Mountain View
Analytics

Why was more than half of this site’s traffic labeled Direct?

GA4 said just over half of August sessions were Direct. I worked out what was inside that number so the marketing team could read its acquisition report again.

Tell me what you're working onSee what it showed
Client
A business compliance services provider
Service
Analytics audit
Systems
GA4, Google Tag Manager, HubSpot
When
August to September 2026

How much of Direct was marketing traffic?

The same August sessions, before and after setting aside customer portal visits and two traffic groups that looked automated.

Direct was just over half of sessions.Direct was under 40% of sessions in this view.

What was mixed into Direct

Portal visits

Existing customers signing in. Real visits, but not marketing acquisition.

CountedSet aside
Two uniform groups

Same location, browser and screen size, day after day. Likely automated.

CountedSet aside
Everything else

Marketing and other visits. The traffic the team needs to read.

Kept

What this view is for: showing how much those groups shaped the report, with every exclusion written down.

The question

A large Direct share usually means GA4 doesn’t know where visitors came from. Here, existing customers signing in to their account portal and some odd traffic patterns were mixed in with marketing visits. Nobody could say how much of that half was real marketing traffic, so the acquisition report couldn’t guide decisions.

What I did

  1. Built 24 GA4 explorations across three reports to break the traffic down.
  2. Separated customer activity using the sign-in, password and dashboard pages only customers use.
  3. Compared location, browser, operating system, screen size, landing page and day. Two very uniform traffic groups stood out as likely automated.
  4. Ruled out the obvious causes. I tested the server-side tagging in Tag Manager preview and on the live site, checked the HubSpot pop-ups, and compared dates with the team’s own site crawler. None of them explained the pattern.
  5. Compared session acquisition with first-user acquisition, because the two answer different questions.

What it showed, and what stayed open

What it showed

  • With portal visits and the two suspicious groups set aside, Direct fell from just over half of sessions to under 40% in that view.
  • The team got a written explanation of why the raw acquisition report needs a caveat, and a view they can read.
  • Along the way, purchase tracking checked out. Revenue and purchase type were filled in reliably from September 9.

What stayed open

  • The source of the suspicious traffic wasn’t confirmed. Likely automated is as far as the evidence goes.
  • The under-40% figure is the share under these exclusions. It isn’t the site’s true Direct share.
  • Direct stayed high in first-user acquisition.
  • GA4 revenue still didn’t match the internal finance tracker. The definitions and date ranges need to line up first.
Granite outcrops and patches of snow among pines, with forested hills under a bright sky.

Is a number in your reports hard to explain?

Tell me which report, which number, and what your team is trying to decide with it.

Tell me what you're working on