Why is my direct traffic so high? Start by removing yourself

What does direct traffic mean?

Direct traffic is every visit your analytics could not tie to a source. Google Analytics files a visit as direct when its source is "(direct)" and its medium is "(none)" or "(not set)". In practice, the browser passed no referrer and the link carried no campaign tag. People typing your address land there, and so does everything else that arrives without a label.

So a high direct number tells you how much you cannot see. It says nothing yet about brand strength or loyal fans.

What causes high direct traffic?

Five things put most visits into direct. Each one leaves a different trace in your data, which is how you tell them apart.

Cause	What it looks like in your data
Your own visits (you, your team, signed-in users)	Repeat visitors, many pages per visit, product or admin pages
Links you shared without a tag	Visits to deep pages (a blog post, pricing) right after you posted or emailed
Private apps (WhatsApp, Slack, Discord, email apps, PDFs)	Same as untagged links, often on mobile
Bots and automated checks	One page, usually the homepage, desktop, in bursts
Typed visits and bookmarks	Homepage, more than one page, returning visitors

Private apps lose the source most often. In a 2023 test, SparkToro and Really Good Data sent 1,113 visits to test pages from social networks and messaging apps, then recorded what analytics showed for each one.

App	Share of visits recorded as direct
TikTok, Slack, Discord, Mastodon, WhatsApp	100%
Facebook Messenger	75%
Instagram DMs	30%
LinkedIn (public posts)	14%
Pinterest (public posts)	12%

Apps change how they pass links, so treat this table as a guide and test your own share paths in check 5 below.

How do I find out what is in my direct traffic?

Run these five checks in order. Each one removes a slice you can explain, so what remains gets smaller and clearer.

1. Take your own visits out. Find the visitors who loaded admin, settings or product pages, or filter by your office IP. Recount the direct share without them. If it moves a lot in either direction, every number you read before was skewed by you.
2. Check sign-in and payment redirects. List the referrers on visits that do have a source. A sign-in page (such as accounts.google.com) or a checkout page showing up as a source means people returning to your site after logging in or paying are being counted as new arrivals. Add those hosts to your referral exclusion list.
3. Split by landing page. Of the direct visits left, count how many start on the homepage and how many start on a deep page. Direct visits to a deep page usually came from a link someone shared, so they point at untagged links and private apps.
4. Split by pages viewed. Count one-page visits separately from visits that went further. Many one-page homepage visits on desktop usually mean bots and quick curiosity checks. Visits of three pages or more are most likely people reading.
5. Test your share paths. Send yourself a link to your site through WhatsApp, Slack, an Instagram DM and your email app. Click each one and look at how your analytics labels the visit. Any visit that arrives as direct is a blind spot you now know about.

What did we find when we ran this on our own site?

We ran the five checks on our own site, analystzero.co, and the result went the opposite way to what we expected. How we counted: every visit over six weeks, 8 September to 17 October 2026, judged by the first page of the visit. "No source" means no referrer, no source and no campaign tag were recorded.

Check 1, taking ourselves out, made direct look worse.

Visits	Share of all visits	Share with no source
All visits	100%	75%
Our team and signed-in product users	53%	59%
Outside visitors only	47%	92%

A handful of browsers, belonging to us or to signed-in users, made more than half of all visits. They also made most of the visits that did have a source, which is why removing them pushed the no-source share up from 75% to 92%.

Check 2 explained where those sourced visits came from. Almost none of them came from marketing.

Source recorded	Share of visits with a source	What it was
Google sign-in page	76%	People coming back to the site after logging in
X (t.co)	11%	Mostly outside visitors from posts
Gmail app	8%	Signed-in users opening a report email
Google search	5%	Visits straight to the signup and login pages

Among outside visitors, only 7% arrived from a channel we could name: posts on X and Google search.

Checks 3 and 4 described the outside visits with no source. 91% landed on the homepage, 85% viewed one page only, and 82% were on desktop. Nearly every one came from a different browser.

That pattern fits bots and quick curiosity checks better than shared links. Shared links tend to land on deep pages and on phones, and we saw very little of either. We cannot prove the split without more data, so we treat those one-page visits as noise until a signup tells us otherwise.

Which direct visits should I worry about?

Use this table on your own direct visits. Find the row that matches, then do what it says.

The direct visit	Most likely cause	What to do
Loads admin, settings or product pages	You, your team or existing users	Exclude them from every report
Comes right after a sign-in or checkout	A redirect counted as a source	Add the host to referral exclusions
Lands on a deep page	A shared link without a tag, a private app or an email app	Tag the links you share; ask new signups where they heard of you
Lands on the homepage, 2 or more pages	Typed visit, bookmark or bio link	Keep it; it is real interest you cannot trace
Lands on the homepage, 1 page, desktop, in bursts	Bot or quick check	Leave it out of decisions; watch for spikes

To tag a link, add three labels to the end of it. Keep one spelling per channel so the reports group cleanly:

https://yoursite.com/pricing?utm_source=linkedin&utm_medium=social&utm_campaign=oct-launch

How much direct traffic is normal?

There is no fixed normal share, and small sites with few tagged links can sit far above published averages, as ours did. One analytics vendor reported a median direct share of 29% across its customers in the 30 days to 2 August 2026, with the middle half between 16% and 46%. It did not publish how many sites that covered.

Our own site sat at 75%, and 92% for outside visitors. On a site with a few hundred visits a month, a handful of bots or one busy team member can move the share a lot. Compare yourself with your own last month, after taking yourself out, rather than with a benchmark.

When does this advice not work?

These checks get weaker in four situations, and you should know them before you trust the result.

• Small sites. On a young site a single afternoon of bot traffic changes the picture, ours included, so read the pattern and ignore the decimal points.
• One person, several browsers. Analytics counts browsers, not people. Our team's browsers may belong to fewer people than they suggest, and a visitor who switches from phone to laptop counts twice.
• No way to confirm bots. We do not store full browser details, so the bot reading in our worked example is an inference from landing page, device and pages viewed.
• Old test data. The SparkToro test is from 2023. Apps change how they pass links without notice, which is why check 5 asks you to test your own share paths.

What should I do this week?

Start with check 1: take your own visits out and recount. It is the quickest check, and it changes every other number you look at.

Then, for the next 30 days, tag every link you share in posts, emails, bios and messages, and add one question to your signup form: "Where did you hear about us?" At the end of the month, run all five checks again and compare the share and the answers side by side.