sporely.
Get started free

Why Do Your Best Leads Show Up as Direct Traffic?

By Görkem Sarptunalı · Last updated · 6 min read

Key takeaways

  • In GA4, a session counts as direct when the source is "(direct)" and the medium is "(none)" or "(not set)". It's a "we don't know" bucket.
  • Untagged links in your own emails, PDFs and decks are usually the biggest fixable share.
  • Links shared in Slack, WhatsApp or forwarded emails rarely carry a referrer. This is often called dark social.
  • Apple's Mail, Messages and Safari Private Browsing strip click IDs like gclid, but standard UTM tags survive.
  • In long B2B cycles, the converting visit is often a return visit. Read the first touch, not only the last.
Where did they really come from? Three small mushrooms labelled email, chat and app send faint trails toward a box labelled direct and none. The trails fade before they arrive: direct traffic is what analytics records when the trail is lost, not proof that people typed the URL. Where did theyreally come from?Direct means "we don't know",not "they typed our URL".EmailChatApp(direct)(none)? View full size

The monthly report looks great until someone asks where the demo requests came from. Half of them say direct. A colleague offers the kind explanation, that people know the brand and type the address in, and the room nods because nobody has a better one. If your company is small and few people know its name, that explanation deserves a second look.

What "direct" really means

Google Analytics files a session under the Direct channel when its source is exactly "(direct)" and its medium is "(none)" or "(not set)" (Google's default channel group rules). Google's own description is people arriving "via a saved link or by entering your URL", and that does happen. The catch is in how the label is assigned: GA4 only knows a visit was direct because it found nothing else, no referring site and no campaign tags.

So direct is less a channel than a gap in the record. Typing the URL is one way into that gap, and there are at least five others that look identical in the report.

Where the trail goes cold

Where the trail goes cold Six cards: shared in a private chat, untagged links you sent, opened inside an app, referrer stripped, click IDs removed, and came back later. Each card names where it happens and the fix, such as tagging links with UTM parameters, serving pages over HTTPS and reading first touch. Where the trail goes coldSix common reasons a known visitor lands in (direct) / (none), and the fix for each.1Shared in a private chatSlack, WhatsApp, a forwarded emailAsk "how did you hear about us?"2Untagged links you sentNewsletters, PDFs, decks, signaturesAdd utm_source, medium, campaign3Opened inside an appEmail clients and in-app browsersTag the links; never rely on referrer4Referrer strippedHTTPS to HTTP, strict referrer policiesServe every page over HTTPS5Click IDs removedApple Mail, Messages, private browsingKeep UTMs; they survive6Came back laterLinkedIn first, a bookmark laterRead first touch, not only the last View full size

Someone sees your post, copies the link and drops it into a team Slack channel, a WhatsApp group or an email to their boss. The person who clicks arrives with no referrer at all. Alexis Madrigal named this "dark social" in a 2012 piece for The Atlantic after noticing how much of the magazine's "direct" traffic couldn't plausibly be people typing long article URLs (background on the term). In B2B, where buying decisions pass through several people, a lot of your best traffic travels this way.

Your newsletter, the PDF a salesperson attached, the link in your email signature, the QR code on an event banner. If those links carry no campaign tags, many of the clicks land in direct. This is the share you can fix today. Google recommends always setting utm_source, utm_medium and utm_campaign whenever you tag a link, because missing values show up as "(not set)" in reports (Google's guide to campaign URLs).

Desktop email clients, and many links opened from within mobile apps, don't pass a referring site to your page. The visit happened because of an email, but analytics can't see the email. The fix is the same as for your own links: don't rely on the referrer, put the source in the URL.

4. Referrers stripped by the browser

Browsers decide how much of the referring page to share. The default policy today is strict-origin-when-cross-origin, which sends no referrer at all when someone moves from an HTTPS page to an HTTP one (MDN on Referrer-Policy). If any page in your funnel, a landing page or an old microsite, still runs on HTTP, the source disappears right there.

5. Click IDs removed

Since iOS 17, Apple's Link Tracking Protection removes tracking parameters from links shared in Messages and Mail, and from links in Safari Private Browsing (Apple's announcement). The targets are identifiers that point to a person, such as the click IDs ad platforms add. Standard UTM tags like source, medium and campaign are not the target, which is one more reason to tag links yourself rather than relying on a platform's click ID alone.

6. They came back later

This one isn't a tracking fault at all. A buyer reads your post from LinkedIn in March, comes back by typing your address in April, and requests a demo. A report that only credits the last visit says direct, even though LinkedIn started it. With a sales cycle measured in months, the converting visit is often the third or fourth, and the later visits are the most likely to be direct.

How to get the source back

You won't get direct to zero, and you shouldn't try. The goal is to shrink the part that's actually yours to fix and to read the rest with the right expectations.

  1. Tag every link you control. Newsletters, sales emails, PDFs, decks, social posts, partner placements, event QR codes. Use the same lowercase values every time; "LinkedIn" and "linkedin" become two sources.
  2. Keep tags through redirects. Link shorteners and tracking redirects sometimes drop the query string. Click your own links and check the final URL in the address bar.
  3. Measure across domains. If your forms or checkout live on another domain, set up cross-domain measurement, or the second domain will start a new session with no source.
  4. Serve every page over HTTPS. One HTTP page in the path is enough to lose the referrer.
  5. Ask people. Add a free-text "How did you hear about us?" field to your demo or contact form. It's the only method that sees the Slack message and the podcast mention.
  6. Read first touch in your CRM. Most CRMs record where a contact first came from. HubSpot, for example, keeps an Original Traffic Source property with two drill-down levels for detail like the campaign or the entrance URL (HubSpot's guide).

What it usually means, at a glance

What you seeLikely causeWhat to do
Direct rises the week a newsletter goes outUntagged email linksTag every newsletter link
Direct converts far better than other channelsReturn visits from people who found you elsewhereCompare first touch with last touch
Direct spikes after a post gets shared widelyDark socialAsk how people heard about you
A paid campaign shows clicks but few conversions, while direct growsClick IDs stripped or tags lost in a redirectAdd UTMs to the ad's final URL and test the link
Direct jumps on one landing pageThat page breaks the chain (HTTP, another domain)Fix HTTPS and cross-domain measurement

Common traps

  • Treating direct as brand strength. Some of it is, but you can't tell how much from the direct number alone. Compare it with branded search and with the self-reported answers on your forms.
  • Tagging internal links. UTM tags on links between your own pages start a new session and overwrite the real source. Only tag links that bring people in from outside.
  • Judging a campaign on last touch alone. If the campaign's job was to start conversations, its credit often sits in first touch while direct takes the last.
  • Fixing the report instead of the links. Reclassifying direct into "probably organic" in a spreadsheet makes the chart prettier and the decision worse.

Quick Q&A

What is direct traffic in GA4?

A session whose source is "(direct)" and medium is "(none)" or "(not set)", meaning Google Analytics found no referring site and no campaign tags for it.

Why is my direct traffic so high?

Usually because of untagged links in your own emails and documents, links shared privately in chat or email, apps that don't pass a referrer, and buyers returning days after their first visit.

Does direct traffic mean people typed my URL?

Sometimes, but not mostly. It means analytics couldn't see where the visit came from. Typing the URL is one of several causes that look the same in the report.

Standard UTM tags like utm_source, utm_medium and utm_campaign are not what Link Tracking Protection removes; it targets parameters that identify a person, such as ad click IDs.

How do I find out where direct visitors really came from?

Tag the links you control, add a "How did you hear about us?" field to your forms, and read the first-touch source your CRM records alongside the last visit.

Keep reading

More from the blog