How to Filter Out Google Analytics Spam

Seeing strange websites in your Google Analytics referral traffic like 'traffic-bot.xyz' or 'free-social-buttons.com'? If your data is getting cloudy with junk traffic, you've come to the right place. This guide will walk you through exactly how to identify and filter out Google Analytics spam, so you can trust your data and make decisions with confidence.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

First, What Is Google Analytics Spam and Why Does It Matter?

Google Analytics spam is essentially fake traffic sent to your website's tracking ID. This junk data pollutes your reports, making it difficult to understand how real users are actually behaving on your site. When your analytics are skewed by spam, you might make poor marketing decisions based on faulty information.

There are two main types of spam you’ll encounter:

• Ghost Spam: This is the most common type. It’s called "ghost" spam because these bots never actually visit your website. Instead, they send fake "hits" directly to Google's measurement servers using your unique Analytics tracking ID (e.g., G-XXXXXXX). They find these IDs through scrapers or sometimes just by guessing them.
• Crawler Spam: These are actual bots that visit your site, crawling pages just like a search engine bot would. However, unlike legitimate bots (like Googlebot), these bots ignore rules that tell them not to be tracked and end up being recorded as user sessions in your analytics.

Both types of spam wreak havoc on your key metrics, often causing a strangely low average session duration, an unbelievably high bounce rate (usually 100%), and phantom traffic from locations you don’t target. Cleaning it up is essential for accurate reporting.

Part 1: How to Identify Spam Traffic in Your Reports

Before you can block spam, you need to find it. Here are the most common places to look in your GA4 property to spot suspicious activity.

Check Your Referral Traffic Report

The referral report is ground zero for identifying crawler spam. You’ll often find a list of sketchy-looking domains sending you traffic.

Here’s how to check:

1. In your GA4 property, navigate to Reports → Acquisition → Traffic acquisition.
2. In the report, change the primary dimension from 'Session default channel group' to Session source / medium.
3. Add a filter at the top of the report: Click 'Add filter', select 'Session source / medium' as the dimension, and enter 'referral' in the value field. This will show you only referral traffic.
4. Scan the list of sources. Look for anything that doesn’t look like a legitimate website.

Red flags include:

• Domains that are clearly trying to sell you something (e.g., get-more-traffic.com).
• Domains with names full of random characters.
• Domains that seem completely unrelated to your industry or audience.
• Service-based domains that people wouldn't typically click a link from (e.g., buttons-for-your-website.com).

Keep a list of these spammy domains - you’ll need it for the filtering process later.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Look for Suspicious Hostnames

Examining hostnames is the most reliable way to identify ghost spam. A hostname is simply the domain where your Google Analytics tracking code was fired. For most businesses, the only valid hostnames should be your own domain (e.g., mybusiness.com) and any related domains you own or use (e.g., checkout.shopify.com if you're on Shopify, or vimeo.com if you embed videos).

Ghost spam appears under hostnames that are not your own. Here’s how to find them using an Exploration:

1. Navigate to Explore in the left-hand menu and create a new 'Blank exploration'.
2. In the 'Variables' column on the left, click the '+' sign next to 'Dimensions'. Search for and import Hostname.
3. Click the '+' sign next to 'Metrics'. Search for and import Sessions and Active users.
4. Drag Hostname from the Variables column to the 'Rows' section in the main panel.
5. Drag Sessions from the Variables column to the 'Values' section.

You'll now see a list of every hostname that has sent data to your GA4 property. Make a list of all the legitimate ones. Any hostname that you don’t recognize, or those that look like blatant spam, is the ghost spam you need to filter out. Seeing a (not set) hostname is another classic sign of spam.

Analyze Behavior Metrics for Obvious Outliers

Spam traffic often behaves in an unnatural way. A quick look at your engagement metrics can help you spot it.

• Bounce Rate (or low Engaged sessions): GA4 has replaced bounce rate with 'Engagement rate'. Spam almost always results in a 0% engagement rate on those sessions.
• Average Engagement Time: Spam sessions typically last for 0-1 seconds.

In your Traffic acquisition report, add a secondary dimension of 'Hostname'. Now you can see the behavior metrics broken down by hostname. If you see a hostname with a 100% bounce rate (or near 0% engagement rate) and an average session duration of almost zero, it’s highly likely spam traffic.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Part 2: How to Filter Spam Out of Google Analytics 4

Now that you've identified the junk, it's time to get it out of your reports. GA4 filters data as it comes in, meaning these changes will only apply to future data. (We'll cover how to clean historical data later).

