Beware referral traffic from a secure site! Why? Because Google Analytics will show it as Direct. Its part of the process of anonymising secure traffic – the referrer gets stripped out of the header, so without a referring URL, it’s treated as Direct by GA.
If you have any control over the link from a secure site, get the link tagged with utm parameters. So your link would become …?utm_medium=referral&utm_source=referringsite.com
For more on this see https://www.e-nor.com/blog/google-analytics/https-to-http-secure-to-nonsecure-referrer-loss