Why do Google, Discord or Stripe show up as a traffic source?

What happens on the way back

A login with an outside account is a round trip. Your page sends the visitor to the provider’s sign-in page, they approve, and the provider sends them back to a page on your site. A checkout on Stripe’s hosted page works the same way: out to checkout.stripe.com, then back to your success page.

The browser tells the page they land on where the click came from. With the default referrer rule, that is the provider’s address (MDN: Referrer-Policy). To your analytics, it looks exactly like somebody arriving from Google’s account page, from Discord, or from Stripe.

Two things go wrong from there:

• The visit is counted twice. Many tools start a new visit whenever a page arrives from another site, so one person becomes two visits, the second one “from” the provider.
• The signup gets the wrong source. You usually record the signup on the page they land on after logging in. If your tool reads the source from that page, every signup made through Discord login is credited to Discord, whatever brought the person in the first place.

How to fix it

1. Keep the visit going when someone comes straight back. If the visitor was on your site a few minutes ago, a return from another site is the same visit, not a new arrival. Tools that keep a session id can check for it. Only a link with campaign tags (UTM parameters or an ad click id) should start a new visit.
2. Ignore pages nobody finds you from. Sign-in and checkout pages (accounts.google.com, appleid.apple.com, login.microsoftonline.com, checkout.stripe.com, your auth provider’s own domain) are never where somebody discovered your product. Most analytics tools have a list of referrers to exclude; add them there.
3. Use the first touch for signups, not the current page. Store where the visitor first came from when they arrive, and give that to the signup. The page after a login has nothing useful to say.
4. Keep your own domains out of the list. If your app lives on app.example.com and your site on example.com, a click from one to the other is not a referral either.

Discord and GitHub are harder than Google: people really do find products through them. You can’t exclude them outright without losing real visits, which is why the session check in step 1 matters more than any list.

Check your own numbers

Look at your sources for the week after you added a social login. If a login provider suddenly appears as a top source, and its visits land on your app’s first page after sign-in, you are looking at round trips, not new visitors.

With Nordva Launch

Launch’s script treats a return within a live session as the same visit, whatever the referrer, so a signup after a Discord or Google login keeps the source the visit started with. Only campaign links start a new visit. Without cookies there is no session to go on, so the collector also leaves out known sign-in and checkout hosts and your own domains. Discord and GitHub stay counted in that case, because they can’t be told apart from a real visit.