Google Analytics Bot Traffic: How to Find and Filter It in GA4 (2026)

Google Analytics 4 removes traffic from known bots and spiders automatically, and you can't turn that off. Everything else gets recorded. A bot that runs a real browser loads your Google tag like any visitor, so it shows up as sessions, users, and sometimes key events. GA4 gives you three ways to deal with it: spot it in Explorations, hide it from reports with segments and filters, and drop some of it at collection with data filters. None of them stops a bot from filling in your form or being reported to Google Ads and Meta as a conversion.

GoodInbound Lead Screen catches the bots that cost you money: the ones that fill in your forms and get counted as leads. It adds one script to the form you already have, with no CAPTCHA:

• Every submission gets a label, lead, review, spam, junk, or bot, with a one-line reason based on how the form was filled in, the network it came from, and the email address and phone number.
• Only accepted leads go back to your ad platforms as conversions: natively to the Meta Conversions API and TikTok Events API, and to Google Ads through a goodinbound_lead event in Google Tag Manager.
• Ad visits show which campaigns send traffic that never engages, and flag IPs that arrive from your ads 5 or more times in 2 hours.
• It works on HubSpot, Webflow, WordPress, Framer, Marketo, and plain HTML forms, or through a REST API.

The free plan screens 500 submissions a month with behavior, network, and identity checks; ad visits and the message check are part of Pro at $29 a month. Start free, or read on for the GA4 steps.

What GA4 filters automatically, and what gets through

Google's help center says GA4 excludes traffic from known bots and spiders automatically. Known bots are identified with Google's own research and the International Spiders and Bots List maintained by the IAB. You can't turn the exclusion off, and you can't see how much traffic it removed (known bot-traffic exclusion).

The important word is "known". The list matches bots that declare themselves, like search engine crawlers and monitoring services. Bots built to look human don't declare themselves, and those are the ones that reach your reports:

• Bots running a full browser. Headless Chrome and other automation tools run JavaScript, so your Google tag fires and the visit arrives with an ordinary browser, device, and screen size.
• Fake visitors on paid campaigns. A bot that clicks your ad lands with the click ID and UTM tags attached, so GA4 files it under Paid Search or Paid Social like a real click.
• Form bots. They load the page, fill in the form, and submit it, which fires your generate_lead event or thank-you page key event.
• Hits that never touch your site. Events sent to your measurement ID from somewhere else: another site running your tag, or the Measurement Protocol with a leaked API secret.

Crawlers that fetch your HTML without running JavaScript never fire the tag, so they only show up in your server or CDN logs. For where bot traffic comes from and what it costs beyond analytics, see our guide to bot traffic.

Signs of bot traffic in Google Analytics

No single number proves a session came from a bot. Look for several of these signs in the same slice of traffic: one source, one city, or one landing page.

1. Sessions with no engagement. GA4 counts a session as engaged when it lasts longer than 10 seconds, includes a key event, or has 2 or more page views (engagement rate). A source with an engagement rate near 0% and an average engagement time of 0 seconds is almost never people.
2. A spike from one city. Since late 2025, many sites have reported waves of sessions from China, often Lanzhou, and from Singapore, lasting 0 to 3 seconds with (not set) landing pages (Castus). GA4 doesn't log or store IP addresses (IP masking) and doesn't report the visitor's network, so the city is often the best clue you get.
3. Referrers and hostnames you don't recognize. Referral domains selling SEO or "free traffic", or a Hostname dimension listing domains that aren't yours.
4. 100% new users. When New users equals Total users for a source and nobody ever returns, the visitor is probably starting from a fresh browser each time, as most bots do.
5. Direct or Unassigned bursts. Direct means a visitor typed your URL or used a saved link. Unassigned is what GA4 uses when no channel rule matches (default channel group). A sudden jump in either, with no campaign, email, or press mention to explain it, deserves a look.
6. One browser, OS, or screen resolution. A spike that's all Chrome on Windows 10 at one resolution, or (not set) for country, points to one bot setup repeating itself.
7. Landing pages that don't exist. Sessions that land on 404 pages, on URLs with strange parameters, or on (not set).
8. Paid clicks that don't engage. A campaign with plenty of sessions but almost no engaged sessions, or an ad platform reporting far more clicks than GA4 shows sessions. Some gap is normal, so read why landing page views trail link clicks before blaming bots.

