Inflated Direct traffic: the AI, the bots and the dark traffic GA4 hides

By Miguel Maio · Published 30 October 2026

Your Direct isn't direct traffic. It's what GA4 couldn't classify, and much of it isn't even human. Everyone looks at the Direct channel and pictures people typing the URL or hitting a bookmark. It almost never is. Direct is the bucket where GA4 dumps everything it couldn't attribute, and before you draw a conclusion from that number you have to know what's inside it.

Why your Direct traffic is inflated

Direct is the default channel: GA4 drops any session it can't attribute to a source in there. It isn't a sign of intent, it's an absence of data. It fills up through several routes at once, and rarely the one you imagine.

The classic causes are referrer loss: an HTTPS-to-HTTP link, a click from an app or an email client, a botched redirect that drops the referrer. To these we've added a badly measured jump between domains, which GA4 treats as a new session with no source, and, over the last two years, AI traffic: plenty of referrals from chatbots and generated answers arrive with no identifiable referrer and land in Direct too. The number grows, and it grows for the worst reason: measurement keeps getting worse.

What GA4 filters out, and what escapes it

GA4 filters bots, but only the obvious ones. The industry standard (MRC) splits invalid traffic in two: General Invalid Traffic (GIVT), detectable from known lists, and Sophisticated Invalid Traffic (SIVT), which needs advanced analysis to catch. GA4 only deals with the first.

GA4's filtering rests on a combination of Google's own research and the International Spiders and Bots List (IAB), is on by default and can't be turned off or even show how much was excluded. So it catches GIVT, the easy part, and lets SIVT through, the part that matters. A bot that isn't on those lists, that runs JavaScript and fires the tag, enters your reports as a human visit. And MRC's definition of SIVT includes exactly that: bots masquerading as people, proxy traffic, hijacked devices. GA4 doesn't see it, and neither do you, if you only look at GA4.

Dark traffic: the human traffic that loses its referrer

Not all inflated Direct is bots. Much of it is dark traffic: real human traffic that arrives with no referrer and so can't be attributed. It's the opposite of the bot problem. Here you lose real people, mislabeled, instead of gaining fake ones.

The mechanism is the W3C Referrer Policy, which defines when and how much of the referrer a browser sends (W3C, Referrer Policy). On a link stepping down from HTTPS to HTTP, the referrer is suppressed by default. In apps, email clients and documents, it often doesn't exist at all. And when the journey crosses a second domain with no cross-domain measurement set up, the real source is lost between the two. The result is always the same: a real person, coming from a concrete place, counted as Direct. Multiply that by thousands of sessions and you have a channel that looks strong and says nothing.

AI browsers: the traffic that fires GA4 and looks human

AI-native browsers, OpenAI's Atlas and Perplexity's Comet, are the next wave of noise in Direct, and the most treacherous, because they run JavaScript, fire the GA4 tag and behave like a user. They aren't on the IAB list. So they're SIVT that passes for human.

This is where it turns out badly: the problem won't improve, it'll get worse. As these agents browse, click and fill in on people's behalf, they generate sessions GA4 records as legitimate traffic and deposits in Direct, or under a source matching no human decision. Anyone still measuring by GA4 alone will watch Direct swell and chalk it up to brand awareness, when it's partly software visiting the site. I've written in detail about AI browsers like Atlas and Comet.

The truth is in the server logs, not in GA4

Server logs record everything that reached the server, timestamp, IP, user-agent, requested URL and status code, regardless of JavaScript, cookie consent or bot lists. They're the only measurement source that doesn't depend on the tag. If GA4 shows you the filtered, skewed version, the logs show what actually happened.

This is where you catch what GA4 hides. First, you verify spoofed bots, because any script can write "Googlebot" or "GPTBot" in the user-agent. There are two methods, and each serious provider supports one: matching the IP against the range file the provider publishes (OpenAI, for GPTBot, OAI-SearchBot and ChatGPT-User; Anthropic; Perplexity), or reverse and forward DNS, the method Google documents for Googlebot. A generic PTR proves control of DNS, not the bot's identity. The scale of the fraud is real: HUMAN Security measured that 5.7% of traffic claiming to be an AI crawler is spoofed, and the most impersonated of all is ChatGPT-User, at roughly one fake request for every five real ones.

Second, and more important for Direct: you size the non-human, misattributed slice by reconciliation. You pull GA4 and the logs for the same period, search the logs for AI and bot user-agents, and compare with what GA4 counted. The gap is your real undercount (or overcount), as a number, not a guess. Tool for this: the Screaming Frog Log File Analyser, which has an option to verify bots on import, cross-checking IPs against the published lists. Without this reconciliation, you're arguing about Direct with half the data.

How to separate human, dark traffic and bots in GA4

If you can't reach the logs, you can still clear some of the noise inside GA4 itself, less reliable, but better than nothing. The rule is to stop treating Direct as a block and start breaking it apart.

Three practical moves. Apply a hostname filter to cut ghost traffic from domains you don't control, a classic source of Direct and fake referrals. Build a segment crossing Direct with deep, specific pages, because nobody types an internal article's URL from memory, so Direct landing there is almost always a lost referrer or AI, not direct access. And confront Direct spikes with the pages AI is citing: if Direct rises on pages that show up in chatbot answers, you know where it's coming from. None of this is as solid as logs, but it turns an opaque bucket into three testable hypotheses. For the detail of how to measure AI in GA4, I wrote a dedicated guide.

How to mitigate bot traffic: Cloudflare, server-side and filters

Measuring better isn't enough: it helps to stop the bot before it dirties the data. Mitigation happens in layers, from the network edge to collection, and the choice depends on what you have and what you pay.

At the edge, Cloudflare is the most direct route. Bot Fight Mode, on the free plan, blocks obvious automated traffic; Super Bot Fight Mode, on the Pro, Business and Enterprise plans (without the Bot Management add-on), lets you set actions per bot category and tell verified bots from the rest; Bot Management, on the Enterprise plan, gives a per-request score so you can decide case by case. At collection, a server-side setup lets you filter the request before it reaches GA4, blocking anything with a high bot score. And inside GA4, beyond the automatic filtering, you use hostname and data filters to cut referral spam and Measurement Protocol spam. No layer is enough on its own; together, they hand you back a Direct you can trust.

Don't decide on Direct until you know what's in it

Every euro you move to a channel on the back of a Direct you never opened is a euro moved blind. It may be paying for bots, hiding a real source you should be reinforcing, or covering a tracking error that's been costing you data for months. The cost isn't having the wrong number in the report. It's making the right decision for the wrong problem, and only finding out once you've already spent.

Sources

• MRC - Invalid Traffic Detection and Filtration Standards (PDF)
• Google Analytics Help - Known bot exclusion
• W3C - Referrer Policy
• Google Search Central - Verify Googlebot
• OpenAI - GPTBot (IP ranges)
• Anthropic - Crawlers (bots.json)
• Perplexity - Crawlers
• Cloudflare - Bots (documentation)
• HUMAN Security - AI crawler spoofing
• Screaming Frog - Monitor AI bots in the logs

Frequently asked questions