GA4 inflates direct traffic when it loses referral information—usually because of missing UTM parameters, misconfigured redirects, or poor site tagging. Many e-commerce teams assume “direct” means users typed the URL, but in practice, most unexplained spikes point to technical issues. You can isolate the root cause by systematically checking campaign tagging, redirect behavior, tracking configuration, cross-domain settings, and traffic anomalies.
By the end, you’ll know how to pinpoint why your GA4 direct channel is absorbing other sources, how to correct the data at the source, and how to validate that your fixes are working. This process prevents wasted ad spend, improves attribution, and gives you a reliable view of where your customers really come from.
What Counts as Direct Traffic in GA4
GA4 classifies a session as direct when it cannot identify a source—no referrer, no campaign parameters, and no recognized medium. This includes users who type your URL, click on a bookmark, or arrive from sources where tracking information is stripped, such as some mobile apps, email clients, or privacy-focused browsers. Unlike Universal Analytics, GA4 processes source attribution at the session level, not the hit level, and handles session stitching and attribution differently.
In Universal Analytics, the ‘last non-direct click’ model applied at the property level: if a user first arrived via a campaign and later visited directly, the direct session was attributed to the original campaign source. GA4 also uses a ‘last non-direct click’ model by default for standard reports, but session attribution is stricter. If GA4 can’t detect any source data at session start, it logs the session as direct, even if the user has a previous campaign source in their history. This means returning users who clear cookies, switch devices, or hit the site from a link missing UTM parameters are more likely to show as direct.
To check attribution in GA4, use the Session source/medium dimension in the standard reports or Explore. If you see a spike in (direct) / (none) that doesn’t match your expectations, audit your campaign tagging and referral paths. GA4 does not retroactively reassign session source if attribution data is missing at session start.
Step 1: Check for Missing or Broken UTM Parameters
GA4 attributes a session to “Direct” when it can’t identify a source. If UTM parameters are missing, malformed, or stripped from inbound links, GA4 has no campaign data and defaults to direct. This is common with email campaigns, SMS links, QR codes, or paid ads that lack tracking templates or use incorrect parameter syntax. For example, a link missing ?utm_source= or with a typo like utm_sorce won’t be recognized.
Audit your landing URLs using browser developer tools. In Chrome, right-click a link (e.g., from an email), open it in an incognito window, and inspect the address bar — confirm UTM parameters persist all the way to the landing page. If not, check the original link in your campaign tool. For a broader view, review server access logs for inbound requests and inspect the full query string. If you see traffic landing on / or product pages with no UTM parameters, investigate how those links are distributed and handled.
Redirects often strip parameters. HTTP to HTTPS upgrades, link shorteners, or in-app browsers (such as those in Instagram or Facebook) sometimes drop or rewrite query strings, especially if not configured to preserve them. If you use a link shortener or custom redirect, test the full click path to ensure UTM parameters survive every hop. If you see UTMs disappear after a redirect, fix the redirect logic to forward the entire query string.
Step 2: Diagnose Redirects and Intermediaries
Payment gateways, third-party checkouts, and app deep links often break the original referral chain. When a customer leaves your site to pay—Stripe, PayPal, Shop Pay, Klarna, Affirm, or similar—the return flow may drop all UTM parameters and referrer data. GA4 then attributes the session as “Direct,” wiping the original source and medium.
In-app browsers from Instagram, Facebook, or TikTok add another layer. These browsers frequently strip UTMs and referrer headers, especially on iOS. Meta’s in-app browser sometimes rewrites URLs or opens external links in a new webview, making the landing session look like direct traffic in GA4 even if it started as paid social.
To isolate where attribution breaks, run controlled test purchases. Start a session from a known UTM campaign, complete checkout via each payment method, and examine the purchase event in GA4. In the DebugView or real-time reports, check if session_source and session_medium persist. If they reset to (direct) / (none) after payment, the referral chain is broken.
To preserve attribution, use server-side tagging (such as GTM server container) to store and forward original UTMs through the purchase flow. Alternatively, pass UTMs as custom parameters through the checkout process or trigger a post-purchase script that sends the original source to GA4. Each method requires careful implementation and ongoing validation, especially after gateway or platform updates.
Step 3: Inspect Site and Tagging Implementation
GA4 assigns direct traffic as a fallback when it can’t identify a valid source, so any failure in tag firing or parameter capture increases direct sessions. Delayed or missing GA4 tag loads—often caused by slow scripts, deferred loading, or tag manager misconfigurations—mean sessions may start before GA4 can read referral or UTM data. If the tag fires after the user has already navigated past the landing page, GA4 will usually attribute the session as direct.
Single-page applications (SPAs) and sites with client-side routing present a persistent risk. If your GA4 configuration only fires on initial page load, subsequent virtual pageviews won’t update source/medium, and returning users may appear as direct traffic. You need to trigger page_view events on every client-side route change, not just on first load. Check your router integration and confirm that new pageviews trigger GA4 events with correct parameters.
Use GA4 DebugView and Tag Assistant to confirm that each navigation triggers a page_view with the expected page_location and, if present, UTM parameters. In Chrome DevTools, filter network requests for collect hits to https://www.google-analytics.com/g/collect and inspect payloads for source and medium values. If you see missing or empty source/medium fields, or if events are delayed after navigation, fix your tag triggers and data layer setup.
Cookie consent banners and privacy tools can block or delay GA4 scripts until after user interaction. If GA4 loads only after consent, the initial landing source may be lost, defaulting to direct. Test with consent banners enabled to see if GA4 fires on first pageview or only after acceptance. Adjust consent mode or banner behavior to ensure tags load in time to capture attribution data.
