To correct your GA4 setup on two websites to ensure that the source doesn’t display as ‘direct’ for the embedded site, it may be beneficial to use Google Tag Manager (GTM). This can help to manage the data layer and control which data is sent and when. Additionally, it is important to ensure that each website is set up as a separate data stream in the property settings on GA4.
In GA4, all website interactions are considered as events and can be customized, hence you can manually set the session_id and client_id on page load through GTM, especially for your embedded iframe site. Your services can use GTM‘s JavaScript APIs to retrieve the GA client ID and set for every hit sent from the iframe.
Despite sharing the same GA cookie value, be aware that cross-domain tracking may cause issues, such as sessions being split across domains. To solve this, cross-domain measurement may be necessary to correctly attribute sessions. In your case, there is a missing linker parameter when the user navigates into the iframe (or from the iframe), which results in the inability to correctly attribute sessions.
Remember to double-check your GA4 debugging output to ensure no other discrepancies are causing issues with the data. Finally, test everything in a non-production environment and gradually roll out changes, monitoring effects on your traffic and other metrics to avoid larger issues.