How to Clean the Spam in Google Analytics

Seeing a sudden spike in website traffic can feel exciting, but when you dig in and see that it came from strange-looking referral domains, it's usually just spam. This junk data messes with your metrics, misleads your marketing strategy, and makes it impossible to know what's actually working. This guide will walk you through exactly how to spot and eliminate spam traffic in Google Analytics 4, ensuring your reports reflect real human behavior.

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

What Exactly is Google Analytics Spam?

Spam in Google Analytics isn't just one thing, it typically falls into a couple of main categories. You don't need to be a security expert to understand them, but knowing the difference helps you identify the problem faster.

Ghost Spam

This is the most common and strangest type. Ghost spam never actually visits your website. Spammers use the Measurement Protocol - a tool that lets developers send data directly to Google Analytics servers - to send fake hits to random GA4 tracking IDs. They basically "pretend" to visit your site without ever loading a single page.

• How it works: A script sends fake data (like a pageview or session event) tagged with your specific G- measurement ID.
• Why they do it: Usually to get you to visit their website out of curiosity when you see it in your referral reports. A domain like "get-free-traffic-now.com" might appear, tempting you to check it out.
• The main clue: Ghost spam often has a "(not set)" or fake hostname because it never accessed your website's server.

Crawler Spam (Bot Spam)

Unlike ghost spam, crawler spam involves actual automated bots visiting your website. These are programs or scripts that crawl web pages. Some bots are good (like Google's own crawler that helps with indexing for search), but many are malicious or just annoying.

• How it works: These bots visit your site, often very briefly, triggering your GA4 tracking code just like a real person would.
• Why they do it: Their goals vary - scraping content, looking for security vulnerabilities, or simply leaving a referral URL in your analytics.
• The main clue: These visits look a little more realistic than ghost spam, but they typically have an extremely short session duration and often hit only a single page before leaving.

Whether it's a crawler or a ghost, the outcome is the same: your data gets distorted. Suddenly your user count is inflated, your average session duration plummets, and your conversion rate looks terrible. This noisy data can lead you to make bad decisions, like pausing a marketing campaign that was actually working or investing in a channel that's 90% bots. Cleaning it up is fundamental to reliable business reporting.

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

How to Spot Spam Traffic in Your GA4 Reports

Before you can block spam, you need to be confident you've found it. Spammers are getting sneakier, but they usually leave a trail of obvious clues. Here's what to look for and where to find it inside Google Analytics 4.

1. Check Your Traffic Sources for Suspicious Referrals

This is often the first and most obvious sign. If you see referrals from sites you don't recognize and whose names sound spammy or irrelevant to your business, you're likely looking at referral spam.

Steps to find it in GA4:

1. Navigate to Reports → Acquisition → Traffic acquisition.
2. The default primary dimension is Session default channel grouping. Click the drop-down menu and change it to Session source / medium.
3. Scan the list of traffic sources. Look for domains that seem off — things like "get-free-traffic.co," "buttons-for-your-website.com," or other nonsensical URLs. Real referrals come from legitimate websites, social media platforms, or trusted partners. Anything that screams "marketing scheme" is almost certainly spam.

Take note of any domains you find - you'll need this list soon.

2. Analyze the Hostname Dimension

The hostname is the domain where your GA4 tracking code fired. For 99% of businesses, this should only be your own website's domain (e.g., yourwebsite.com) or any subdomains you use (e.g., blog.yourwebsite.com or shop.yourwebsite.com). Ghost spam often uses fake hostnames or leaves them "(not set)."

Steps to find it in GA4:

1. Go to Reports → Engagement → Pages and screens.
2. Just above the data table, click the small blue "+" button to add a secondary dimension.
3. In the search box, type "Hostname" and select it.

Now you'll see a new column in your report. Every single row should show your own domain as the hostname. If you see other domains listed, especially domains that don't belong to you, that traffic is almost definitely spam. The only exceptions are legitimate third-party services like your payment processor (e.g., stripe.com), a translation service, or perhaps a development server. Traffic where the hostname is "(not set)" is another major red flag for ghost spam.

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

3. Look for Abnormally Low Engagement Rates

Bots don't typically stick around to read your latest blog post or fill out a contact form. They hit a page and leave instantly. This behavior results in a rock-bottom engagement rate.

Steps to analyze engagement:

1. Go back to your Traffic acquisition report with the Session source / medium dimension.
2. Look at the columns for Engaged sessions and Engagement rate. Sort the table by engagement rate in ascending order.
3. Suspicious sources will often have a 0% engagement rate or a number that's extremely low compared to your site average. If a new traffic source sends you 500 users with a 0% engagement rate over a weekend, it's not a suddenly disinterested audience - it's bots.

