The rush to install the secure SSL protocol on our websites has grown recently, and much of the blame lies with Google and its latest algorithm tweak, which gives “less consideration” to sites that don’t use this secure protocol when exchanging user data with the server.
With this change, many eCommerce managers have started to notice that their analytics don’t add up when it comes to the source of visits that eventually converted. In other words, since installing SSL on their online store’s domain, Google Analytics (wrongly) reports that their sales referrers are payment gateways such as PayPal, RedSys or others.. rather than the real sources (Adwords, affiliates, organic search traffic, direct links from mailings, etc..)
In this article we’ll show how to configure Google Analytics to exclude specific sources as referrers, such as PayPal or RedSys, for an eCommerce with SSL, so your analytics stay accurate and you can determine with certainty where the visits that convert in your store come from.
The referrer problem in Google Analytics conversions
As the example above shows, most transactions were listing PayPal and RedSys as their source, even though this information is clearly wrong. So what’s going on? Or better yet, the question should be: why is this happening now when it didn’t before?
The explanation lies in the HTTP protocol definition itself, which states that referral information must not be sent when navigating from a secure HTTPS site to an HTTP site without that protocol.
As we can read on Wikipedia https://es.wikipedia.org/wiki/Referer_(Cabecera_HTTP):
If a website is accessed over a secure connection (HTTPS) and a link points to a non-secure location, the referrer field information is not sent.
And in the HTTP protocol definition itself https://tools.ietf.org/html/rfc2616#section-15.1.3, specifically in section 15.1.3:
Clients SHOULD NOT include a Referrer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol. (Clients must not include a referrer header field in a non-secure HTTP request if the referring page was transferred over a secure protocol).
In short, what was happening before is that PayPal, RedSys and other payment gateways used the secure HTTPS protocol, but when returning to the online store via a non-secure URL (HTTP), the referrer information wasn’t sent in the headers, so Google Analytics kept the referrer it had previously assigned to the visitor.
To understand what’s happening:
- Google starts a new session every time someone arrives at your online store from another website
- In a normal purchase process, a user arrives at the store, adds something to the cart and then goes to pay on the secure payment gateway (PayPal, RedSys, others…)
- After completing the transaction, they return to the online store
Because someone arrived at the store from another site (PayPal, RedSys or others…), Google Analytics counts this visit as a new session. This means the payment gateway is assigned as the acquisition source for the transaction, since it was the last site visited before reaching the online store and completing the purchase.
Can this be fixed?
It’s not so much a fix, since it isn’t actually an error, but rather a configuration so our analytics work the way we need, by changing how Google interprets sessions in our store.
First, we assume you’re using Google Universal Analytics. If so, go to the Google Analytics admin section and sign in. Once there, select the account you want to change.
Go to the middle column (property), Tracking Info, and open the referral exclusion list.
Make sure to add paypal.com, sis.redsys.es and/or any URLs wrongly showing up as referrers in transactions.
Session settings in Google Analytics
To be 100% sure this works, even if the connection drops temporarily, a user spends too long on the payment gateway or for any other reason, you can extend the session timeout in your Google Analytics settings. To do this, go back to the middle column (property), Tracking Info, and open the session settings section.
The default is usually 30 minutes, but it can be extended up to a maximum of 4 hours.
Conclusion
By adding these domains to the referral exclusion list, no new session is created when someone returns to our store from one of these domains after paying. Instead, the user’s session keeps its original source information and the transaction is credited to the correct source.
After making this configuration change, future transactions will once again show the correct traffic sources converting in our online store, which are essential for performance analysis and for creating new online marketing campaigns.