Bot spike or real spike? A real traffic spike has a cause you can find, like a post, a newsletter, or a mention. It engages, spreads across many cities and devices, and brings back some returning users. A bot spike clusters on one source, one city, and one device setup, and drags down engagement for the whole site.

Where to look first:

How to identify bot traffic in GA4 with Explorations

Standard reports show one dimension at a time. Explorations let you combine them, which is how you narrow a spike down to the pattern that describes the bot.

1. Open Explore and start a Free form exploration.
2. Set the date range to cover the spike and a few normal weeks before it.
3. In the Variables column, click + next to Dimensions and add Session source / medium, Session default channel group, Country, City, Landing page + query string, Hostname, Browser, and Screen resolution.
4. Click + next to Metrics and add Sessions, Engaged sessions, Engagement rate, Average engagement time per session, New users, Total users, and Key events.
5. Drag Session source / medium into Rows and the metrics into Values. Sort by Sessions and look for big rows with an engagement rate near zero.
6. Swap the row dimension for City, Landing page, Browser, and Screen resolution in turn, with a filter on the suspect source, until you find the combination that describes the spike.
7. Right-click the suspect row and choose Create segment from selection, or click + beside Segments to build one by hand.

A useful pair is a "Likely bots" session segment, for example City exactly matches Lanzhou and Session default channel group exactly matches Direct, and a "Clean traffic" segment with the same conditions in an exclusion group. You can apply up to four segments at a time, and Editors can click Save to property to share them with the team (segments in explorations).

Then switch the visualization to a line chart to see when the traffic started and whether it's still running. Note the dates, so you know which periods need the segment when you report on them later.

How to filter bot traffic out of GA4 reports

GA4 has two kinds of filters, and the difference matters:

• Report filters and segments change what you see. They work on past data, and you can remove them at any time.
• Data filters change what GA4 keeps. They only apply to new data, and what they exclude is gone for good, from GA4 and from BigQuery (data filters).

Report filters

In a detail report, click + Add filter above the chart, choose a dimension, a match type, and the values, then click Apply. To remove bots, use a "does not" match type, such as "does not exactly match" or "does not match regex", on City, Session source, or Browser. You can add up to 4 more conditions (report filters).

Regex match types are case sensitive and limited to 250 characters. A filter of Hostname matches regex ^(www\.|app\.)?example\.com$ keeps only events recorded on your own domains.

These filters are temporary: they're gone the next time you open the report, unless an Editor customizes the report and saves it with the filter. Expect to hide a few real visitors too, since a bot on Chrome and Windows 10 shares those values with real people. If the bot is big, the trade is worth it.

Segments and Looker Studio

Saved segments do the same job inside Explorations. In Looker Studio, add the exclusion as a report-level filter so every chart uses it.

Data filters

Data filters are the only GA4 setting that keeps traffic out of your data, and they only filter on three things (data filters):

• Internal traffic: IP addresses or ranges.
• Developer traffic: events sent in debug mode.
• Web hostname traffic: the domain an event was recorded on.

You can create up to 10 data filters per property (internal traffic). There's no data filter for country, city, browser, source, or user agent, and those are the only dimensions that describe most bots. So most bot traffic can be hidden from reports, but not kept out.

How to exclude bot traffic in GA4 by IP address

The internal traffic feature is meant for your own team, but it filters any IP address, so it also works for a bot that always comes from the same address or range. You need Editor access on the property (define internal traffic).

