Direct traffic

Not a channel.
A missing referrer.

Direct traffic is every visit that reached your site without a referrer, the note a browser sends to say which page a click came from. In GA4 it shows as (direct) / (none). Some of it is what the name says: people typing your address or opening a bookmark. Much of the rest is referred traffic that lost the note on the way: links opened from chat and email apps or PDFs, links from https pages to http ones, and sites that send no referrer at all. The shared-link part has a name: dark social. Below: each cause from the browser’s own rules, how GA4 counts it, an explainer that sorts your direct landing pages, and how to shrink the part that isn’t really direct.

Explain my direct traffic Why it’s so high

By the Builderify team

Illustration · Four ways to arrive at example.com, and what analytics can see.
01 / What it is

What is direct traffic?
A visit with no referrer.

When you click a link, the browser usually tells the next site where you came from, in a request header spelled Referer (a misspelling the web has kept since the 1990s). Analytics reads that, or the page’s document.referrer, to name the source. When it’s empty, there’s nothing to name, and the visit goes in the Direct pile.

A click on a web pageHas a note
GET /blog/celadon-glaze-recipe
Host: example.com
User-Agent: Mozilla/5.0 …
Referer: https://forum.example.net/
Analytics files it asReferral: forum.example.net
A tap in a chat appNo note
GET /blog/celadon-glaze-recipe
Host: example.com
User-Agent: Mozilla/5.0 …
Referer: —
Analytics files it asDirect: (direct) / (none)
Really direct

People who already know the way

Typed addresses, bookmarks, the address bar’s suggestions, a saved home-screen icon. Returning customers, regular readers, you and your team. Mostly the home page and short addresses.

Referred, but the note got lost

Somebody sent them, and it doesn’t show

Links in chats, emails and PDFs, links from https to http, sites that send no referrer on purpose, redirects that strip it. Mostly deep pages that nobody would type, which is how you tell the two apart.

02 / Why so high

Why is my direct traffic so high?
Seven ways to lose a referrer.

Browsers send less than they used to. MDN calls strict-origin-when-cross-origin “the default policy if no policy is specified”: the full address within your own site, only the origin (https://forum.example.net/) to other sites, and nothing at all from https to http. Inside those rules, these are the usual reasons a visit arrives empty.

  1. 01

    Typed, bookmarked, autocompleted

    Really direct

    Someone types your address, picks it from the address bar’s suggestions, or opens a bookmark. No page sent them. MDN: the referrer “is an empty string if the user navigated to the page directly (not through a link, but, for example, by using a bookmark)”.

    Tell-tale  The home page and short addresses; people who already know you.

  2. 02

    Links opened from apps

    Referrer lost

    A link tapped in a chat or email app, or clicked in a PDF or a desktop document, opens in the browser with no web page behind it. To your analytics that looks exactly like a typed address. This is the part called dark social.

    Tell-tale  Long, deep addresses that nobody would type.

  3. 03

    From https to http

    Referrer lost

    The default policy sends nothing “to less secure destinations (HTTPS→HTTP)”. A link to http://yoursite arrives empty, and the redirect to https afterwards can’t put the referrer back.

    Tell-tale  An old link, a signature or a profile that still says http://.

  4. 04

    noreferrer and no-referrer

    Referrer lost

    The site that links to you can send nothing on purpose. rel="noreferrer" tells the browser to “omit the Referer header” for that link; a Referrer-Policy: no-referrer header does it for a whole site.

    Tell-tale  A partner or directory that links to you, yet never appears as a source.

  5. 05

    Redirects with their own policy

    Referrer lost

    A server redirect normally keeps the page the click came from as the referrer. But the Fetch standard lets each redirect response set its own referrer policy, so a hop through a tracker or shortener that says no-referrer leaves the visit with nothing.

    Tell-tale  Links that pass through someone else’s redirect on the way.

  6. 06

    Privacy settings

    Referrer lost

    Chrome 85 (2020) and Firefox 87 (2021) send only the origin to other sites by default, which trims the referrer but keeps the site. Firefox also lets people change the default policy, so a visitor who sets it to send nothing arrives as Direct.

    Tell-tale  Spread thinly across every page; there’s no landing-page pattern.

  7. 07

    Bots and scripts

    Not people

    A script that fetches your page has no page to come from. GA4 removes known bots automatically, using Google research and the IAB’s International Spiders and Bots List, and you can’t see how many it removed. The rest get through.

    Tell-tale  Data-centre networks, one-page visits, odd hours.

