Bot traffic in Google Analytics

Traffic tripled on Tuesday.
Nobody new came.

GA4 already removes known bots and spiders on its own, from a list you can’t switch off or inspect. What reaches your reports anyway is automation that looks like a browser: headless Chrome, scrapers in data centres, traffic through residential proxies, referral spam and the odd fake event. You spot it by the pattern, not the visit: a spike from one city, sessions of no seconds, a pile of (not set), and screen sizes nobody owns. Below: what GA4 does by itself, what slips through, a checker that scores your own numbers, and the filters worth setting. Weighing up whether GA4 is worth this much effort? The guide to simpler Google Analytics alternatives compares the options.

Check my numbers How to filter it in GA4
7 signals GA4 filters checked 14 Oct 2026

By the Builderify team

01 A record week 02 Split by network 03 The people line is flat

Illustration, not real data

01 / What GA4 removes

Does Google Analytics
filter bot traffic?

Yes, the known ones. Google’s help page says traffic from known bots and spiders is excluded automatically, identified by a combination of Google’s own research and the International Spiders and Bots List kept by the IAB. You can’t switch it off, and you can’t see how much it removed.

“Known” is the word doing the work. A bot that names itself can be on the list; one that drives a real browser and calls itself Chrome won’t be. And bots that never run JavaScript don’t reach GA4 at all: the tag is a script, so a crawler that only reads your HTML never fires it. Your server logs see those; your analytics doesn’t.

Bots and GA4, in four numbersFrom the sources
Always on
Known-bot exclusion in GA4. There is no setting to turn it off and no report of what it removed. Source
$5,000
A year for IAB Tech Lab members to subscribe to the Spiders & Bots List ($15,000 for non-members). It is updated monthly. Source
Over 53%
Of all web traffic was automated, says Imperva’s 2026 Bad Bot Report, its analysis of full-year 2025 bot activity. Not all of it is harmful: search crawlers count too. Source
0
Dimensions in GA4’s Data API for the network, provider or IP behind a visit. Country and city are as close as it gets. Source

Every request to your site goes through one of three doors.

Only the third ends up in your reports, and it’s the one this guide is about.

  1. Doesn’t run JavaScript

    Simple crawlers, scrapers and vulnerability scanners that fetch the HTML and leave.

    Never reaches GA4. Your server logs see it.

  2. Runs JavaScript, on the known-bot list

    Bots that name themselves and are on Google’s list or the IAB’s.

    Dropped by GA4 automatically. You can’t see how many.

  3. Runs JavaScript, not on the list

    Headless browsers, data-centre tools and proxy traffic that look like a visitor.

    Counted as a visitor, in every report.

02 / What slips through

Why is there still bot traffic
in GA4?

Because the bots that matter are built not to look like bots. Five kinds get past the list, and each leaves a different mark in your reports.

  1. 01

    Headless browsers

    Real Chrome, driven by a script, with no window. It runs your tags like any visitor and can send any user agent it likes, so a list of known bot names doesn’t catch it.

    Shows up as
    Short visits, odd screen sizes, data-centre cities
  2. 02

    Data-centre machines

    Scrapers, SEO and price-checking tools, link previews and uptime monitors that load pages from rented servers in cloud data centres.

    Shows up as
    One city, one provider, at all hours
  3. 03

    Residential proxies

    Automated traffic routed through ordinary home connections, so each address looks like a person’s. The hardest kind to spot by address alone.

    Shows up as
    Normal cities; identical paths and no time on page
  4. 04

    Referral spam

    Visits, real or faked, that exist to put a site’s name in your referral report, hoping you’ll go and look.

    Shows up as
    An unfamiliar referrer at 0% or 100% engagement
  5. 05

    Ghost hits

    Events sent straight to Google without loading your site. GA4’s Measurement Protocol needs a private API secret for that; Universal Analytics only needed the public tracking ID, which is why ghost spam filled old reports.

    Shows up as
    Hostnames that aren’t yours, (not set) pages

Paying for clicks makes this sharper: the seller’s report counts everything it sent. The guide to checking solo ad traffic quality counts the same order on a link you control, unique and flagged clicks included.

03 / Signs in the numbers

How to identify bot traffic
in your reports.

One odd number is a question. Three that changed on the same day are an answer. Read these against a normal week, the same pages, the same season.

  • A spike from one place

    Visitors jump with nothing you did to explain it, and the extra all come from one city. Cloud-server towns such as Ashburn, Virginia show up when the visits come from data centres.

    In GA4: the city report, for the spike’s days

  • Engagement at the extremes

    A pile of sessions at 0 seconds, and an engagement rate in single figures. Or the opposite: 100% engaged across hundreds of sessions, which scripted visits that scroll or fire events can produce. People are never that tidy.