First, define the rule:

1. Go to Admin → Data collection and modification → Data streams and click your web stream.
2. Click Configure tag settings, then Show more, then Define internal traffic, then Create.
3. Name the rule, for example "Known scraper".
4. Change the traffic_type value from internal to something like bot, so you can test and filter it separately from your team's traffic.
5. Pick a match type for the IP address: equals, begins with, ends with, contains, is in range (CIDR notation, like 203.0.113.0/24), or matches regular expression. IPv6 addresses work too.
6. Click Add condition for each extra address or range (conditions are joined with OR), then click Create.

Then create the filter:

1. Go to Admin → Data collection and modification → Data filters and click Create filter.
2. Choose Internal traffic, name the filter, choose Exclude, and enter bot as the traffic_type value.
3. Set the filter state to Testing and click Create.
4. After 24 to 36 hours, build a free-form exploration with Test data filter name and Event name as rows and Event count as the value. If only the bot's events show up under your filter's name, switch the filter to Active.

There are two catches. GA4 never shows you IP addresses, so you need them from your server or CDN logs, your firewall, or a tool that records visitor IPs. And the filter only works when the IPs stay put: an uptime monitor or a scraper on a fixed range, yes; bots on rotating cloud or residential proxy IPs, no.

The same steps, with traffic_type left as internal, are how you filter out your own team's visits. Add a Developer traffic filter too, so testing in debug mode stays out of your reports.

With Google Tag Manager you can go further and set traffic_type yourself when a visit matches a bot pattern, or stop the Google tag from firing for it. That takes custom triggers or JavaScript, so save it for a persistent, well-defined bot.

Hostname filters, unwanted referrals, and Measurement Protocol spam

These three get mixed up, and only one of them removes data.

Web hostname filter

A web hostname traffic filter drops events based on the domain they were recorded on. Set it to Include only with your own domains, and events recorded anywhere else are discarded: an old staging site, a scraped copy of your pages still running your tag, or a site using your measurement ID. Create it under Admin → Data filters → Create filter, choose the web hostname type, pick Exclude or Include only, and match with exactly matches, begins with, ends with, or contains (web hostname filter).

First list every hostname you use, including checkout and app subdomains, with the Hostname dimension in an exploration. A domain left off an Include only filter loses real traffic, so keep it in Testing for a few days.

Unwanted referrals

List unwanted referrals sits under Admin → Data streams → your web stream → Configure tag settings → Show all, and takes up to 50 domains per stream (unwanted referrals). It's built for payment processors and similar sites that send visitors back to you, and it doesn't remove anything: matching events get an ignore_referrer flag, so the session still counts but isn't credited to that domain.

That's why referral spam you add here doesn't go away. It reappears as Direct, or gets credited to an earlier source. Hide spam referrals with a report filter or segment instead.

Measurement Protocol spam

The Measurement Protocol lets a server send events straight to GA4, and every request needs an API secret. Google says to keep the secret confidential and never put it in client-side code, because anyone who has it can add arbitrary data to your property (sending events).

If you see events your site couldn't have sent, check whether a secret is exposed. Delete it under Admin → Data streams → your stream → Measurement Protocol API secrets, and create a new one for your server. Don't count on a hostname filter here: according to Loves Data, Google says the Include only hostname filter isn't applied to Measurement Protocol events.

How to stop bots before they reach GA4

Filtering in GA4 cleans up after the fact. To keep bots out of your data, stop them before the tag fires:

• Firewall and CDN rules. Challenge or block traffic from hosting and datacenter networks, countries you don't serve, and known bad user agents. Most CDNs can match on ASN, the network an IP belongs to, which keeps working when a bot changes IP within the same network.
• Server-side tagging. With a server-side Google Tag Manager container, your own server decides whether to forward each event to GA4, so it can drop requests that match a bot pattern.

