Problem

Why HubSpot shows so much Direct traffic

HubSpot labels a visit Direct Traffic when it finds no referrer and no tracking parameters on it. A high Direct share in B2B is rarely people typing your URL. It usually means UTMs and referrers are being lost before the HubSpot tracking code reads them: through embedded forms, redirects, cross-domain hops, consent banners or blocked scripts.

By Vladimir Cvetkoski · Last updated

Root causes

The 7 most common causes, and how to check each one

  1. 01

    Embedded or iframe forms lose the page context

    When a form loads inside an iframe or on a separate domain, the submission can be tied to the iframe URL instead of the landing page, and the UTMs on the landing page never reach the contact record.

    How to check
    1. 01Open a landing page with ?utm_source=test&utm_medium=audit added to the URL and submit the form with a fresh email address.
    2. 02In HubSpot, open the new contact and check Original Source and the first page in the activity timeline.
    3. 03If the source is Direct Traffic or the first page has no UTMs, the form is losing context.
  2. 02

    Redirects and link shorteners strip query parameters

    A 301 from http to https, from non-www to www, or through a link shortener can drop everything after the ? if it is not configured to pass it through. The visitor arrives with no UTMs and no referrer.

    How to check
    1. 01Take a tagged ad URL and run it through curl -sIL "<url>" or a redirect checker.
    2. 02Check that the final URL still has every UTM and click ID.
    3. 03Repeat for each ad platform, since each one builds final URLs differently.
  3. 03

    Cross-domain hops break the session

    Visitors who move from your marketing site to an app, booking tool or docs subdomain can start a new session on the second domain with no source. If the conversion happens there, HubSpot sees a Direct visit.

    How to check
    1. 01List every domain and subdomain a buyer can pass through before converting.
    2. 02Confirm each one is added in HubSpot under Settings > Tracking & Analytics > Tracking code > Advanced tracking.
    3. 03Click from the main site to the other domain and check whether the __hstc cookie value stays the same.
  4. 04

    Tracking code missing or late on some templates

    One landing page template, a subdomain, or a page built in a different tool without the HubSpot tracking code means visits there are never recorded with their source.

    How to check
    1. 01Open each template type and subdomain and look for js.hs-scripts.com (or js-eu1.hs-scripts.com) in the network tab.
    2. 02Check it loads on the first page view, not after a scroll or click.
  5. 05

    The consent banner blocks the cookie, and the source is never recovered

    With an opt-in banner, HubSpot only records page views after the visitor accepts cookies. The first page view, the one with the UTMs, is not recorded, so a visitor who accepts on page two can start without a source. A visitor who never accepts and then submits a form is recorded as Direct Traffic.

    How to check
    1. 01In a private window, land on a tagged URL and do not touch the banner. Check whether __hstc and hubspotutk are set.
    2. 02Accept consent on a second page, submit a form, and check the new contact's Original Source.
  6. 06

    Safari limits cookie lifetime

    Safari's Intelligent Tracking Prevention deletes cookies set by JavaScript after 7 days without the visitor interacting with your site, and caps them at 24 hours when the visitor arrives from a link-decorated URL. A buyer who comes back after the cap looks like a new visitor, often with no source.

    How to check
    1. 01In HubSpot, compare the share of Direct contacts by browser where you have the data.
    2. 02Look at the gap between first visit and conversion for your typical buyer. Longer than a week means ITP matters.
  7. 07

    Ad and script blockers

    Blockers that stop the HubSpot tracking script mean no page views are recorded until the form submission. The contact gets created with little or no source data.

    How to check
    1. 01Install a common blocker (for example uBlock Origin) and walk through your funnel with a tagged URL.
    2. 02Check what source the resulting contact gets.
Self-check

Checklist

  1. 01Pick one landing page per paid channel and add test UTMs to each URL.
  2. 02Run every tagged URL through a redirect checker and confirm the parameters survive.
  3. 03Submit each form type once (embedded, pop-up, booking tool) with a new email address per test.
  4. 04Check each test contact's Original Source, Original Source Drill-Down 1 and first page seen.
  5. 05Repeat one test in Safari and one with an ad blocker enabled.
  6. 06Repeat one test while declining, then accepting, the consent banner.
  7. 07List every domain in the journey and confirm each one is in HubSpot's tracking settings.
  8. 08Write down which tests came back as Direct Traffic. Those are your leaks.
When it is not a quick fix

When to get help

If the tests show more than one leak, or the leak is in custom code, a booking tool or a consent setup you cannot change yourself, the Attribution Audit maps every leak with evidence and a fixed-price plan.

Related reading

From the blog

10 min read

Why HubSpot shows 60%+ Direct traffic (and how to find the leak in 30 minutes)

High Direct traffic in HubSpot is almost always a tracking leak, not real direct visits. A 30-minute test plan to find which of the 7 usual causes is yours.

Read more →11 min read

HubSpot attribution reports, explained by an engineer

How HubSpot's contact create, deal create and revenue attribution reports work, what data each one needs, which model fits B2B, and how to spot a bad report.

Read more →11 min read

HubSpot Original Source vs Latest Source: what they really record

What HubSpot Original and Latest Traffic Source record, when each one changes, how visits get classified, and how to add your own first and last touch fields.

Read more →
Questions

Common questions

Yes. Bookmarks, typed URLs and links from apps that send no referrer are real Direct visits. The problem is when Direct is one of your biggest sources while you run paid campaigns, because paid visitors almost never arrive without a source.

Yes, but carefully. HubSpot lets you edit Original Source on a single record, in bulk or with a workflow, but editing it clears the drill-down values and First Referring Site, so you lose the detail you would need to audit it later. A separate custom source property, or a documented backfill from your own data, is usually the better route.

Only part of it. Server-side tracking helps with blockers and cookie lifetime, but it does not fix forms that drop UTMs or redirects that strip them. Those need to be fixed where they happen.

Related

Services that fix this

From $2,000

Attribution Audit

A fixed-scope audit of how your ad clicks, forms and CRM connect. You get a written report of every leak, ranked by cost, and a fix plan.

Read more →Service

The Fix

A one-time engagement to fix specific attribution problems, scoped and priced before any work starts. You get a working fix and written notes on what changed.

Read more →Service

Server-Side Tracking

Tracking that keeps working when browsers block your data. Server-side GTM for GA4, Google Ads, Meta and LinkedIn, added to the GTM you already have.

Read more →
Early access · Limited spots

Not sure which of these it is?

Connect your stack read-only and I monitor it free for 14 days. Tracking breaks get flagged before they hit your reports.

  • →14 days from connection, no card required
  • →Read-only access only, nothing is changed in your accounts
  • →Alerts by Slack or email
Start a free 2-week monitorOr describe what you're seeing →