Direct Traffic can be one of many things. Here are a few possibilities:
- Clicking a link from an email (depending on email provider/program)
- Clicking a link from a Microsoft Office or PDF document
- Accessing the site from a shortened URL (depending on the URL shortener)
- Clicking a link from a Mobile social media apps like Facebook or Twitter (mobile apps often do not pass referrer information)
- Going to a non-secure (HTTP) site from a link on a secure (HTTPS) site, as the secure site won't pass a referrer to the non-secure site. For instance, if someone clicks a link on https://example.com to go to https://example2.com, the analytics for example2.com will show the session as direct.
- Accessing a site from organic search, in some instances, will end up being reported as Direct due to browser issues.