Attribution lost in transit

Symptom and cause

Symptom

Traffic that clearly drove sales piling up under "direct / none", or your own payment processor sitting in the top referrals. Real channels get no credit.

Cause

Campaign parameters or the Google click id (gclid) stripped by a redirect; a cross-domain step running without GA4's linker, so the session restarts; or a payment provider's return trip overwriting the original source.

Where it's caught

A suspiciously large "direct" channel, or a checkout/payment domain showing up as a top referral; sessions arriving from ad platforms with no campaign attached.

How the signal gets lost

When a user follows a tracked link, the browser carries the UTMs or gclid and GA4's _gl linker parameter carries the session across a domain boundary. If a redirect along the way (a payment hop, a CDN edge, a marketing platform) drops the query string the _gl parameter rides on, GA4 gets a request with no campaign data and no referrer, and defaults it to (direct) / (none). If instead the round-trip returns with a referrer of its own, GA4 credits that payment or checkout domain rather than the source that earned the visit. Either way the visit is real and the source is lost.

(direct) / (none) ↑ swells with checkout volume

organic search

payments.████.com (referral) the round-trip, credited as source

email

google / cpc the paid clicks that actually drove it

this is the tell

Channel, as GA4 files it	Sessions	Conv.
(direct) / (none)	4,812	286
organic search	2,310	61
payments.████.com (referral)	1,940	173
email	540	12
google / cpc	212	4

How to catch it

1. In GA4 DebugView, click a real paid ad, enter the checkout or payment flow, and come back. Watch whether the gclid and utm_* parameters vanish mid-journey, or the session restarts (a new session_start).
2. In Traffic acquisition, look for a (direct) / (none) channel that swells in step with checkout or payment volume. Direct traffic should not scale with paid spend.
3. Check Admin → Data streams → [select your web stream] → Configure tag settings → Configure your domains, and confirm every domain in the checkout and payment flow is listed for cross-domain measurement.
4. In DevTools → Network, switch on Preserve log first so entries survive each redirect. Open a product from an ad, then on the request that crosses to the checkout or payment domain, confirm gtag appended a _gl= parameter, and confirm utm_* and gclid are still present on the thank-you URL after the round-trip.
5. In Admin → Data streams → [select your web stream] → Configure tag settings → Show all → List unwanted referrals, confirm the payment provider domain and any internal redirect domain are excluded.
6. In Google Ads, confirm auto-tagging is on at the account level (Admin → Account settings → Auto-tagging), then separately confirm the gclid it appends to the landing URL is not dropped by a downstream redirect or checkout system.

What putting it right involves

1. Preserve the parameters across every redirect: re-append utm_source, utm_medium, utm_campaign and the gclid to each redirect target, or wrap redirects so they carry the original query string through.
2. Enable and test GA4 cross-domain measurement: add every payment, checkout and marketing redirect domain to the web stream, then confirm the _gl linker parameter is appended at the boundary and read back on return.
3. Configure the unwanted-referrals list so a return trip from the payment provider, CDN or internal checkout domain is not recorded as the source, and GA4 carries the prior source forward instead. The new session itself is prevented by keeping _gl continuity across the hop (steps 1 and 2), not by this list.
4. Add a backstop at the conversion layer (browser-side or server-side). For Google Ads: recover the match with Enhanced Conversions (hashed first-party data sent with the conversion, for visitors who allowed ad_user_data), and where you captured the gclid before the strip, an Offline Conversion Import keyed on that gclid. For Meta: send the event via the Conversion API, matched on the fbc/fbclid click id or hashed first-party data (Meta CAPI does not use the gclid). Note the scope: these reattach credit at the Ads or Meta layer (event and user scoped). They do not repair GA4's session-scoped source/medium, so the (direct) / (none) line in Traffic acquisition is only fixed by preserving the referrer and _gl across the redirect (steps 1 and 2).
5. Verify it end to end in DebugView: trace one journey from ad click to conversion and confirm a single session id survives the whole path with its campaign parameters intact.