Most of our “direct” traffic was browser automation

What the dashboard said

Over four weeks, from 29 August to 25 September 2026, GA4 filed 91% of the sessions on our company site under “direct”: no search engine, no link, no campaign. Read at face value, almost all our visitors knew the address and typed it in.

What looked wrong

People who type an address in usually know what they came for. These sessions did not behave that way. Only 9% of direct sessions counted as engaged in GA4. Sessions that arrived any other way, most of them from search, engaged at 54%.

Direct did not move like an audience either. One day, 3 September, brought 18% of the four weeks’ direct sessions.

The check that found it

GA4 does not record which program made a visit, but it does record the screen size. A person’s screen does not depend on how they arrive: the laptop that types our address in is the same laptop that finds us through search. The automation that reached us was different. It rotated its addresses, cities and browser versions, but kept its window size, and it almost never arrived from a search result.

So for each screen size we asked how its sessions arrived. Three sizes, 800×600, 1366×1366 and 1280×1200, brought nearly three quarters of all direct sessions between them, and almost nothing else. In all, the screen sizes the check flagged carried 87% of direct sessions over the four weeks, and about 1% of the sessions that arrived any other way.

Some of the automation was ours. The Lighthouse speed tests we run on our own site emulate a phone with a 412×823 screen, and GA4 cannot tell those runs apart from anyone else’s. That screen size brought 4% of direct sessions. Without it, automation is still 87% of direct.

The check names no screen size in advance. A new machine on a new window size is caught as soon as it crosses the same line.

The step on 31 August is a change in measurement, not in visitors. That day, the day after our company site moved to a new platform, its analytics tag began loading from the site’s own domain, past the blockers that had stopped Google’s tag manager, so GA4 began recording visits it had missed: far more machines than people.

What we did: categorised, nothing subtracted

We did not delete these sessions or take them out of any total. Every total in our report is still the number GA4 recorded. The sessions on automation-shaped screen sizes are a category of their own, shown beside direct.

That keeps the report checkable against GA4: the categories add back up to GA4’s own totals. If the check misjudges a screen size, the category changes and the totals do not.

What it changed

The benchmark that was wrong was direct traffic itself. Direct is usually read as the people who already know you, the baseline other channels are measured against. Ours was mostly machines, so it said our most loyal visitors barely engaged: 9%.

With the machines in a category of their own, the 13% of direct sessions left engaged at 20%. That is still well below the 54% for everything else, and machines the check cannot see may still be among them. It is a closer baseline for people than the 9% ever was.