Where Does Direct Traffic Come From? We Measured It

Most direct traffic comes from links whose referrer never reached your server. A small share is someone typing your address or opening a bookmark. We know roughly how small, because we counted a week of it on a site we run, and 93% of the no-referrer visits started somewhere other than the homepage.

Direct traffic is a bucket defined by what is missing

Analytics needs a label when nothing else matches. In the Google Analytics 4 default channel group, Direct means the source is exactly (direct) and the medium is (not set) or (none). Google describes Direct as users arriving via a saved link or by entering your URL. Unassigned is the value Analytics uses when no other channel rule matches the event data.

That definition is narrower than the traffic it collects. A link from an email, a link from a chat app, and a link from an AI answer can all land in the same bucket when the referrer is missing. Nothing was typed. Nothing was bookmarked. The signal just was not there.

A week on one site, counted two ways

Here is the week. A visit is a run of pageviews with gaps of 30 minutes or less.

By pageview, two thirds of everything looked unattributed. By visit, the figure drops to 53%. Both numbers are honest. They answer different questions, and the visit number is the one that describes people.

Why the pageview figure runs so high

A click from one page to another on your own site sends no referrer. Every internal navigation is a fresh pageview with nothing attached. If you count pageviews, you count your own menu as a source of direct traffic.

Switch to visits and the picture calms down. 856 visits out of 1,628 is still a lot, and 798 of them started on a page that was not the homepage. People do not type long addresses from memory. When a visit begins deep in a site with no referrer, a link brought them, and the referrer was lost somewhere between the sender and your server.

The 30-day window says the same thing

Over 30 days the site took 6,745 visits. Of those, 3,035 (45%) arrived with no referrer and no tag. 2,802 of that group (92%) started on a page other than the homepage. 233 started on the homepage.

Same pattern, slightly lower share, larger sample. The 7-day week was a little unusual, and one week is one week.

A campaign tag can hide inside direct traffic

Over the same 30 days, 360 visits (5.3%) carried utm_source=chatgpt.com and no referrer. ChatGPT adds utm_source=chatgpt.com to the links in its answers. If your analytics reads utm_source, those visits land in a campaign, not in Direct. If it reads only the referrer, all 360 look direct.

This is why two tools disagree about your direct traffic on the same day. One reads tags, the other does not. The tag is the smaller half of the problem, but it is the half you can act on today.

It also explains why sampling chat answers to guess your traffic is unreliable, since ChatGPT does not give the same answer to everyone and the tags only show up when someone actually clicks. Separately, ChatGPT-User (OpenAI's live fetcher) fetches a page when one person asks a question. That fetch is not a visit. The click that follows is.

Most missing referrers are a browser decision

The default for a modern browser is strict-origin-when-cross-origin. On a same-origin request it sends the origin, path and query string. On a cross-origin request it sends the origin only, and only while the protocol stays HTTPS to HTTPS. From HTTPS to HTTP it sends no Referer header at all. A link marked rel=noreferrer sends nothing.

Many apps open links with no referrer. Email clients, chat apps and native mobile apps often send none. That is a browser and app behaviour, not a gap in your setup, and you cannot configure your way out of it.

Why timing cannot find the AI visits

We tried the obvious trick. Take a direct visit, find an AI assistant's read of the same page in the 10 minutes before it, and call the two a match. It found only 1 to 2% more matches than chance, with no peak in the first 2 minutes. If AI clicks were clustering right behind AI reads, that peak would exist. It does not.

Timing cannot tell you which direct visits came from AI. Any tool that implies otherwise is guessing with extra steps, which is the same problem described in Sampled Answers vs Recorded Visits.

How Kymo counts a visit with no referrer

Kymo counts sources by visit, and it splits no-referrer visits in two. If the visit started on the homepage, it goes under "typed or bookmarked". If it started on any other page, it goes under "link, no referrer". For that second group, Kymo shows the landing page. That page is a clue to where the visit came from. It is never a name for the source, because the browser sent nothing to name.

You can see the split on the live Kymo demo dashboard without a login, and the Kymo documentation covers the definitions. Solo is $9 a month or $90 a year for up to 10,000 events a month. Studio is $29 a month or $290 a year for up to 100,000. Every feature is on both plans, both start with 14 days free, no card required, and AI crawler tracking does not count against the event limit.

Crawler hits are not direct traffic, and one token is not a crawler

AI crawler requests hit your server and show in your logs, but they are not visits. GPTBot (OpenAI's training crawler) sends no traffic and never will. Blocking it does not remove you from OpenAI's answers, because the indexing and live-fetch agents use separate tokens.

The AI crawler directory lists every agent Kymo classifies, with its category. One entry there is a control token rather than a crawler: Applebot-Extended has no user-agent and will never appear in a log.

You may also have read that an llms.txt file fixes AI discovery. Adoption is partial. No major operator has publicly committed to honouring it, and publishing the file is not the same as a crawler fetching it. Only your own server sees which one happened. It costs a few minutes, so treat it as a cheap bet. If you run Shopify, here is how to add one.

What to check when direct traffic rises

A sudden increase in direct traffic usually has a boring explanation. Work through these in order.

1. Check visits, not pageviews. If the rise is only in pageviews, it may be internal navigation or a template change.
2. Look at the landing pages. If the new direct visits land on one page, that page was linked somewhere. A launch, a newsletter, a forum post, a shared screenshot.
3. Search the raw data for utm_source. A tag means the visit had a source all along, and your reports simply were not reading it.
4. Check your crawler log separately. Crawler requests are not visits, and mixing them into traffic numbers will make a busy crawl week look like a surge of people.

If direct traffic is above roughly half your visits and most of it starts on inner pages, you are not running a site with a mysterious audience. You are running a site whose links mostly arrive without a referrer. That is worth knowing before you rewrite your content plan.

And if you want to know which AI engines actually read your pages and which of them send people who convert, the answer is measurement, not more guessing. The Small Business Guide to AEO is the place to start on the strategy side.

Stop guessing. Watch.

Kymo shows which AI crawlers visit your site, which pages they read, and how many people AI answers send to each page, so you can start tracking it on your own site instead of asking a chatbot what it thinks. If you want a look first, the free AI visibility check reads a URL from public signals, so your site does not need Kymo installed, and the report arrives by email.

Start free → 14-day free trial. No card required.