Email deserves its own note: a click in a mail app usually arrives with no referrer, and opens are no better a guide, as the guide to Apple Mail Privacy Protection explains. Tag the links in what you send, and the clicks stop being Direct.

03 / Dark social

What is dark social?
Shares you can’t see.

Dark social is sharing that happens where analytics can’t see it: a link pasted into a chat, an email, a text message. The visit is real and someone sent it, but it arrives with no referrer, so it lands in Direct.

The term is Alexis Madrigal’s, from an October 2012 piece in The Atlantic: “this vast trove of social traffic is essentially invisible to most analytics programs. I call it DARK SOCIAL.” Chartbeat, The Atlantic’s analytics provider, had singled out traffic that “goes deep into the site without a referrer”, on the reasoning that people aren’t dutifully typing in long URLs. As The Scholarly Kitchen summed up his numbers a week later, nearly 57% of The Atlantic’s social traffic was dark social, and 69% across a set of media sites Chartbeat looked at.

Those figures are from 2012 and from news sites; yours will differ. The method still works, and it’s the one the explainer below uses.

People type this11 characters
example.com
Nobody types this71 characters

example.com/blog/2026/10/celadon-glaze-recipe-for-beginners-step-by-step

So when an address like this arrives as Direct, somebody sent it: a chat, an email, a document.

Home page
Typed or bookmarked
Short address
Probably typed
Deep article
Shared: dark social

Illustration · The address is the clue.

04 / In GA4

Direct traffic in Google Analytics:
(direct) / (none).

GA4’s Direct channel has one rule: the source is exactly (direct) and the medium is (none) or (not set). No referrer and no campaign tags gives you that pair. What GA4 does next with returning visitors matters more.

One visitor, two visits, three reports
What happened GA4 Traffic acquisition GA4 User acquisition Builderify Journey
Visit 1
Finds you in Google search		 google / organic google / organic Google
Visit 2
Types your address a week later		 google / organic carried over google / organic first source, kept Direct first touch still Google

Illustration · GA4 columns follow Google’s description of traffic-source scopes; Journey’s from its code.

Returning visitors keep their source

For session-scoped dimensions, the ones in Traffic acquisition, Google says GA4 “uses the paid and organic channels last click attribution model” and that “sessions initiated by direct entrance are attributed to the UTM values for that user.” A returning visitor who types your address is credited to where they last came from, if GA4 still recognises them.

And Direct gets no credit for key events

“All attribution models exclude direct visits from receiving attribution credit, unless the path to key event consists entirely of direct visits.” So GA4’s Direct is the hard core: people with nothing better on record, such as new visitors, a new device or cleared cookies.

Where to find your direct landing pages

Google defines the landing page as “the page path and query string associated with the first pageview in a session”, so tags and click IDs survive into the report, which is what the explainer needs.

  1. 01

    Open the report

    In GA4, Reports › Engagement › Landing page. If it’s missing, an Editor can add it back to the menu.

  2. 02

    Add the source

    Add Session source / medium as a secondary dimension, then search or filter for (direct) / (none).

  3. 03

    Copy the rows

    Landing page and sessions, one per line, into the explainer. A CSV export works too: it reads the first number after each address.

Tagged your links and now see Unassigned instead? That’s “the value Analytics uses when there are no other channel rules that match”: usually a utm_medium GA4 doesn’t recognise. Weighing up whether to stay on GA4 at all? The guide to Google Analytics alternatives compares what each tool does with sources.

05 / Explainer

What’s in your direct traffic?
Paste the landing pages.

One landing page per line, path or full URL, with the number of direct sessions after it. The explainer sorts each into what it most likely was, totals them, and says what to do first. It runs in your browser; nothing is sent anywhere.

Like /blog/post 1,240 or https://example.com/, 87. No number counts as 1. Up to 200 lines.

Or load a sample
25%
Probably really direct
75%
Referred, referrer lost

7,080 sessions across 10 landing pages.

59% of these visits land deep in the site, on addresses nobody types: links shared in apps, chats and email.