Both have a cost. A country block turns away real buyers who travel or use a VPN, and an over-eager rule can challenge Googlebot. Start with challenges rather than blocks. And neither one decides whether a lead is real: a bot that gets past them, or a person paid to fill in forms, still submits.

Why clean reports don't mean clean conversions

Every GA4 filter changes what GA4 shows or keeps. None of them undoes what the bot already did:

• The form was still submitted. The fake lead is in your inbox and your CRM, and someone on your team will try to call it.
• The conversion was still reported. If your thank-you page fires the Meta pixel or a Google Ads conversion tag, the ad platform counted the bot's submission the moment it happened. Report filters and segments don't change anything GA4 shares with Google Ads either.
• Your campaigns learned from it. Ad platforms bid toward people who look like your converters. Fake conversions teach them to find more traffic like the bots.
• The click was still paid for. Hiding a fake visit in GA4 doesn't change what the ad platform charged you.

So the decision about what counts as a lead has to happen at the form, before any conversion is reported.

That's what Lead Screen does. It labels every form submission lead, review, spam, junk, or bot, with a one-line reason, from how the form was filled in (fill time, typing, automation, pasted text), the network (datacenters, VPNs, repeat submissions from one IP, blocked countries), and the email and phone number, using the same checks as the email validation API and phone validation API. On Pro, it also reads the message to catch sales pitches and junk.

Only accepted leads are sent back as conversions: natively to the Meta Conversions API, as a Lead event with hashed email and phone deduplicated with your pixel, and to the TikTok Events API. For Google Ads, it pushes a goodinbound_lead event to Google Tag Manager or calls a webhook, and you fire your conversion tag on that instead of on the thank-you page.

For paid traffic, ad visits in Lead Screen records visits that arrive with a click ID (gclid, msclkid, fbclid, and others) or paid UTMs, and shows per campaign how many engaged, became leads, and were accepted. It flags IPs with 5 or more ad visits in 2 hours, the IPs GA4 never shows you. Exclude copies the IP with steps to add it to your Google Ads exclusions yourself; nothing is excluded automatically.

To try the checks first, paste a submission into the free form spam checker. For form spam beyond bots, see how to stop contact form spam.

Which fix for which problem

FAQ

Does Google Analytics count bot traffic?

Partly. GA4 excludes traffic from known bots and spiders, using Google's research and the IAB's International Spiders and Bots List. Bots that aren't on that list, especially ones running a real browser, are counted like any visitor, so most GA4 properties include some bot traffic.

How do I see bot traffic in GA4?

There's no bot report. Look for traffic with an engagement rate near zero, 0-second engagement time, 100% new users, and a cluster on one city, source, browser, or screen resolution. A free-form exploration isolates it fastest.

How do I remove bot traffic from past GA4 data?

Data filters only apply to new data, so bot sessions already collected stay in your property. For past periods, hide them with a segment in Explorations, a report filter, or a filter in Looker Studio.

How do I filter out internal traffic in GA4?

Define your office or VPN IP addresses under Admin → Data streams → your web stream → Configure tag settings → Define internal traffic. Then create an Internal traffic data filter set to Exclude. Leave it in Testing for a day or two, check it in an exploration, then set it to Active.

Why does referral spam show up as Direct after I add it to unwanted referrals?

Unwanted referrals don't remove sessions. GA4 ignores the referrer, so the visit is reported as Direct or credited to an earlier source. Hide spam referrals with a report filter or segment instead.

Can IP filtering stop bot traffic in GA4?

Only for bots that stay on the same IP or range. Bots that rotate through cloud or residential proxy IPs get past any list, and GA4 doesn't show IP addresses, so you'd need your server logs to build one.

Is bot traffic bad for your website?

Not all of it. Search engine crawlers are how you get indexed. The harmful kind skews your reports, wastes ad spend on fake clicks, fills your forms with fake leads, and trains your campaigns on conversions that were never real.