Direct vs Organic Traffic: How to Tell Them Apart
- Organic traffic arrives with a search engine referrer. Direct arrives with no referrer and no campaign tag.
- On one of our own sites, 856 of 1,628 visits over 7 days arrived with no referrer and no tag. 798 of them (93%) started on a page other than the homepage.
- People rarely type a deep address by hand. Most of that direct traffic was a link shared somewhere you cannot see.
- Counted by pageview, 66.5% of pageviews on that site had no outside referrer. Counted by visit, 53% did. Pageview counting inflates direct traffic.
- Timing cannot tell you which direct visits came from AI. We tested it and found 1 to 2% more matches than chance.
The direct vs organic traffic split looks simple on a chart. Organic traffic carries a search engine referrer. Direct traffic carries none. That is the whole difference on a single visit. The harder question is what to do when the direct number starts climbing, because a rise in direct traffic often has nothing to do with people typing your address.
The definitions, and where they get fuzzy
The organic search vs direct traffic split comes down to one header. A visit counts as organic search when the browser sends a Referer header naming a search engine, or when a utm tag identifies the campaign. It counts as direct when neither exists.
Google Analytics 4 uses exactly this rule. In the Google Analytics 4 default channel group, the Direct channel is source exactly (direct) and medium (not set) or (none). Google describes Direct as users arriving via a saved link or by entering your URL. Unassigned is the value Analytics applies when no other channel rule matches the event data. Our post on why GA4 is so complicated covers the rest of the channel logic.
The browser decides whether a referrer exists at all. MDN's Referrer-Policy page documents the default: strict-origin-when-cross-origin. A same-origin request sends the origin, path and query string. A cross-origin request sends the origin only, when the protocol stays HTTPS to HTTPS. An HTTPS page linking to an HTTP page sends no Referer header. A link marked rel=noreferrer sends nothing at all.
Many apps open links with no referrer. Email clients, chat apps and native mobile apps often send none.
| Organic | Direct | |
|---|---|---|
| Referer header | names a search engine | absent |
| Campaign tag | may be present | absent |
| Typical source | a click on a search result | a typed URL, a bookmark, or a link from an app that sent nothing |
| What it tells you | which engine sent the visit | that a visit happened, with no name attached |
Direct traffic rises when links get shared off the record
Count direct traffic by pageview and you will overstate it. A click from one page to another on the same site carries no referrer.
One of our own sites, over 7 days: 5,774 pageviews and 1,628 visits, where a visit is a run of pageviews with gaps of 30 minutes or less. By pageview, 3,841 pageviews (66.5%) had no outside referrer. By visit, 856 visits (53%) arrived with no referrer and no campaign tag.
Of those 856 visits, 798 (93%) started on a page other than the homepage. 58 started on the homepage.
The 30-day window on the same site: 6,745 visits. 3,035 (45%) arrived with no referrer and no tag. 2,802 of them (92%) started on a page other than the homepage, and 233 started on the homepage.
People rarely type a deep address by hand. Most of that direct traffic was a link whose referrer went missing. Someone shared the page in an app, in a chat, somewhere your analytics cannot see. The visit is real. The name of the source is gone.
The homepage test separates typed visits from shared ones
The organic vs direct traffic split is clean until you look at where a no-referrer visit began. Run that check before you interpret a direct number.
A visit that begins on the homepage is consistent with a bookmark or a typed address. A visit that begins three levels deep is consistent with a link someone sent. Neither is proof. Bookmarks to product pages exist, and a person who types your domain then clicks through is one visit that started on the homepage anyway.
The test works because typing a long URL is rare and sharing a long URL is common. It does not identify the app or the sender. The browser sent nothing, so there is nothing to read. The landing page is a clue to the source, never a name for it.
Some AI traffic arrives with a tag, not a referrer
ChatGPT adds utm_source=chatgpt.com to the links in its answers. A visit that arrives with that tag and no referrer is not direct traffic, as long as your tool reads utm_source.
On 30 days for one of our own sites, 360 visits (5.3%) carried utm_source=chatgpt.com and no referrer. A tool that reads only the referrer would have counted every one of them as direct.
Timing does not reveal AI-sent visits inside direct traffic
We tried to find AI-sent visits by matching a direct visit to an AI assistant's read of the same page in the 10 minutes before it. The method found 1 to 2% more matches than chance, with no peak in the first 2 minutes. Timing cannot tell you which direct visits came from AI. Do not build a report on it.
Measure the AI side directly instead
Kymo tracks AI crawlers server-side and sorts them by purpose. One group is a live fetch made for one person's question. Another is an indexer building a search index for later answers. The third is a bulk crawl collecting training data. The bot taxonomy spells out the categories.
The individual agent pages show what each one does. GPTBot and ClaudeBot are training crawlers that send no traffic. PerplexityBot is an indexer and can lead to referral traffic.
Robots.txt controls sit alongside the crawlers without being crawlers. Applebot-Extended (a robots.txt control token, not a crawler) has no user-agent and never appears in a log. Blocking GPTBot does not remove your site from ChatGPT's answers, because the indexing and live-fetch agents are separate tokens.
Publishing an llms.txt file is a cheap bet. Adoption is partial, no major operator has publicly committed to honouring it, and publishing the file is not the same as a crawler fetching it. Only your own server sees which one happened. Kymo's free llms.txt generator and validator builds one in a few minutes.
What to do with the direct number
Count by visit, and run the homepage test before you interpret a direct number. Read utm tags before you trust a referrer-only report. How to Measure AI Visibility: Mention, Read, Click, Sale lays out the signals worth tracking, and AI Visibility Score: What It Measures and What's a Good One explains what the number means. Before You Buy an LLM Visibility Tool, Ask These 8 Questions will save you a bad purchase. The Small Business Guide to AEO covers the work that moves discovery.
Kymo counts sources by visit, not by pageview, and splits no-referrer visits in two. A visit that started on the homepage is labelled typed or bookmarked. A visit that started on any other page is labelled link, no referrer. For the second kind, Kymo shows which page the visit landed on. That landing page is a clue to the source and never a name for it.
Pricing is simple. Solo is $9 a month or $90 a year for up to 10,000 events a month. Studio is $29 a month or $290 a year for up to 100,000 events a month. Every feature is on both plans, and the plans differ only by event volume. Both start with 14 days free, no card required, and AI crawler tracking does not count against your event limit.
Stop guessing. Watch.
Point Kymo at your site and you see which pages AI engines read, how many people AI answers send there, and which of those people complete a goal. That beats asking a chatbot about your brand and reporting the answer as data. If you want the lighter version first, the AI visibility check reads a URL from public signals, so your site does not need Kymo installed, and the report arrives by email.
Start free → 14-day free trial. No card required.