  • Typed or bookmarked 1,545 · 22%
  • Returning or hand-off 210 · 3%
  • Shared link (dark social) 4,185 · 59%
  • Tagged, referrer lost 1,020 · 14%
  • http:// downgrade 120 · 2%
Landing pageSessions · verdict
  • /blog/how-to-choose-your-first-kiln
    2 levels deep, 35 characters
    2,310
    Shared link
  • /blog/celadon-glaze-recipe-for-beginners
    2 levels deep, 40 characters
    1,875
    Shared link
  • /
    The home page
    1,240
    Typed or bookmarked
  • /?utm_source=newsletter&utm_medium=email
    Tagged utm_source=newsletter
    640
    Tagged, no referrer
  • /blog/glaze-guide?fbclid=IwAR2F4-dbP0l7Mn1
    Meta click ID (fbclid)
    380
    Tagged, no referrer
  • /pricing
    Short enough to type
    210
    Typed or bookmarked
  • /account/login
    A login or account page
    150
    Returning user
  • http://example.com/blog/old-kiln-review
    Loaded over http://
    120
    http:// downgrade
  • /about
    Short enough to type
    95
    Typed or bookmarked
  • /checkout/thank-you
    A cart, checkout or thank-you page
    60
    Back from paying

What to do, biggest share first

59%
Shared link (dark social)

Tag what you share

Links you post in groups, chats, emails, bios and PDFs arrive without a referrer. Put utm_source, utm_medium and utm_campaign on them, or give each place its own short link so its click count tells you which one it was. You can’t tag what other people share, but now you can see its size.

14%
Tagged, referrer lost

The source was in the link all along

These addresses carry campaign tags or click IDs. GA4 reads the utm_ parameters, and gclid when Google Ads is linked; click IDs from other platforms, such as fbclid, aren’t among them. Builderify User Journey reads none of them as a source, though a page goal can count them. And a tagged link copied out of an email carries its tags wherever it’s pasted, so some of these are shares too.

2%
http:// downgrade

Close the http gap

Move every page to https and redirect http to it, then fix the links you control: email signatures, social profiles, old posts, PDFs. The redirect keeps the visitor; it can’t bring back a referrer the browser already dropped.

3%
Returning or hand-off

Leave the comebacks out of the judgement

Login, account, cart and thank-you pages are where people return to, not where they find you, and many come from a bookmark, an app or a payment page. Judge acquisition on the other rows. If checkout or thank-you pages lead, the cross-domain guide covers payment pages you don’t host.

22%
Typed or bookmarked

This part is the real thing

Home page and short addresses: people who know your name or kept the bookmark. Nothing to fix. It’s the share you’d want to grow.

+ How the explainer decides

Each line gives an address (anything starting with http://, https:// or /, or a bare domain) and the first number after it. The same address twice is added up. Then the first rule that fits wins:

  1. http:// downgrade when a full address starts with http://. GA4 lists paths only, so paste full URLs to catch these.
  2. Tagged when the query has any utm_ parameter or one of: gclid, gbraid, wbraid, msclkid, fbclid, ttclid, mc_cid, mc_eid, _hsenc, _hsmi.
  3. Returning or hand-off when a part of the path is a cart, checkout or thank-you page (cart, basket, checkout, order, orders, order-received, order-confirmation, thank-you, thankyou, thanks, success, confirmation, receipt) or a login or account page (login, log-in, signin, sign-in, account, my-account, dashboard, admin, wp-admin, wp-login, members, member, portal, profile, settings, password, reset-password, unsubscribe, preferences, verify), with or without .php or .html.
  4. Shared when any other query string is left.
  5. Typed or bookmarked for the home page, /index, /home, a language root such as /en or /pt-br, or a single short word: up to 16 characters, one hyphen at most, no digits.
  6. Shared for everything else: deeper or longer addresses that people don’t type.

It’s a judgement from the address alone. A short page can be shared and a long one bookmarked; the totals are what to read, not any single row.

06 / Reduce it

How to reduce direct traffic
that isn’t direct.

You can’t make a chat app send a referrer. You can put the source into the link itself, close the gaps you own, and stop counting what isn’t a person.

  1. 01

    Tag every link you share yourself

    Emails, chats, PDFs, QR codes, social bios: anything that opens outside a web page. Google says to “always use utm_source, utm_medium, and utm_campaign”. Values are case sensitive, so keep them lowercase, and use a medium GA4 knows, such as email, or the session lands in Unassigned.

  2. 02

    Give each place its own short link

    When tagging every link is too fiddly, make one short link per place: one for the WhatsApp group, one for the PDF, one for your bio. The visit may still arrive as Direct, but the link that was clicked has already counted it. The affiliate click guide has a planner for the names.

  3. 03

    Read your direct landing pages

    Paste them into the explainer. The home page is people who know you; long article addresses are shares; tagged addresses are campaigns that lost their referrer.

