Dark Social Attribution: Tracking Word-of-Mouth Traffic

Dark social is traffic from private sharing (messaging apps, Slack and Discord, email, DMs and plain conversation) that arrives without a referrer, so analytics files it under Direct. You can't track it perfectly, but you can attribute much of it with four methods: treat Direct visits that land on deep pages as likely shares, make the links people share carry UTM tags, ask “How did you hear about us?” at signup, and line up traffic spikes with the mentions you can see.

For many SaaS products, word of mouth is the best channel they have and the one their dashboard shows least. This guide explains why it disappears, how to estimate its size from data you already collect, and how to report it honestly, as a range rather than a made-up precise number.

What is dark social traffic?

Dark social is the share of your traffic that comes from people passing links to each other through channels analytics can't see: a link pasted in a WhatsApp group, a Slack message from a colleague, a Discord server, an email forward, a text message. The visit is real and was referred by someone, but the browser doesn't say by whom, so it lands in the same bucket as people who typed your URL. The glossary entries for dark social and direct traffic have the short definitions.

The term comes from Alexis Madrigal's 2012 article in The Atlantic, written after he found that a large share of the site's social traffic came through these invisible channels rather than through public social networks. Since then, private sharing has grown, and browsers have become stricter about what referrer information they send.

Why does word-of-mouth traffic show up as Direct?

A referrer is the address of the page a visitor came from, sent by the browser with the request. When a link is opened from an app rather than a web page, there often is no page to report. Modern browsers also default to a referrer policy (strict-origin-when-cross-origin) that sends only the origin of the referring site, not the full URL, and nothing at all when going from HTTPS to HTTP.

Paste a referrer or a tagged URL into the referrer channel checker to see how a given visit would be classified.

How much of your Direct traffic is really dark social?

Look at where Direct visitors land. People who genuinely type your address or use a bookmark go to short, memorable URLs: the homepage, the login page, the app. Almost nobody types /blog/how-to-track-stripe-revenue-by-utm-campaign from memory. A Direct visit that lands on a long, deep URL almost certainly came from a link someone shared.

In this example, a reasonable estimate is that 30% to 35% of Direct traffic is dark social (most of the 1,050 deep-page entries, minus some docs bookmarks), and that the real number is somewhat higher, because some shared links point at the homepage too. That range is far more useful than either “Direct is 40% of our traffic” or a precise-looking figure produced by a model nobody can explain.

Method 1: how do you make shared links carry their source?

You can't add a referrer to someone else's WhatsApp message, but you can control many of the links people share:

• Share and copy-link buttons on your content that add utm_source=share and utm_medium set to the channel (whatsapp, slack, email) to the URL they copy.
• Invite links from inside your product, tagged with utm_source=invite, so team invitations are their own channel instead of Direct.
• Referral or affiliate links with a unique campaign value per referrer.
• Links in your own emails, onboarding sequences, docs and social bios, tagged consistently so your own channels stop inflating Direct.
• Vanity URLs for spoken mentions (example.com/podcast) that redirect to a tagged URL.

Generate the tagged versions with the UTM builder. A copy-link button can be as small as this:

function copyShareLink(channel: "slack" | "whatsapp" | "email") {
  const url = new URL(window.location.href);
  url.searchParams.set("utm_source", "share");
  url.searchParams.set("utm_medium", channel);
  url.searchParams.set("utm_campaign", url.pathname.split("/").pop() || "home");
  navigator.clipboard.writeText(url.toString());
}

Not every share will go through your button, and that's fine. The tagged shares give you a sample of which pages get shared and through which apps, which is often enough to know what to write more of.

Method 2: should you ask “How did you hear about us?”

Yes. Self-reported attribution is the only method that captures recommendations with no link at all, and it costs one optional field. A worked, illustrative example: of 200 signups in a month, analytics credits 70 to Direct. The same 70 people answered the signup question like this:

• Use a short list plus “Other (tell us)”, so answers can be counted and surprises still show up.
• Put the options in a random or neutral order; the first option gets picked more often.
• Store the answer with the account and send it as a trait or event property, so it can be broken down alongside measured sources.
• Treat it as a second opinion, not ground truth. People forget, and they credit the last thing they remember. Where self-report and first-touch data disagree, both are partly right.

If you run cookieless analytics, carry the measured first touch into the signup as well, so you can put both answers side by side; how to track signups by traffic source without cookies shows the setup.

Method 3: how do you connect traffic spikes to mentions?

Word of mouth often arrives in bursts: someone influential mentions you in a newsletter, a podcast episode goes out, a thread in a private community picks you up. You can't see the private part, but you can see its footprint: a jump in Direct entries to a specific page, often paired with a rise in branded searches, on a specific day.

1. 1.Watch daily Direct entries per landing page, not just the site total. A spike concentrated on one page has one cause.
2. 2.Check branded search impressions in Search Console for the same days.
3. 3.Look for the public tip of the iceberg: a Hacker News thread, a post, a newsletter issue that mentions you.
4. 4.Log known mentions with dates, so next month's review can match spikes to events.

VisitTrack's Mentions tab automates part of step three: it polls Hacker News for terms you track (your product name, your domain) every hour and shows each mention next to the traffic it produced. Bluesky is available where the deployment has it configured; the details are in the mentions setup docs. Private channels stay private, which is the point of them.

Method 4: how do you turn word of mouth into a measurable loop?

The most reliable way to measure word of mouth is to give it a mechanism. Team invitations, referral programs, public share pages (a public dashboard, a report a user can send to their boss) and “made with” badges all turn private recommendations into tagged, attributable visits. They don't capture everything, but each one moves a part of dark social into a channel you can measure and improve.

How should you report dark social in a channel review?

Combine the methods into one estimate and present it as a range, next to the measured channels. Continuing the example for the month's 200 signups:

This view changes decisions. A founder who saw 70 Direct signups and nothing labeled word of mouth might conclude that only search and communities work. The adjusted view says the single biggest channel is people recommending the product, which argues for investing in the things that create recommendations: a better onboarding for invited teammates, share features, and a product worth talking about. For deciding between measured channels, see which marketing channels bring paying customers.

What should you not do to track dark social?

• Don't fingerprint visitors to stitch devices together. It is intrusive, legally risky in the EU, and unreliable.
• Don't reassign all Direct traffic to a channel with a rule of thumb and present it as measured.
• Don't make the “How did you hear about us?” field required; forced answers are noisier than skipped ones.
• Don't over-tag. Adding UTMs to internal links between your own pages overwrites the real source of the visit.