, but ultimately,
your best bet in figuring out your navigation and any needed changes is
to explicitly user-test the site. See http://www.useit.com/alertbox/ and
browse around there for information on user testing sites.

Ultimately, the only real use of referrers not either better covered by
something else or better avoided altogether is to figure out what
external sites are referring you how much traffic. Even then, take the
results with a grain of salt because it's easy to spoof the header and
users will often do so, even without technical knowledge, by using
browser-privacy plugins or by using proxies that whitewash their
browsetrails.