Affiliate Privacy · Referrer Leaks

Your Affiliate SubIDs Are Leaking Through Referrer Headers — Here's How to Cloak Them

Published June 2026 · 8 min read · By the TraceNull Team

If you're an affiliate marketer, SubIDs are the backbone of your optimization. They tell you which page, which button, which ad creative, which audience segment drove a conversion. They're your competitive edge — and they're being handed to merchants, affiliate networks, and competitors on a silver platter through the HTTP Referrer header.

This isn't a theoretical risk. It's happening on every single click right now unless you've taken explicit steps to prevent it. Let's break down exactly how SubID leakage works, why it's devastating for your business, and how to seal the leak permanently.

What Are SubIDs and Why Do They Matter?

SubIDs (also called sub-affiliate IDs, tracking tokens, or click IDs) are custom parameters appended to affiliate links to help you track performance at a granular level. A typical affiliate URL with SubIDs might look like this:

Each sub parameter encodes a piece of your strategy:

• sub1: Which landing page variant is performing
• sub2: Which placement or CTA button was clicked
• sub3: The traffic source (paid search, social, email, etc.)
• sub4: The device or geo segment
• sub5: The audience niche or angle

This data is your playbook. It's months of split-testing, thousands of dollars in ad spend, and the exact formula for what converts. And it's leaking.

How the Referrer Header Exposes Your SubIDs

When a visitor clicks an affiliate link on your page, the browser sends an HTTP Referer header to the destination. That header contains the full URL of your page — including every query parameter, fragment, and path segment.

But here's the part most affiliates miss: the referrer doesn't just leak your page URL. It leaks the affiliate link URL itself when redirects are involved.

Here's the chain of events:

Who Can See Your Leaked SubIDs?

The exposure is wider than you think:

Why rel="noreferrer" Alone Isn't Enough

Many affiliates have heard the advice: just add rel="noreferrer" to your links. While this is a good start, it has serious limitations:

• It only works on standard anchor tags. JavaScript-triggered redirects, form submissions, and dynamically injected links often bypass it.
• It's a client-side hint, not a guarantee. Some browsers and browser extensions don't fully respect it in all redirect scenarios.
• It doesn't protect server-side redirects. If your link goes through a 301/302 chain, the Referrer header propagates at the HTTP level — before the browser even renders the page.
• You can't add it to links you don't control. Affiliate links embedded in emails, PDFs, or third-party platforms won't carry your rel attributes.

The 3-Layer Referrer Stripping Approach

TraceNull was designed specifically for this problem. Every link processed through TraceNull is stripped of referrer data using three independent, redundant layers:

Layer 1: Node.js Application Headers

The application server sets the Referrer-Policy: no-referrer header on every response. This instructs the browser to send zero referrer information when the user is redirected to the destination URL.

Layer 2: Caddy Reverse Proxy Headers

Even before the application responds, the Caddy web server injects its own Referrer-Policy headers. This creates a fallback in case the application layer is bypassed or misconfigured.

Layer 3: HTML Meta Tag

For edge cases where headers are stripped by intermediary proxies or CDNs, TraceNull's redirect pages include a <meta name="referrer" content="no-referrer"> tag — ensuring the browser receives the no-referrer instruction regardless of what happens at the HTTP level.

The result: the merchant sees a direct visit with zero referrer data. No page URL. No SubIDs. No traffic source hints. Nothing.

How to Cloak Your Affiliate SubIDs with TraceNull

Here's the practical workflow:

Your SubIDs still reach the affiliate network for attribution and reporting. The merchant's analytics see a clean, referrer-free visit. Your strategy stays yours.

Advanced Protection for Serious Affiliates

TraceNull's Business plan includes features specifically designed for affiliate operations at scale:

• Custom domains: Use your own branded domain instead of tracenull.cc so links look native to your brand and don't raise flags with compliance teams.
• API access: Programmatically generate cloaked short links from your ad management scripts, landing page builders, or automation tools.
• Password-protected links: Restrict access to high-value offer links so only your team or approved partners can use them.
• 365-day TTL: Evergreen affiliate links that won't expire mid-campaign.
• Privacy-safe analytics: See click counts and performance data without storing IP addresses or personally identifiable information — staying fully GDPR compliant.

What About Postback URLs and Server-to-Server Tracking?

A common question: "If I'm using server-to-server (S2S) postback tracking, am I already safe?"

S2S postbacks protect the conversion data exchange between you and the network — but they do nothing about the initial click. The Referrer header is sent by the browser on that first click, long before any postback fires. So even with a fully server-side conversion pipeline, your SubIDs are still exposed at the point of click unless you strip the referrer.

A Quick Audit: Are Your SubIDs Leaking Right Now?

You can check in under two minutes:

1. Open your browser's Developer Tools (F12) and go to the Network tab
2. Click one of your affiliate links on your live site
3. In the network log, find the first request to the affiliate network's domain
4. Inspect the request headers — look for the Referer header
5. If it contains your page URL, your SubIDs, or any query parameters: you're leaking

If you see anything other than an empty or absent Referrer header, your competitive intelligence is being broadcast to every server in the redirect chain.

Stop Giving Away Your Playbook

You spend real money and real time figuring out which angles work, which audiences convert, and which creatives drive ROI. Your SubIDs encode all of that intelligence. Letting it leak through the Referrer header is like leaving your campaign dashboard open on a public screen.

Referrer stripping isn't a nice-to-have privacy feature — for affiliate marketers, it's operational security.