    In GA4: Traffic acquisition, engagement columns

  • (not set) where a value should be

    GA4 writes (not set) when it receives nothing for a dimension: no session start for the source, no page view for the landing page. A tagging gap explains a little. A lot of it, arriving with a spike, looks like events sent from outside a browser.

    In GA4: source, landing page, city

  • Screens nobody owns

    A block of visits at one exact size. 800×600 is the default window of Puppeteer, a popular tool for driving Chrome from a script, so a lot of it is worth a look. So is a device mix that suddenly turns all desktop.

    In GA4: the Screen resolution dimension

  • Visits at 4 am, in neat rows

    People sleep. Scheduled jobs don’t. Visits that pile up in the small hours of your audience’s time zone, at the same minutes every night, come from a timer, not a person.

    In GA4: an Exploration by hour

  • Language and place disagree

    A city in one country and a browser language from another is normal for one traveller. Hundreds of identical ones isn’t. Builderify’s visitor profiles also compare the browser’s clock with the IP’s country.

    In GA4: Language against Country

A burst of Direct traffic often travels with these, because automated visits often arrive without a referrer. Not all Direct is bots, though: the guide to what direct traffic really is sorts out the rest.

04 / Bot signal checker

Is your traffic spike real?
Score your own numbers.

Copy a day’s or a week’s numbers from GA4, or from Builderify, or start from an example. Each signal is scored, explained, and turned into a range for how much of the traffic was probably people. Leave a box empty if you don’t have it.

Your numbers
Start from an example

GA4: Active users, for a day or a week

For a period of the same length

In Journey: visits

Or 100 minus bounce rate

Per session

Top city ÷ all visitors

Of sessions, in any report

If you have it

If you have it

Probably human
10–50%

≈ 346–1,730 of 3,460 visitors

Mostly machines.

12 of 14 points from 7 signals

  • Traffic against usual 3× Strong

    Three times your usual 1,150 or more. With no campaign, post or mention behind it, a jump like this is the most common sign of a crawler.

  • Engagement rate 4% Strong

    Almost no session lasted 10 seconds, saw a second page or reached a key event, which is GA4’s test for an engaged one. One-page machine visits look exactly like this.

  • Average engagement time 1.4 s Strong

    Under 3 seconds a session: pages loaded and nobody stayed to read them.

  • Top city’s share 58% Strong

    Half or more from one city. Unless you sell locally, check it: data-centre towns such as Ashburn, Virginia are where cloud servers live, not customers.

  • (not set) share 3% OK

    Hardly any, so events are arriving the way a browser sends them.

  • Data-centre or VPN share 62% Strong

    A quarter or more from hosting companies, VPNs or proxies. Data-centre visits are nearly always machines; VPN ones are often privacy-minded people.

  • Visits under 5 seconds 86% Strong

    Most visits ended before a page could be read.

Do this first
  1. 1Line the spike up with what you published that day. If nothing explains it, open the city and landing-page reports for those days only.
  2. 2Compare the spike’s landing pages with a normal week: scripted visits usually hit one page, the same page, every time.
  3. 3Check the city against where cloud servers live. If it’s one, ask your host or firewall to challenge or block that network.
+ How the checker decides

Each signal you fill in scores 0 (OK), 1 (Watch) or 2 (Strong). Amber starts at: 1.5 times your usual visitors, an engagement rate under 30% or over 95% (with 50 sessions or more), under 10 seconds of engagement, a quarter from one city, 5% (not set), 10% data-centre or VPN, and 40% of visits under 5 seconds. Red starts at: three times usual, under 15% or over 99% engaged, under 3 seconds, half from one city, 20% (not set), 25% flagged, and 60% under 5 seconds.

The share of possible points picks a band for the machine share: none at all is 0–5%, then 0–15%, 5–30%, 15–50%, 30–70% and 50–90%. Your own numbers can widen it: half to all of a data-centre or VPN share counts, because data-centre visits are nearly always machines and VPN ones often aren’t, and when another signal is red, half to all of the visitors above your usual count too. “Probably human” is what’s left.

These lines are rules of thumb for deciding where to look, not a measurement. Treat the range as a reason to dig, not a number to report.

05 / Filter it

How to filter bot traffic in GA4,
and where filters stop.

GA4 has no “exclude bots” switch beyond the automatic one. What it has are filters for hostnames, referrers and your own team, and every one of them works forward only: a data filter never changes data you already have.

  1. 01

    Keep only your own hostnames

    Admin › Data collection and modification › Data filters › Create filter › Web hostname traffic, set to Include only, with your domains. Leave it in Testing first: matching data gets a “Test data filter name” value you can check after 24–36 hours.