4. Review Geo Locations and Languages

Sometimes spam is targeted from specific locations far outside your target market. If your business only serves North America but you suddenly get traffic from hundreds of users in a city you've never heard of, that's a clue.

Steps to view geographic data:

1. Navigate to Reports → User → User attributes → Geographic → Country or City.
2. Look for new, unexpected locations with very low engagement. If a city you don't target has sent you 1,000 users with one engaged session, you've probably found a spam source for another filter.

Blocking Spam in Google Analytics 4 For Good

Once you've identified the spam, it's time to get rid of it. GA4 handles spam filtering differently than its predecessor, Universal Analytics. The good news is that it has some powerful built-in tools that make the process more direct.

Step 1: Activate Built-In Bot Filtering

First things first, make sure GA4's automatic bot filter is turned on. Google maintains an up-to-date list of known bot and spider IPs, and you can tell GA4 to automatically exclude traffic from them.

1. Go to Admin (the bottom-left gear icon).
2. In the Property column, select Data Streams and click on your website's data stream.
3. Under Google tag, click on Configure tag settings.
4. On the next screen, under Settings, click Show more.
5. You'll see an option for List unwanted referrals, which we'll use in the next step. Previously, bot filtering was here, but GA4 now filters common bots and spiders automatically. There is no longer a checkbox to tick, it is enabled by default. This is your first line of defense.

Step 2: Define and Exclude Your Internal Traffic

This filter prevents activity from you, your team, and your agencies from being counted as real user traffic. It isn't strictly "spam," but your own repeated visits can skew data in similar ways (especially on low-traffic sites).

1. First, find your IP address. The easiest way is to Google "what is my IP address."
2. In GA4, go to Admin → Data Streams and click your data stream.
3. Click Configure tag settings. Then click on Define internal traffic.
4. Click the Create button.
5. Give your rule a name, like "Office IP Address." Keep the traffic_type value as internal.
6. Under IP address → Match type, select "IP address equals" and paste your IP address into the field.
7. Click Create. You can add multiple IPs if your team is distributed.
8. CRITICAL NEXT STEP: You have defined what internal traffic is, but you haven't told GA4 to filter it out yet. Go to Admin → Data Collection and Modification → Data Filters. You should see a filter named "Internal Traffic." Click on it, change its state from Testing to Active, and then save. It can take up to 24 hours to kick in.

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

Step 3: Block Unwanted Referral Domains

Remember that list of spammy referrers you identified earlier? This is where you use it.

1. Navigate to Admin → Data Streams.
2. Click on your website's data stream.
3. Click Configure tag settings. On the right-side configuration screen, click Show more under the Settings section.
4. Go to List unwanted referrals.
5. Under Match type, choose "Referral domain contains."
6. Enter one of the spam domains you found (e.g., free-buttons.com) into the Domain field.
7. Click Add condition to add more domains from your list.
8. When you're finished, hit Save. Traffic from these domains will no longer be processed.

These features handle the vast majority of common spam. Note that filters in GA4 are applied going forward, meaning they won't clean your historical data. However, they will keep your new data much more reliable.

Maintaining a Clean Google Analytics Account

Battling spam isn't a one-and-done task. It's a bit like weeding a garden, you have to do it periodically to keep things healthy. Here's a simple routine to adopt:

• Monthly Check-Up: Once a month, take 15 minutes to review your referral sources and hostnames. Follow the identification steps outlined above. If new spammers have popped up, add them to your unwanted referrals list.
• Use Annotations: While GA4's annotation feature is less pronounced than it was in Universal Analytics, you can make a note for yourself of when you applied a new filter. Even a simple entry in a team document or calendar can help you remember why traffic patterns might have changed.
• Stay Informed: Spammer tactics evolve. Keeping an eye on marketing and analytics blogs can alert you to new types of spam campaigns so you can get ahead of them.

By regularly monitoring and maintaining your filters, you can be confident that the data you're using to make strategic business decisions is accurate and trustworthy.

Final Thoughts

Clearing out junk traffic in Google Analytics is an essential step towards making data-driven decisions you can trust. By regularly identifying suspicious sources, leveraging GA4's built-in filters for bots and unwanted referrals, and excluding internal traffic, you ensure your reports accurately reflect genuine user engagement.

Of course, keeping your GA4 data clean is only half the battle. To see the full picture, you still need to pull data from your advertising platforms, CRM, and sales tools, which often leads to hours of tedious report-building. With a tool designed for streamlined analytics, like Graphed, we help you overcome that challenge. We make it easy to connect all your data sources in seconds, allowing you to ask questions in plain English - like "What was our total ad spend vs. revenue from GA4 last month?" - and instantly get dashboards that show the complete story in real-time.