Direct traffic: what (direct) / (none) really means

"Direct" sounds like people typing your address. Some of it is. Most of it is not. In analytics, direct traffic is a leftover: every visit where the tool found no referrer, no UTM tag and no other clue about where the visitor came from.

In GA4 that leftover is source (direct) and medium (none) (Google). In Sporetag and most privacy-friendly tools it is "Direct / None". The label is the same idea: we do not know.

Where direct traffic really comes from

Referrer kept

Web page linkSends its origin

→

Your siteSource: that site

Referrer lost

App, email, chat, PDFOften sends nothing

→

Your siteSource: Direct

• Typed addresses and bookmarks. The real direct visits. Usually returning customers and people who heard your name somewhere you cannot track, such as a podcast or a conversation.
• Apps. A link tapped in an email app, a chat app, a desktop app or a PDF often opens the browser with no referrer at all. An email newsletter without UTM tags mostly shows up as direct.
• In-app browsers. Instagram, Facebook, TikTok and other apps open links in their own browser. Depending on the app and version, the visit may arrive with no referrer.
• HTTPS to HTTP. Browsers send no referrer from a secure page to an insecure one under the default referrer policy (MDN). If your site still loads over plain HTTP anywhere, links from secure sites lose their source.
• A strict referrer policy on the linking site. A site can choose no-referrer for every outgoing link. Some webmail and privacy-focused sites do.
• Lost tags. A redirect that drops the query string removes your UTM tags and click ids on the way. So do some link shorteners and some "clean URL" settings.
• Bots that request pages with no referrer, when a tool does not filter them.

What the referrer actually carries

Under the default policy, strict-origin-when-cross-origin, a link from one site to another sends only the origin, such as https://news.example.com/, not the full page address (MDN). So even when the referrer arrives, you know the site, not the article or the post. That is why a link you control should carry UTM parameters: they name the exact campaign and placement, and they survive where the referrer does not.

Why direct grows over time

• More traffic arrives through apps, where referrers are least reliable.
• Browsers trim more. Safari strips known click ids from links opened from Mail, Messages and Private Browsing (Apple).
• Brand grows. More people know your name and type it.

A rise in direct is not bad by itself. A sudden jump on one day usually is a tracking change: a redirect, a site migration, a new consent setup, or a campaign sent without tags.

How attribution tools treat direct

Most models refuse to give direct the credit when they know of anything else. GA4's models exclude direct visits from receiving credit unless every visit on the path was direct (Google). Shopify's default model is "last non-direct click" for the same reason (Shopify). A buyer who clicked an ad last week and typed your address today counts for the ad, if the tool still remembers the ad click.

That memory is the weak point. In a cookieless tool, the next day's visit is a new visitor, so it shows as direct. In a tool with a first-party id, Safari's 7-day cap on cookies set by script can end that memory early (WebKit).

Five ways to shrink direct traffic

1. Tag every link you control. Email, SMS, social bios, QR codes, partner links, podcast show notes. Any link without UTM tags that leaves an app becomes direct.
2. Use short links for anything people type or scan. A short link counts the click itself, then forwards with the tags, so a podcast mention or a printed code has a source even if the visit loses its referrer.
3. Fix redirects. Test your main landing pages with ?utm_source=test and confirm the tag is still there after every redirect, including http to https and www to the bare domain.
4. Serve every page over HTTPS and keep a referrer policy no stricter than the default.
5. Read the in-app browser. Some tools, Sporetag among them, name the source from the in-app browser or the Android app that opened the link when no referrer arrives. Check whether yours does before you assume direct means typed.

What not to do

• Do not tag your own internal links. A UTM tag on a link from your blog to your pricing page replaces the real source of that visit with your own tag.
• Do not treat direct as "brand". It is a mix of brand, untagged campaigns and lost sources. Compare it with branded search to see how much is brand.
• Do not chase zero. Some visits will always arrive without a clue. The goal is a direct share that is stable and explained.

Common questions

What is direct / none in GA4?

It is GA4's label for a session with no referrer, no campaign tags and no auto-tagging click id. Source is (direct) and medium is (none).

Is direct traffic good or bad?

Neither. It includes loyal customers typing your address, which is good, and campaigns that lost their tags, which is a tracking problem. Read the landing pages: direct visits landing deep on a campaign page are usually lost tags.

Why did direct traffic suddenly go up?

Look for a change on that day: a site migration, a new redirect, a consent banner, an email sent without tags, or a spike of bots. A gradual rise is normal. A step change is almost always technical.

Does email traffic show as direct?

Often, yes. Desktop and mobile email apps frequently send no referrer. Tag every email link with utm_source and utm_medium=email.

Sources

• Google Analytics Help: Default channel group, Get started with attribution. Checked October 2026.
• MDN: Referrer-Policy. Checked October 2026.
• Shopify: Marketing insights. Apple: Link Tracking Protection. WebKit: ITP 2.1.