    Limit  Stops events that claim to come from a site that isn’t yours. A bot on your real pages carries your real hostname.

  2. 02

    List spam referrers as unwanted

    Admin › Data streams › your web stream › Configure tag settings › Show all › List unwanted referrals. Up to 50 per stream.

    Limit  It hides the referrer as a traffic source. The visits stay in your totals.

  3. 03

    Filter your own visits, by IP

    Configure tag settings › Define internal traffic: an address, a range in CIDR notation or a pattern, labelled with traffic_type. Then switch the Internal traffic data filter from Testing to Active.

    Limit  Meant for your office and your team. Bots change addresses faster than you can list them, and a property holds 10 data filters.

  4. 04

    Look at the past without them

    Data filters don’t change data you already have, and once active their effect is permanent. To study last month, use a comparison or report filter that leaves out the spike’s city or source instead.

    Limit  Report filters hide data in one view; nothing is deleted.

  5. 05

    Keep the API secret secret

    The Measurement Protocol secret lives under your web stream’s Measurement Protocol API secrets. Google’s own words: “Don’t expose it in the client-side code of your website or app.”

    Limit  If one leaked, delete it and make a new one.

  6. 06

    Stop them at the door

    Bot protection or a web application firewall from your host or CDN can challenge data-centre networks before a page loads, which also saves your server the work.

    Limit  robots.txt only asks. RFC 9309 says its rules “are not a form of access authorization”; polite crawlers obey, the rest don’t.

IP exclusion is for you, not for bots

GA4’s IP rules live under “internal traffic” for a reason. A crawler on a cloud host can come back tomorrow from another address, and a property holds 10 data filters in all. Block networks at the door; use IP rules for your office.

Paying for the traffic?

Count it before it reaches your site. A short link per order records unique clicks with proxy and data-centre flags, and the affiliate click guide shows the same trick for free traffic, one link per platform.

06 / With Builderify

Data-centre traffic,
named and set aside.

Builderify’s User Journey does what GA4 can’t: it looks up the network behind each new visitor’s address and sorts them into real people, VPN and proxy, and data centre. The Insights page shows the split, the trend over time, and the providers behind the flagged visits, so “who was that?” usually has a name.

Each new visitor costs 0.1 credits, out of 250 free every month; see pricing. Every visitor also gets a page-by-page timeline, which is how a bot’s identical path gives itself away; the user journey tracking guide covers reading one.

What Builderify does

  • Splits every period’s visitors into real people, VPN and proxy, and data centre, from the network behind each IP address
  • Names the providers behind the flagged traffic, with how many of their visitors left after one page
  • Real people only takes flagged visitors out of every figure on Insights; the visitor list filters the same way
  • Each visitor’s profile shows their network, and warns when the browser’s clock doesn’t fit the IP’s country
  • The script doesn’t start for browsers whose user agent contains bot, crawl, spider, headless, Lighthouse or PageSpeed, among a few others: no page load, no journey, no charge

Know this first

  • Flags are signals from the address, not proof: a VPN visitor can be a customer, and a bot on a home connection passes as a person
  • The check runs in the background after a new visitor arrives. Until it answers they show as “Not checked yet”, and a few never get an answer
  • A flagged visitor is still a new visitor, charged 0.1 credits like anyone else. A bot that clears its cookies arrives new each time
  • There’s no IP or referrer block list. You can exclude paths; blocking belongs at your host or firewall

More on reading your analytics

Questions

Bot traffic in analytics, before you ask.

Yes, the known ones. GA4 excludes traffic from known bots and spiders automatically, using Google's own research and the IAB's International Spiders and Bots List. You can't switch it off or see how much it removed, and bots that drive a real browser and present themselves as ordinary visitors aren't on that list.

Look for several signs changing on the same day: a spike with nothing you did to explain it, most of it from one city, engagement time near zero or engagement rate at 100%, a jump in (not set), and a block of visits at one odd screen size such as 800×600. One odd number is a question; three together are usually an answer.

Use a Web hostname data filter that includes only your own domains, list spam referrers under List unwanted referrals, and use IP-based internal traffic filters only for your own team. Data filters work only on new data and their effect is permanent, so test them first. Bots that keep changing address are best stopped by your host's firewall or bot protection.

No. GA4 data filters don't change data already collected. To look at an earlier period without a spike, use a comparison or report filter that leaves out its city or source; that hides the visits in that view without deleting anything.

No. robots.txt is a request that well-behaved crawlers follow; the standard itself says its rules are not a form of access authorization. Scrapers and spam bots ignore it, so block them at your host, CDN or firewall instead.

Sources

Read on 14 October 2026.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does