Ping-To
The HTTP Ping-To request header is sent with a hyperlink auditing request to identify the destination URL being navigated to.
Usage
The Ping-To header is part of the HTML Standard's hyperlink
auditing feature. When a user clicks a link with the ping
attribute, the browser sends POST requests to the URLs listed in
the ping attribute. These requests include Ping-To to specify the
destination URL and Ping-From to specify the source
page.
The ping attribute exists to let servers track link activation without relying on redirects or JavaScript event handlers. The browser handles the entire process. The hyperlink audit requests run in the background, separate from the main navigation. The user moves directly to the linked page while the auditing requests complete asynchronously.
The Ping-To header contains the full URL of the hyperlink target. This allows tracking servers to record where the user navigated and correlate the destination with the source page in Ping-From.
Hyperlink auditing is supported by Chromium-based browsers and Safari. Firefox includes the capability but ships it disabled by default. Different browsers implement varying privacy controls around the ping attribute. Some block cross-origin ping requests by default or require secure contexts.
Values
Destination URL
The value is the full URL of the hyperlink target. The URL
includes the scheme, host, path, and any query string or fragment
identifier from the href attribute.
Example
A user clicks a link pointing to
https://external.example.re/resource on a page with a
ping="https://analytics.example.re/track" attribute. The browser
sends the navigation request to the destination and a separate
POST request to the analytics endpoint.
POST /track HTTP/1.1
Host: analytics.example.re
Ping-From: https://news.example.re/article/123
Ping-To: https://external.example.re/resource
Content-Type: text/ping
Always present on an audited click
Ping-To accompanies every hyperlink audit. The
browser answering a click on a link carrying a
ping attribute issues a POST with
Content-Type: text/ping, a fixed four-byte body
reading PING, and Ping-To naming the link's
destination. The destination of the clicked link,
not the ping endpoint, which is the reading most
descriptions invert.
The companion Ping-From follows referrer logic, present unless an HTTPS page pings a different origin, while Ping-To survives every case. Cookies travel with the ping, credentials mode is include by design, and the browser discards whatever the endpoint answers, so redirects and response bodies achieve nothing.
Coverage is broad and permanently incomplete. Chromium-based browsers and Safari ship auditing enabled, Chromium without a user-facing toggle, while Firefox has kept the feature off by default for the mechanism's entire life, capping delivery at one ping per click even when enabled. The specification hands every browser permission to ignore ping URLs outright, so missing pings carry no signal, and analytics built on the mechanism undercount by whatever share the abstaining browsers hold.