Direct traffic isn't what you think it is
Direct sounds like people typing your address. Mostly it means the browser never said where the visit came from, and that covers chat apps, email, PDFs, AI assistants and, quite often, you.
6 min read
In this article
Earlier this month our own site, lomenanalytics.com, had a small spike over two days. Nothing dramatic, but enough to go looking for the cause. Almost all of the increase, around 94% of it, was Direct: no referrer, no campaign tag, nothing to go on.
Then we looked at which pages those visits went to. One visitor accounted for 36 pageviews on the first day and 30 on the second, mostly dashboard and settings pages, a couple of which only an admin can open. The spike was us, testing our own product.
It's a good example of what Direct really is. It isn't a source. It's the absence of one.
What Direct actually means
When you click a link, your browser usually tells the next site where you came from. That's the referrer, and it's what analytics tools use to fill in your list of sources. If the link also carries utm_ tags, the tool reads those as well. A visit that arrives with neither gets filed as Direct. Google Analytics calls it (direct) / (none), which is more honest: there's no source, and no medium.
So Direct doesn't mean “typed the address”. It means “arrived without saying where from”. Typing the address is one way that happens. There are a lot of others.
When the browser says nothing
Browsers have become much more careful with referrers. Since around 2020 the major browsers default to a policy called strict-origin-when-cross-origin, which in practice means three things:
- A link from another site on HTTPS sends only the domain. You see reddit.com, not which thread.
- A link from an HTTPS page to an HTTP address sends nothing at all.
- A site can switch referrers off entirely with a no-referrer policy, and some do.
And anything that isn't a web page (an app, a mail client, a PDF reader) usually has no referrer to send in the first place.
Where the click happened
What the browser sends
Filed as
A link in a thread on reddit.com
Referer: https://www.reddit.com/
Referral: reddit.com
A link in Slack, WhatsApp or a mail app
Referer: (none)
Direct
A link on an https page to an http:// address
Referer: (none)
Direct
A link in a ChatGPT answer, tagged utm_source=chatgpt.com
Referer: often nothing
AI assistant, from the tag
What's usually inside it
Here's what usually ends up in there.
People who know you
Typed addresses, bookmarks and the address bar finishing your domain for them. This is the Direct traffic everyone imagines, and it mostly lands on your homepage.
Chat apps
Slack, Discord, WhatsApp, Teams, iMessage. Links shared in apps open in the browser with no referrer, so private word of mouth (sometimes called dark social) shows up as Direct. On a lot of sites this is the biggest part of it.
Mail apps on phones and desktops don't send a referrer. Webmail sometimes does, so you might see mail.google.com as a source, and the same newsletter can turn up in two places in one report.
Documents and the offline world
PDFs, slide decks, a link in a printed brochure, a QR code on a poster. None of them can tell the browser where the click happened.
AI assistants
The ChatGPT app often opens links without a referrer. ChatGPT usually adds utm_source=chatgpt.com to the links it hands out, which rescues many of those visits, but only if your tool reads utm_source. There's a separate guide on finding visits from ChatGPT and other assistants.
Old http:// links
Any link to http:// your site from a page on HTTPS arrives with nothing. Old profiles, directory listings and your own early blog posts are the usual suspects.
You
Checking your own site, testing a form, showing it to someone over coffee. On a small site this can be a surprisingly big share, as we found out.
Bots that run JavaScript
If your tool doesn't filter them out, headless browsers almost always arrive with no referrer and go straight into Direct.
Read Direct by where it lands
You can't recover a referrer that was never sent. But where people land says a lot about how they got there.
Nobody types yoursite.com/blog/how-we-cut-our-aws-bill. If a long, specific address gets fifty Direct visits in a day, someone shared it somewhere you can't see: a Slack workspace, a group chat, a newsletter read in a mail app. Direct visits to your homepage, on the other hand, are mostly people who already know you.
Direct visits by landing page, last 7 days
Illustration, not real data
- /412
People who know you: typed, bookmarked, autocompleted.
- /blog/how-we-cut-our-aws-bill183
Nobody types this. Someone shared it where you can't see.
- /pricing96
Returning visitors, comparing before they decide.
- /docs/install58
Customers with the page bookmarked.
- /admin44
You, probably.
Timing helps too. Direct visits that arrive within minutes of something you did (sent the newsletter, posted in a Discord server, published a video) very likely came from it. When we posted a video recently, four visits with no referrer arrived within ten seconds of it going up. We can't prove where they came from. We'd still bet on it.
How to make the bucket smaller
Most of Direct you can't fix, and you shouldn't try. But links you control, you can label before they leave:
- Tag every link you put somewhere that won't send a referrer: your newsletter, your email signature, PDFs, QR codes, podcast show notes and bio links in apps. Here's a simple naming system for UTM tags that keeps the reports readable.
- Change old http:// links to https://, on your own pages and on any profile you can still edit.
- Stop counting yourself. Use a separate browser profile for working on your own site, or your tool's setting for ignoring your visits if it has one.
- Check that your redirects keep the query string, so a tagged link that passes through a redirect still arrives tagged.
What's left is fine
After all that, Direct will probably still be one of your biggest sources, and that's fine. A good part of it is word of mouth that happened somewhere private: people recommending you in places you'll never see. You can't measure the conversation, but you can watch the total.
If Direct grows along with everything else, people are talking about you. If it grows on its own, check the landing pages first and yourself second.
Lomen reports Direct as Direct and doesn't try to guess. It does read utm tags and recognise AI assistants before it gives up on a visit, and if you ask Lomen AI why a particular day was busy, it breaks that day down by source and landing page, Direct included. Which is exactly the question we were asking about our own spike.