Full Answer

Direct in GA4 is a fallback, not a channel. When a session arrives with no recognisable source or medium, GA4 has nowhere to file it, so it lands in Direct. For paid traffic that should never happen, yet it happens constantly because the identifying data gets lost on the way in.

The usual causes stack up. UTMs get stripped by redirects, CDNs, or ad-block filter lists. Click IDs like gclid and fbclid are dropped or expired by browser privacy controls, so the platform can't re-attach the source. A payment gateway bounces the buyer off-site and returns them without parameters. Apps open links in in-app browsers that don't carry referrer data. Each of these turns a known paid visit into an anonymous one.

The damage isn't just cosmetic. Inflated Direct hides which campaigns actually drive revenue, so smart bidding optimises on bad signal and you under-credit the channels paying your bills. Two moves help. Reduce the loss: preserve query strings through every redirect, use coded parameters that survive filter lists, and confirm tags reach the hit. Then add a durable backstop by capturing first-touch source server-side on the WooCommerce order, so even when GA4 guesses Direct, your own data still knows where the sale came from.