What's Actually Inside Your GA4 Dark Traffic?

Most sites have 20–40% of sessions attributed to direct/none. Some of that is real direct traffic. A lot of it isn't. The Dark Traffic Analyzer shows you what's hiding — and what's recoverable.

Analyze My Dark Traffic →

Free. No credit card. Connects via Google OAuth.

🌑Dark Traffic Analyzer
Last 28 days

Dark Traffic

34.2%

8,312 / 24,304 sessions

Recoverable Sessions

1,823

via page_referrer signal

Referrer Domains Found

5

with attribution signal

Watch Out — 34.2% dark traffic suggests UTM tagging gaps or excessive link shorteners.

Opportunity — 1,823 sessions recoverable across 5 referrer domains via exclusion list updates.

Referrer Recovery Table

DomainLikely SourceMediumSessionsConfidence
linkedin.comlinkedinsocial841high
mail.google.comemailemail523high
android-app://com.slackslackreferral198medium
t.cotwittersocial164medium
lnkd.inlinkedinsocial97low

What Is Dark Traffic in GA4?

Dark traffic — also called unattributed traffic — refers to sessions where GA4 records session_source = direct and session_medium = none. In plain terms: GA4 received the session but had no referrer information to tell it where the visitor came from.

The name "dark traffic" reflects the problem — this traffic is invisible to your attribution model. You can count the sessions, but you can't connect them to a channel, campaign, or source.

Why does dark traffic happen?

The most common causes: HTTPS-to-HTTP referrer stripping, link shorteners that discard the original referrer, missing UTM parameters on email and social links, cross-domain tracking gaps, self-referrals from your own domain, and app or email clients that don't pass referrer headers at all. Google covers many of these in their official (direct) / (none) traffic guide. For a full breakdown of each cause and how to fix it, see the common culprits section below.

Why does it matter?

Unattributed traffic means you can't optimize what you can't see. If 35% of your sessions are dark, your channel reports — organic, paid, social, email — are all understated by at least that margin. Budget decisions made from those numbers are made from incomplete data.

What does "recoverable" mean?

Even when GA4 records a session as direct/none, it still captures the page_referrer event parameter — the URL of the page the user came from. The GA4 Data API can surface this value for direct/none sessions. When a recognizable referrer domain appears (linkedin.com, mail.google.com, t.co), we can make a confident inference about the likely true source. That's referrer recovery: using the signal GA4 has but doesn't attribute on its own.

Terminology

Direct/None vs. Unassigned vs. (not set)

If you searched for any of these, you're in the right place — here's how to tell which one you're actually dealing with.

direct / none

Source / Medium — This is what this report analyzes

session_source = direct and session_medium = none appear when GA4 received a session with no referrer information. It's the source/medium dimension value — a raw data point, not a classification. This is the dark traffic problem: sessions that arrived without attribution.

Unassigned

Default Channel Group — Related, but not identical

"Unassigned" is a channel grouping label, not a source. It appears in GA4's Default Channel Grouping when a session doesn't match any of the defined channel rules. A direct/none session will often land in Unassigned, but so will other traffic that doesn't match grouping logic. If you're seeing Unassigned in your channel reports, the dark traffic report is a good starting point — but the fix may also involve updating your channel grouping rules.

(not set)

Missing Dimension Value — Different root cause, different fix

"(not set)" means GA4 has no value at all for a dimension — the data was never collected or the dimension doesn't apply. You'll see it in reports when events fire without required parameters, or when you filter on a dimension that wasn't recorded for some sessions. It's a data quality issue, not a source attribution issue. The fix depends on which dimension is showing (not set) and why — usually a tracking implementation gap.

What the Dark Traffic Report Shows

Connect your GA4 property and get this breakdown in seconds.

01

Dark Traffic %

Your share of unattributed sessions versus total sessions, with raw session volume. Immediately tells you whether you have a problem worth investigating.

