If users don't send you the referrer information about where they came from, it is very hard to pull it out of thin air. You usually just have to live with not knowing much about direct visitors.
The reasons that visitors appear as direct are:
- They type the URL into the browser.
- They have the page bookmarked.
- They visit the page from outside the browser, such as clicking a link in an email or chat client.
- They have configured their browser to suppress the referrer header
- They are actually a bot that does not send a referrer header, sends a user agent that mimics a real browser, and triggers analytics.
Here is an interesting article about a relevant experiment: Experiment Shows Up To 60% Of “Direct” Traffic Is Actually Organic Search. They excluded themselves from search engines for a day and found that they lost lots of direct visitors. Their conclusion is that many people visiting from search engines configure their browsers to not send referrers.
If you send out a newsletter, many of the clicks from it may appear to be direct. When sending out newsletters be sure to tag the URLs with parameters that let you know the source of the traffic.
Google Analytics does a decent job of weeding out the bots already. To trigger analytics, the bot has to execute JavaScript. You could also set up a honey pot URL to catch bots. Make a link on your page that is well hidden so that users won't click on it. Any time that page is visited, it will be a bot and you can exclude it from your stats.