Let me look at where your "Direct" traffic is actually landing. If sessions are starting on pages like checkout confirmations or login pages, that's a strong signal they're actually returning from payment processors or auth flows — not real direct visits.

This is revealing. Two red flags stand out: 1. /checkout/success has 6,910 "Direct" sessions — these are almost certainly users returning from Stripe's payment page. Since Stripe isn't in your referral exclusion list, GA4 starts a new session and credits it as "Direct." 2. /account/login has 3,770 sessions — likely Auth0 redirect returns creating the same problem. Let me check the checkout page to confirm...