A cliff in the chart is far more often a measurement change than a traffic change. Real audiences move like weather; measurement moves like a switch.
Work down this list in order. The early items are cheap to check and account for most cases.
1. The tag is gone
A deploy replaced a template, a tag manager container was published without it, a caching layer is serving an older page. Open the page in a browser and look for the script.
This is the single most common cause and it is the fastest to rule out.
2. Somebody added a filter
An exclusion rule added yesterday drops traffic today, permanently and silently, because that is what exclusions are for. A rule meant to remove one office can remove a whole ISP's range if the mask is wrong. See excluding traffic.
3. A bot rule started matching real visitors
Bot detection works on substrings, so an entry that is too short can match ordinary browsers. The traffic is still recorded, which is what makes this recoverable, and it disappears from reports, which makes it look like a drop.
4. The drop is one segment
Split by country, device and channel before assuming it is everything. A fall that turns out to be one browser version or one source is a different problem with a different fix.
5. A redirect changed
A new redirect, a canonical change, a domain moved from www to bare. The visits still happen; they land somewhere your reporting is not counting the same way.
6. Search moved
Check Search Console against your analytics. If impressions fell too, this is an audience change and not a measurement one, the first real cause on this list.
7. Consent changed
A new banner, a stricter default, a blocking rule added by a CDN. If a measurable share of visitors now decline before anything loads, the drop is real for you and not for the site.
8. It is the calendar
A bank holiday, a school term, the last week of December. Compare against the same week last year rather than last week.
9. Somebody stopped sending you traffic
A newsletter that did not go out, a partner who removed a link, a campaign that ended. The referrer report answers this in one look.
The one that catches everybody
If the fall is exactly at midnight, or exactly at a deploy, it is measurement. If it slopes over days, it is more likely to be real.
Two causes look identical to a real drop and are not: bot traffic that was being counted and now is not, and a traffic exclusion somebody added and forgot. Both are visible from the Analytics page before you go looking for a marketing explanation.
Related: why two analytics tools never agree, what direct traffic really means, and when the snippet is not working.