Fantastic post Tom! There's a lot of confusion on direct traffic to begin with. These are even more finer nuances that you have explained. I have a client whose top source of traffic is direct, and part of it is maybe due to the fact that they don't do any promotion, and it's mostly shared around internally within their team. But I just noticed that their URL is http and not https so this might be something for me to take back to the team. Thanks!

The time might have come when you want to secure your website and switch from HTTP to HTTPS. Easier said than done. A lot of issues might appear along the way that can screw up your hard-worked organic traffic. However, there is one thing that can really mess up things for your website while moving your site to https; and that is the canonical tag. 

Thank you Jayne, for doing all that voting and sharing, means the world to me! I am glad you saw some new ideas and looking at all the comments, I think I killed a really bug tree with this post, that is how many people want to print it out, lol. If at any point of time you get stuck with one of these, send me an e-mail, tweet, what ever and I will try to help you with extra ideas :)
But now, that is all changing. We can still see all of that information ... sometimes. Things got a whole heck of a lot more complicated a little over a year ago, when Google introduced SSL encryption . What does that mean? It means Google started encrypting keyword data for anyone conducting a Google search while logged in to Google. So if you're logged in to, say, Gmail when you do a search, the keyword you used to arrive on a website is now encrypted, or hidden. So if that website drilled down into its organic search traffic source information, they'd see something like this:

If you want to drop from your hard worked #14 position to #79, you can start looking for companies that advertise themselves like the one in the image below. We don’t even know what to believe when it comes to companies that promise guaranteed instant traffic: that they are folly (in which case you don’t need them) or charlatans (in which case you don’t want them). If you want to find out more about SEO agencies and how they can ruin your website’s traffic, we wrote a previous blog post on this. 
Secure (https) to non-secure sites (http): Since Google began emphasizing the importance of having a secure site, more websites are securely hosted, as indicated by the “https” in their URLs. Per the security protocol, however, any traffic going from a secure site to a non-secure site will not pass referral information. For this issue, you can correct by updating your site to be secure through a third-party SSL certificate.