02

Recovered Sessions

Sessions where the page_referrer event parameter reveals a likely true source despite a direct/none session attribution. The signal GA4 has but doesn't use.

03

Referrer Recovery Table

Every referrer domain found in your dark sessions, with a likely source, likely medium, session count, and a confidence score — high, medium, or low.

04

AI Insights + URL Signals

Watch Out and Opportunity callouts from your actual data — including click ID detection (fbclid, gclid, etc.) and broken UTM alerts when parameters arrive in the URL but GA4 doesn't attribute them.

Why Confidence Scores?

Not all referrer recovery is equal. Some referrers are unambiguous — if linkedin.com is the page_referrer on a direct/none session, it's almost certainly LinkedIn traffic. Others require a judgment call.

high

High confidence

The referrer domain maps unambiguously to a known source and medium. linkedin.com, mail.google.com, t.co — these have one reasonable interpretation and it's reliable.

medium

Medium confidence

The referrer suggests a source category but isn't definitive. App-based referrers like android-app://com.slack are likely Slack traffic but could be other Slack-adjacent apps.

low

Low confidence

The referrer exists and is recoverable, but the source mapping is a best guess. Link shorteners, CDNs, and ambiguous subdomains fall here. Use as a signal, not a fact.

We surface the data and flag the uncertainty. What you do with it is your call.

Common Culprits Behind Dark Traffic

Most dark traffic comes from a small set of predictable problems. Here's how each one works and how to spot it. For a detailed reduction guide, Analytics Mania's walkthrough covers each fix in depth.

Self-referrals — Your own domain showing as a referrer
If you see your own domain (or a subdomain) appearing in the referrer recovery table, that's a cross-domain tracking problem. Typically caused by a payment processor, booking system, or subdomain that isn't included in GA4's cross-domain list. Sessions cross the domain boundary, GA4 treats them as new sessions, and the previous session gets attributed to direct/none. Fix: add the missing domain to your GA4 cross-domain tracking configuration.
Missing UTM parameters — The most common root cause
Email campaigns, social posts, link-in-bio tools (Linktree, etc.), and newsletter platforms are frequent offenders. When a link doesn't include utm_source and utm_medium, GA4 can't attribute the session. This traffic lands as direct/none even though it came from a clearly trackable source. Fix: tag every outbound link you control with UTM parameters. Tools like the GA4 Helper UTM Builder can help.
HTTPS to HTTP referrer stripping
Browsers drop the Referer header when navigating from a secure (HTTPS) page to an insecure (HTTP) page. If any part of your site still runs on HTTP, inbound traffic from HTTPS sources will look direct. Fix: migrate entirely to HTTPS. This is table stakes in 2024 but still causes attribution gaps on older properties.
Link shorteners stripping referrer data
Services like bit.ly, ow.ly, and similar URL shorteners perform a redirect. That redirect often strips or replaces the original Referer header. GA4 sees the final destination but not where the click started. Fix: use UTM parameters on links before shortening them. The shortener can strip the referrer, but it can't strip a utm_source parameter embedded in the URL itself.
App traffic without referrer headers
Mobile apps, PDF documents, desktop software, and some email clients open URLs without sending a Referer header. This is structural — there's no referrer to capture. Fix: UTM parameters in app-shared links are the only reliable attribution method here.
Cross-domain tracking gaps
If your user journey spans multiple domains — a main site, a checkout on a subdomain, a booking widget from a third-party tool — and you haven't configured GA4 cross-domain tracking to stitch those sessions together, each domain crossing resets the session attribution to direct/none. Fix: add all relevant domains to your GA4 property's cross-domain list and verify the linker parameter is passing correctly.

Stop Guessing. See Your Actual Traffic Sources.

Connect your GA4 property and get your dark traffic breakdown in seconds. Free, read-only access — we never modify your data.

Run My Dark Traffic Report →
Free
Read-only GA4 access
No credit card
Results in seconds
No GA4 data stored