Arrive

A person arrived on the site from a link in one of our posts.

The click a caption link used to count at the redirect, counted where only a person can make it: the site calls this once the page it opened is visible in a browser (not prerendered, not a background tab), once per post per browser session. Meta's link fetchers follow the redirect but do not run the page, so they never get here. Written as kind='click', via='arrival', which the dashboard counts (stats.SOCIAL_CLICK).

The body is parsed by hand rather than as a typed parameter, so it is read whatever content type it arrives with: navigator.sendBeacon with a plain string sends text/plain, and a beacon that is dropped is a lost click.

Refused with 403 when the browser says the call came from another site (Sec-Fetch-Site), so another page cannot post clicks on our behalf through its visitors. Older browsers send no such header and are let through: the count is anonymous and the post must exist, so the most a forger gets is a number on our own dashboard.