Step 4: Review Cross-Domain and Subdomain Tracking
Session breaks during cross-domain flows are a primary cause of inflated direct traffic. If a shopper leaves your domain for payment (e.g., PayPal, Klarna) and returns, GA4 may treat the return as a new session with unknown source—classifying it as direct. This also applies to subdomain transitions if cookies or linker parameters aren’t preserved.
Start by checking GA4’s cross-domain tracking settings in the Admin area under Data Streams > Web > Configure tag settings > Configure your domains. List every domain and subdomain involved in user journeys, including checkout and third-party flows. If a domain is missing, GA4 cannot link sessions across it.
Consistent measurement IDs across all domains are required. If you use multiple GA4 properties or have legacy Universal Analytics tags firing, you risk session fragmentation. Inspect the source code or use browser tools to confirm the GA4 measurement ID (G-XXXXXXXXXX) is identical on each domain.
GA4 relies on linker parameters (_gl) to pass session info. If redirects or page templates strip these parameters, session continuity fails. Test a full flow: start on your main domain, proceed through checkout, and return. Use browser dev tools to watch for the _gl parameter in URLs. If it disappears, session linking is broken.
Shopify’s native checkout is on a separate domain. Shopify Plus supports cross-domain tracking; standard Shopify does not. For WooCommerce, plugin or theme conflicts can strip linker parameters. Always validate after updates or customizations.
Step 5: Analyze Traffic Patterns and Rule Out Bot or Internal Traffic
Bot traffic and internal testing can distort direct traffic in GA4. If your direct channel reports unexplained spikes or persistent elevation, check for activity from non-human or in-house sources. Bots and staff often bypass campaign parameters or use bookmarks, which GA4 then logs as direct.
GA4 applies automatic bot filtering, but this only excludes traffic Google identifies as known bots. It does not block custom scrapers, QA tools, or other automated hits that evade detection. Review the “Traffic acquisition” report for unusual surges, especially at odd hours or from unfamiliar locations. Anomalies clustered around releases or site changes often point to internal testing.
To filter out internal traffic, define rules by IP address in the GA4 Admin under Data Streams > More tagging settings > Define internal traffic. Specify one or more IPs or subnets. GA4 marks these as “internal” using the traffic_type parameter. To exclude them from reports, create a data filter in Admin > Data Settings > Data Filters and set it to “Active.”
Test your filter by generating a test event from an internal IP and verifying the traffic_type field in the DebugView. If the label does not appear, check for typos or misconfigured IP ranges. Review direct traffic patterns weekly for unexpected spikes—these often signal missed filter coverage or new bot activity.
How to Monitor and Validate Fixes
Build a custom exploration in GA4 to isolate sessions attributed as direct. In the Explore workspace, create a free-form report with Session default channel group as a dimension and Sessions as a metric. Filter to include only Direct channel group. Add a secondary dimension such as Landing page or Source/Medium to spot patterns, like spikes on specific pages or after particular changes.
Annotate any changes to tracking, redirects, or UTM handling. GA4’s built-in annotation support is limited, so maintain a shared changelog—Google Sheets or project management tools work. Log the exact date, time, and nature of each fix (for example, “2024-06-01: Added UTM preservation to payment gateway return URLs”). When direct traffic drops or shifts, cross-reference with your changelog to confirm causality.
Check for metric shifts at both daily and weekly intervals. After a fix, compare direct session counts for at least one full week before and after, accounting for seasonality or campaign activity. For ongoing monitoring, set a monthly recurring audit: review the direct channel’s share of total sessions, and spot-check recent landing pages for UTM presence using GA4 explorations. If attribution issues reappear, re-run the diagnostic steps and update your changelog accordingly.
Frequently asked questions
Why does GA4 show more direct traffic than Universal Analytics?
GA4’s attribution model and stricter handling of missing source data often result in higher reported direct traffic compared to UA. Differences in session stitching and referral detection also contribute.
Can payment gateways cause direct traffic spikes?
Yes. Many payment gateways redirect users back to your site without preserving UTM parameters or referrer data, causing GA4 to attribute the session to direct.
How can I test if redirects are stripping UTMs?
Manually add UTM parameters to a test URL, follow the full user journey (including through payment or third-party flows), and inspect the landing URL and GA4 DebugView to see if parameters persist.
Does GA4 filter out bot traffic automatically?
GA4 includes some bot and spam filtering, but not all non-human traffic is caught. Review traffic patterns and consider additional filters if you suspect inflated numbers.
Not sure your tracking is telling you the truth?
Propulse Agency audits e-commerce tracking setups — server-side tagging, Meta CAPI, GA4 and consent — and fixes what is quietly costing you conversions.
Prioritize UTM Hygiene and Redirect Audits First
Start by auditing your main traffic sources for missing, malformed, or stripped UTM parameters. In e-commerce, most direct inflation stems from broken campaign tagging or links passing through platforms that drop query strings. Review links from email, SMS, and paid social—especially where you use link shorteners or third-party platforms. Test actual user flows, not just what’s in your campaign builder.
Redirect chains and misconfigured HTTPS settings are the next most common culprits. Use browser dev tools or a redirect checker to confirm that UTM parameters persist through every hop. If you fix these two areas and still see excessive direct traffic, only then move deeper into cross-domain, bot, or internal traffic analysis. Skipping the basics leads to wasted time and recurring attribution gaps.
Reviewed and updated by Test on Jul 28, 2026.