Step 1: Activate Google's Default Bot Filtering

Google maintains its own list of known spiders and bots. GA4 can automatically filter this traffic out for you. In Universal Analytics, this was a manual setting, but in GA4, it's typically enabled by default. It's always a good idea to confirm it's active.

1. Go to Admin (the gear icon in the bottom-left).
2. Under the 'Property' column, click on Data Streams and select your web stream.
3. Click on Configure tag settings at the bottom.
4. Under the 'Settings' section, click Show all.
5. Select Define internal traffic. The section that manages bot traffic isn't here anymore. GA4 has integrated it more deeply.
6. Now go back to Admin → Data Settings → Data Filters.

You should see a filter named 'Internal Traffic' and possibly an active filter for bot traffic. As of recent GA4 updates, bot filtering is handled automatically with no toggle, but keeping an eye on your Data Filters section is a good habit.

Step 2: Create a Referral Exclusion List for Crawler Spam

Remember that list of spammy referral domains you made? Now you can tell GA4 to ignore any traffic coming from them.

1. Go to Admin → Data Streams and click on your website's data stream.
2. Click Configure tag settings below the stream details.
3. Under 'Settings', click on Show all, then click List unwanted referrals.
4. Under 'Match type', select Referral domain contains.
5. In the 'Domain' field, enter one of the spammy domains you found (e.g., traffic-bot.xyz).
6. Click Add condition to add more rows and continue adding all the spam domains from your list.
7. Click Save when you're done.

From this point forward, GA4 will ignore any sessions originating from these domains.

Step 3: Filter by Your Hostname to Block Ghost Spam

This is the single most effective way to eliminate ghost spam for good. You'll create a data filter that tells GA4 to only include data from your legitimate hostnames.

Warning: Be very careful with this filter. If you configure it incorrectly, you could accidentally block all of your real traffic. Double-check your list of valid hostnames before proceeding.

1. Go to Admin → Data Settings → Data Filters.
2. Click the 'Create Filter' button in the top right.
3. Choose the 'Include only' filter type.
4. Give your filter a descriptive name, like "Include only traffic from valid hostnames".
5. Set the 'Filter field' to Hostname.
6. Set the 'Filter value' using a regular expression that lists all your valid hostnames, separated by a pipe |.

Your regex will look something like this:

yourdomain\.com|seconddomain\.net|shopify\.com

Important notes on the regex:

• The pipe symbol | means "OR".
• You must "escape" any periods in domain names with a backslash \ because a period is a special character in regex. So, yourdomain.com becomes yourdomain\.com.

Enter your customized regex in the 'Filter value' box. Change the 'Filter state' from 'Testing' to Active once you are certain it's correct, and then click 'Save'. This filter tells GA4 to discard any hit that doesn't come from one of the domains you listed.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Bonus: Cleaning Spam from Your Historical Data

The filters above only work on data collected from now on. To analyze past data without spam, you need to use "Comparisons" in your standard reports (GA4's version of segments).

1. Go to any standard report, like Reports → Acquisition → Traffic acquisition.
2. At the top of the report, click Add comparison.
3. In the builder on the right, create a condition.
4. Set the Dimension to 'Hostname'.
5. Set the Match Type to 'matches regex'.
6. Enter the regex from the previous step.
7. Create a condition to Include valid hostnames using: yourdomain\.com|shopify\.com.
8. Click Apply.

You can now compare your spam-free data against the original, unfiltered data. To view only the clean data, simply remove the "All Users" comparison by clicking the 'x' on its card.

Final Thoughts

Keeping your Google Analytics data clean from spam is not a one-time fix but an ongoing process. By regularly checking your referral and hostname reports and applying the right filters, you can ensure your analytics are accurate, enabling you to make smarter, data-driven decisions for your business.

We know tedious reporting tasks are the last thing you want to spend time on - even with perfectly clean data. Manually building dashboards in Google Analytics or exporting data to a spreadsheet takes hours you could be using for strategy. That's why we built Graphed. After connecting Google Analytics in a few clicks, you can ask for whatever report you need in simple language, like "show me my top converting landing pages by traffic source" and instantly get a live, sharable dashboard that stays up-to-date automatically.