Referral traffic is the stream of visitors who land on a site after clicking a link from another service, such as a search engine, social platform, email client, or partner website. It is one of the clearest ways to measure how users move through the web, because the referrer indicates where the visit began and often what kind of content or preview drove the click.
In cyber security, referral traffic matters because attackers and defenders both use it. Phishing kits, malvertising, and redirect chains can send victims from one site to another, hiding the real source of the visit. Security teams also watch referral patterns for signs of bot activity, traffic spoofing, or abuse of trusted platforms. On the defensive side, publishers and incident responders use referral data to detect suspicious spikes, understand exposure from search or social previews, and decide whether to tighten crawl, snippet, or sharing controls. When referral traffic drops sharply, it can signal a change in discovery, filtering, or access policy.