Why is GA4 direct traffic so high? Eight causes and how to find yours

Direct traffic in GA4 is the bucket for sessions that arrive with no recognisable source: no referrer, no UTM parameters, no click ID. Some of it really is people typing your address or using a bookmark. But when direct is a large share of your traffic, or it suddenly jumps, it's almost always attribution that was lost somewhere between the click and the session.

That matters because those sessions came from somewhere. An email, a paid social ad, a partner link, a QR code. When they're filed as direct, the channel that earned them looks weaker than it is, and the budget conversation goes the wrong way.

Here are the eight causes we see most often, how to recognise each one, and what to do about it.

How to tell what's in your direct traffic

Before guessing at causes, look at what direct sessions actually do. In GA4, open Reports → Acquisition → Traffic acquisition, filter to Session default channel group = Direct, and add these as secondary dimensions:

• Landing page. Real direct visitors mostly land on your homepage or a few well-known pages. Direct sessions landing deep in a campaign landing page or a blog post were almost certainly sent there by a link.
• Device category. A spike in mobile direct traffic often points to in-app browsers and messaging apps, which strip the referrer.
• New vs returning. Returning visitors are more likely to be genuine type-ins and bookmarks. Large numbers of new users arriving direct on deep pages are a strong signal of lost attribution.
• Date. A step change on a specific date usually lines up with a site release, a consent banner change or a new campaign.

If you'd rather not build the exploration by hand, export the report and run it through the GA4 Direct Traffic Diagnoser, which groups direct sessions by these patterns and points at the likely causes.

1. UTM parameters lost on a redirect

This is the most common cause. Your campaign link carries utm_source, utm_medium and utm_campaign, but before GA4 loads, a redirect rebuilds the URL without them. HTTP to HTTPS, www to non-www, trailing-slash rules, link shorteners, geo-redirects and marketing-platform click trackers can all do it.

When the parameters disappear before GA4 records the session, the session has no source, and becomes direct.

How to check: paste a real campaign URL into the UTM Loss Detector. It follows every redirect in a real browser and shows the exact hop where the parameters stop surviving.

Fix: preserve the query string on every redirect, and point campaign links at the final URL rather than one that redirects.

2. UTMs lost on the second page view

Even if the landing page records the campaign correctly, single-page apps, consent banners that reload the page, and scripts that "clean up" the address bar can drop the parameters before a later page view. If GA4 starts a new session at that point (for example after consent changes), it starts without a source.

How to check: the UTM Loss Detector follows one internal link after the landing page settles, because most attribution dies on the second page view, not the first.

Fix: store first-touch campaign parameters in first-party storage when the visitor lands, and make sure your consent setup doesn't reload the page in a way that starts a new session.

3. Links from apps, email clients and documents

Links opened from messaging apps, many mobile email clients, PDFs, desktop software and some social apps arrive with no referrer. Without UTMs, GA4 has nothing to classify them by.

How to check: look for direct sessions on mobile landing on the pages you link to from newsletters, social posts or sales emails.

Fix: tag every link you control with UTMs, including email signatures, PDFs, QR codes and social bios. The Bulk UTM Validator checks a whole list of tagged links for missing or inconsistent parameters before they go out.

4. Payment and booking handoffs

When visitors leave your site to pay (Stripe Checkout, PayPal, a hosted payment page) or to book (a scheduling tool), and then come back, the return can start a new session. GA4 may file it as a referral from the payment provider or, if the referrer is stripped, as direct. Either way, the purchase isn't credited to the campaign that brought the buyer.

How to check: look for direct or payment-provider sessions landing on your thank-you or success page. Run the Payment Referral Leak Checker on both sides of the handoff.

Fix: add payment and booking domains to GA4's list of unwanted referrals, and carry a session or order reference through the handoff.

5. Crossing between your own domains

If your marketing site, app, store or checkout live on different domains, a visitor crossing between them is a new visitor to GA4 unless cross-domain measurement is configured. The second domain often sees no referrer, or your own domain as the referrer.

How to check: run the Cross-Domain Attribution Checker with a starting URL that carries UTMs and the page on the other domain.

Fix: add all your domains to GA4's cross-domain configuration so the linker parameter carries the session across, and exclude your own domains as referrals.

6. Google Ads traffic without a working link

Auto-tagged Google Ads traffic arrives with a gclid rather than UTMs. If GA4 and Google Ads aren't linked, or the gclid is stripped by a redirect, those sessions can't be attributed to google / cpc and end up as direct or (not set).

How to check: the GCLID Checker follows an ad URL and shows whether the click ID survives and gets stored.

Fix: link your Google Ads and GA4 accounts, keep auto-tagging on, and make sure redirects preserve query parameters.

7. Bots and automated traffic

Bots usually send no referrer, so whatever bot traffic gets past GA4's filtering lands in direct. It tends to show as bursts of sessions with almost no engagement, odd locations or screen resolutions, and landing pages that don't make sense for people.

How to check: export sessions with engagement, location and device dimensions and run them through the GA4 Bot Traffic Detector.

Fix: block obvious bots at the edge (your CDN or firewall), and exclude the patterns you identify from reporting.

8. Your own team

Staff, agencies and QA testers who type your URL or open it from bookmarks all count as direct. On a small site, a handful of people visiting every day is a meaningful share of traffic.

How to check: the Internal Traffic Checker scans an export for internal, staff, test and staging markers.

Fix: define internal traffic in GA4 and activate the data filter (filters are created in testing mode and don't exclude anything until activated).

What about "dark social" and AI assistants?

Two growing sources of genuinely referrer-less traffic are worth knowing about:

• Dark social: links shared privately in messaging apps and DMs. You can't tag what other people share, but you can make your shareable pages and URLs carry UTMs when you post them yourself.
• AI assistants: visitors clicking links in chat assistants sometimes arrive with a referrer and sometimes without, depending on the app. If you see direct sessions landing on pages that assistants commonly cite, that may be part of it.

Neither can be fixed completely, which is another reason to fix the causes you can.

A sensible order of work

1. Diagnose the export to see where direct traffic lands and when it changed.
2. Trace the URLs behind the biggest landing pages: campaign links, email links, payment returns.
3. Fix redirects and storage so parameters survive the first and second page view.
4. Configure GA4: cross-domain, unwanted referrals, Google Ads link, internal traffic filter.
5. Re-check after each release, because the most common reason direct traffic jumps is a site change that nobody connected to analytics.

Direct traffic will never be zero, and it shouldn't be. The goal is for it to mean what it says: people who came to you directly.

FAQ

What percentage of direct traffic is normal in GA4? There's no universal benchmark; it depends on your brand recognition, channel mix and audience. What matters is whether direct sessions behave like real direct visitors (landing on your homepage, mostly returning) and whether the share changes suddenly.

Does GA4 attribute direct sessions to a previous source? In attribution reports, GA4 ignores direct when there's an earlier non-direct touch in the lookback window. Session-level acquisition reports still show the session as direct.

Can consent banners increase direct traffic? They can, if the banner reloads the page or starts a new session after consent and the original campaign parameters are lost in the process.

Why did direct traffic jump after a site redesign? Usually because new redirects, a new router or a new consent setup started dropping UTM parameters. Test your main campaign URLs with the UTM Loss Detector after every release.