  4. 04

    Close the http gap

    Serve every page over https, redirect http to it, then fix the links you control: email signatures, social profiles, old posts and PDFs. The redirect keeps visitors; only the https link keeps the referrer.

  5. 05

    Check your own sites

    If you run a blog and a shop on different domains, make sure neither sends no-referrer, and link them so a move between them isn’t a new arrival. The cross-domain tracking guide covers the setup, and the self-referrals that are its opposite problem.

  6. 06

    Take out what isn’t people

    Some direct traffic is automated. The bot traffic guide shows how to spot it before it skews your numbers.

  7. 07

    Keep the rest

    People who type your address or keep you bookmarked are the best visitors you have. A share of Direct that stays is a remembered brand, not a fault.

07 / With Builderify

Direct, visitor by visitor.
No guessing what’s inside.

Builderify’s User Journey names a visit’s source from its referrer and nothing else, so its Direct is exactly what this page describes: no referrer arrived. What it adds is the person behind the row. Open a direct visitor and you see the page they entered on, where they came from the first time, and every page after.

For the links you share, pair it with Short Links: one link per place, each counting its own clicks and recording the referrer whenever a browser sends one. Prices are on the pricing page: 250 free credits a month, then one-time packs.

How Journey labels a visit
  • (no referrer) Direct
  • https://www.example.com/blog/ Internal
  • https://example-shop.com/ (linked) Internal
  • https://www.google.com/ Google
  • https://www.linkedin.com/ LinkedIn
  • https://news.ycombinator.com/ Hacker News
  • https://substack.com/ substack.com

Illustration · From the labelling rules in Builderify’s code.

What Builderify does

  • A visit with no referrer is Direct. Your own site, its subdomains and your linked domains are Internal. Everything else is labelled by the referrer’s host, with names for the big ones such as Google, Bing, Facebook, Instagram, LinkedIn and YouTube
  • Each visit keeps its own source. A visitor who first came from Google and later types your address has a Direct visit, and their profile still shows Google as the first touch, with the full first referrer and landing URL
  • Which channels pay off sets Direct beside every other source: visits, goal conversion rate, bounce rate and pages per visit
  • The visitor list searches by source and landing page: search for Direct to see the people whose first visit had no referrer, each with the page they entered on
  • A page goal can match the address’s query, such as utm_medium equals email or fbclid is present. Goals read the full address even with Ignore query strings on, so tagged arrivals can still be counted
  • Visitors on VPNs and proxies and in data centres are flagged, so you can filter the direct visits that came from servers
  • Each new visitor costs 0.1 credits, out of 250 free each month

Know this first

  • No UTM support: tags don’t change a visit’s source, and there are no channel groups like GA4’s
  • Ignore query strings is on by default, so stored addresses drop ?utm_… and other parameters. Turn it off to keep them in landing URLs
  • No carry-over: a returning visitor’s typed visit counts as Direct, so Direct will look bigger than in GA4’s acquisition reports
  • Source names come from matching the referrer’s host against a short list, and a few hosts get the wrong name. A visitor’s profile shows the first referrer in full, to check against
  • It uses first-party cookies, so it isn’t cookieless. With Wait for cookie consent on, nothing is recorded until the visitor allows analytics
Questions

Direct traffic, before you ask.

Direct traffic is any visit that reached your site without a referrer, the header a browser sends to say which page a click came from. It includes people typing your address or using a bookmark, but also links opened from chat and email apps or PDFs, links from https pages to http ones, and sites that send no referrer on purpose.

Usually because referred visits lose their referrer on the way. Links opened in apps, emails and documents have no web page behind them, browsers send nothing from an https page to an http one, and some sites and redirects strip it deliberately. Look at the landing pages: long, deep addresses that nobody would type are shared links, not typed visits.

It is GA4's source and medium for a session with no referrer and no campaign tags: the Direct channel is source exactly (direct) with medium (none) or (not set). In the Traffic acquisition report, GA4 credits a returning visitor's direct session to their last non-direct source, so what stays Direct is mostly visitors with nothing earlier on record.

Dark social is sharing that analytics cannot see: links passed on in chat apps, email and text messages, which arrive with no referrer and are counted as direct. Alexis Madrigal named it in The Atlantic in October 2012, after spotting traffic that went deep into sites without a referrer.

Tag the links you share yourself with utm_source, utm_medium and utm_campaign, or give each place its own short link so its clicks are counted. Serve every page over https and fix old http links, check that your own sites do not send no-referrer, and filter out bots. What is left is people who know your address, which is worth keeping.

Sources

Read on 14 October 2026.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does