Does Google Analytics Exclude Bots?

Ever checked your Google Analytics and seen a sudden, inexplicable traffic spike from a location you don't even serve? You're likely looking at bot traffic. This article explains how Google Analytics handles bots, how to spot them in your data, and what steps you can take to get a more accurate picture of your actual human audience.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What Exactly is Bot Traffic?

Bot traffic refers to any website visit that isn’t made by a human. These automated scripts, or "bots," crawl the web for all sorts of reasons. Not all of them are malicious, but all of them can skew your analytics data, making it difficult to understand how real users are interacting with your site.

There are generally two categories of bots:

• Good Bots: These are the bots you want visiting your site. Think of search engine crawlers like Googlebot, which scan your pages to index them for search results. Others include SEO tools like Ahrefs or Semrush, which analyze your site for performance metrics. They perform essential functions for online visibility.
• Bad Bots: This is a much broader and more troublesome category. It includes everything from spambots that leave junky comments to scrapers that steal your content, and click fraud bots that intentionally waste your ad budget. These bots can inflate your traffic and session counts while wrecking other metrics like bounce rate and conversion rates.

The problem is that, to Google Analytics, a visit is just a visit. Without proper filtering, a spam bot from a data center in a random country looks the same as a potential customer from your target market. This inflates your numbers, ruins your conversion rates, and leads to bad decisions based on faulty data.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

How Google Analytics Filters Bot Traffic by Default

Google Analytics has a vested interest in providing clean data, so it does have a built-in mechanism for fighting bots. Tucked away in the admin settings is a simple checkbox: "Exclude all hits from known bots and spiders."

When you enable this feature, Google Analytics filters out traffic from sources on a list maintained by the IAB (Interactive Advertising Bureau), known as the "IAB/ABC International Spiders & Bots List." This list is a comprehensive catalog of known, legitimate crawlers and automated agents. It’s effective at removing a significant chunk of the "good bots" and many common, easily identifiable "bad bots."

Is the Default Filter Enough?

In short, no. While the IAB list is a great start, it's not a foolproof solution. The world of malicious bots is constantly evolving, with new bots being created every day that aren't on this list. More sophisticated bots are designed specifically to mimic human behavior, making them harder to detect automatically. The default setting will catch a lot of the low-effort spam, but plenty of bot traffic will still slip through the cracks and into your reports.

Signs That You Have a Bot Traffic Problem

Since you can't rely solely on the default filter, you need to learn how to spot the common symptoms of bot activity in your analytics. Here are a few red flags to watch for:

• Sudden, Sharp Traffic Spikes: If your sessions suddenly double overnight for no apparent reason - no new marketing campaign, no viral content - it’s often due to bots. Real traffic growth is usually more gradual.
• Extremely High or Low Bounce Rates: Look for bounce rates of exactly 100% or close to 0%. Malicious bots often hit a single page and leave immediately (100% bounce rate). Other types of bots might trigger multiple fake events on a page, resulting in an unnaturally low or 0% bounce rate.
• Un usually Long or Short Session Durations: A bot might stay on a page for hours, leading to an impossibly high average session duration. Or, it might stay for exactly 0 seconds. Look for these extremes in your engagement reports.
• Suspicious Geographic Locations: Are you suddenly getting a ton of traffic from a country where you don’t do business and have never advertised? This is a classic sign of bot networks. Drill down into your location reports to see where those traffic spikes are really coming from.
• Weird Referral Sources: Check your acquisition reports for referral spam. These are sketchy-looking domains that appear in your referral traffic, often with names like "-marketing-for-you.com" or other spammy variations. These are not real referrals, they are bots trying to get you to visit their site.
• A Flood of "(not set)" Data: While "(not set)" can appear for many legitimate reasons, a large, sudden increase in "(not set)" values across your reports (like in browser, screen resolution, or language) can sometimes point to bot traffic that doesn't provide this information.

How to Clean Up Your Google Analytics Data

If you're noticing any of the signs above, it’s time to take action. Here’s how you can manually clean up your data in Google Analytics 4.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

1. Enable the Built-in Bot Filtering

First things first, make sure the automatic filter is on. It might seem obvious, but it's an easy setting to miss.

In GA4, this setting has moved. Go to Admin → Data Streams → Click your web stream → Configure tag settings → Show all → Internal traffic and unwanted referrals. From there, ensure your Web Tag Settings have "Traffic from known bots is excluded by default in Google Analytics 4." It’s typically on by default but always wise to confirm.

2. Exclude Specific IP Addresses

If you identify a suspicious IP address that's a repeat offender, you can exclude it directly. This is also a great practice for filtering out internal traffic from your own team, which can also skew your data.

How to find suspicious IPs:

Unfortunately, GA4 no longer shows IP addresses in its reports due to privacy reasons. You’ll need to analyze your server logs to find the IP addresses sending spam traffic to your site. Look for IPs with an unusually high number of requests in a short period. Once you have a list, you can exclude them in GA4.

How to exclude the IP in GA4:

1. Go to Admin → Data Streams → Click your web stream.
2. Under Google Tag, click Configure tag settings.
3. Click Show all, then select Define internal traffic.
4. Click Create. Give your rule a name (e.g., "Bot IP Block").
5. Under IP addresses, select a Match type (like IP address equals) and paste in the suspicious IP address.
6. Click Create to save it. Now, you need to activate this filter.
7. Go to Admin → Data Settings → Data Filters. You'll see an "Internal Traffic" filter in "Testing" mode. Click the three dots, choose Activate filter, and you're set.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

3. Filter by Hostname

A common type of spam involves "ghost" traffic. This is when bots don't even visit your website. Instead, they send fake data directly to Google Analytics servers using your Measurement ID. An easy way to spot this is that the fake data won't have your website's domain as the hostname.

You can create a filter to ensure that only traffic from your own valid hostnames (your domain, subdomains, payment portals, etc.) is included.

How to create a hostname filter in GA4:

Unlike Universal Analytics, GA4 doesn't have view-level filters anymore. However, you can manage this in your tag configuration settings. By default, GA4's data collection is generally tied to the domain where you installed the tag, making direct ghost spam less of a problem. But for extra security, especially if you see suspicious hostnames in your reports:

1. Go to your Admin → Data Streams → Click your web stream → Tagging Instructions view.
2. Check your Tag installation instructions and ensure that your tracking code is implemented correctly only on your domain.
3. For advanced filtering to ONLY include your hostname, head to Configure Tag Settings → Show All → List unwanted referrals. Here you can configure rules for what domains are not allowed to be a referrer, which can help eliminate some spam. However, a more robust "include own hostname only" filter is best implemented using Google Tag Manager with triggers that only fire on your specific domain.

Final Thoughts

Google Analytics does a decent job of excluding known bots, but its default settings aren't a magical fix. Malicious and spammy traffic can still find its way into your reports, compromising the data you rely on to make key business decisions. By regularly monitoring for the signs of bot activity and applying your own filters, you can ensure your data is as clean and accurate as possible.

We know how much time this can take. Instead of spending hours digging through GA settings, what if you could just ask for the data you need? With Graphed, we connect directly to your Google Analytics account - and all your other marketing platforms - to bring your data together in one place. By turning hours of data analysis into a simple conversation, you can ask questions like "Show me my traffic from the US last month, excluding known referral spam domains" and get an instant, clear answer without having to build a single filter yourself.