How to Get Rid of Referral Spam in Google Analytics

Seeing strange, irrelevant websites appear in your Google Analytics traffic report can be alarming. One minute you're analyzing which marketing channels are working, and the next you're wondering why a site called "get-free-traffic-4u.xyz" is supposedly sending you hundreds of visitors. This is referral spam, and it's more than just an annoyance, it actively undermines your data. This article will walk you through exactly what referral spam is, how to find it in GA4, and the steps you can take to block it for good.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What is Referral Spam and Why Does it Matter?

Referral spam is fake traffic sent to your website by bots, not humans. The goal of spammers is often to get you to visit their website out of curiosity, hoping you'll buy a product or service. They accomplish this by making their domain show up in your analytics reports.

This fake traffic generally falls into two categories:

• Ghost Spam: This is the most common type. It's called "ghost" spam because the bots never actually visit your site. They bypass your website entirely and send fake data (called "hits") directly to Google Analytics servers using your unique GA Measurement ID. They often generate a random ID, and if it matches yours, you get fake traffic data recorded.
• Crawler Spam: These are actual bots that visit your website, crawl a few pages, and then leave. While they do interact with your site, their behavior is completely different from a real user. They typically have a 100% bounce rate, a session duration of 0 seconds, and they never convert.

So, why is this a problem? If left unchecked, referral spam drastically skews your analytics data. It inflates your session counts, increases your bounce rate to unbelievable highs, and decreases your average session duration. When you try to make strategic decisions based on this corrupted data - like which marketing channels to invest in - you're working with a completely fictional picture of your performance. Getting rid of it is essential for having data you can actually trust.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

How to Identify Referral Spam in Your GA4 Reports

Before you can block spam, you have to find it. In Google Analytics 4, the process is straightforward. Here’s how you can check your referral traffic for suspicious activity.

Step 1: Navigate to the Traffic Acquisition Report

From your GA4 dashboard, go to Reports > Acquisition > Traffic acquisition.

Step 2: Change the Primary Dimension to "Session Source"

The report defaults to "Session default channel grouping." Click the drop-down arrow and select Session source instead. This will show you a list of the actual domains sending you traffic.

Step 3: Analyze the Source List for Red Flags

Now, scan the list of sources. Most will look familiar (e.g., google, bing, newsletter names), but spammy referrers stand out. Look for these warning signs:

• Irrelevant or Suspicious Names: You'll see domains that have nothing to do with your niche or sound like offers that are too good to be true. Examples include things like "free-seo-buttons.com," "buy-social-media-traffic.net," or other generic, bot-like names.
• Unusually High Traffic or Awful Engagement: A spammy referrer might suddenly send hundreds of sessions. If you click into the traffic from that source, you'll almost always see an engagement rate near 0% and an average engagement time of just a few seconds. If a source sends tons of fly-by traffic that doesn't interact with your content, it’s highly suspect.
• No Legitimate Connection: Do you have a backlink on that site? Is it a partner or a known business in your industry? A simple rule of thumb: if you don’t recognize a referring domain and you have no reason to be getting traffic from them, google the name. A quick search will often reveal others complaining about spam from the same URL.

The Best Way to Block Referral Spam in GA4: Using Data Filters

In the past, Universal Analytics had a feature called the "Referral Exclusion List," but it had a different purpose - it was for filtering out known domains you didn’t want to count as referrals, like payment gateways (e.g., paypal.com). Trying to use it for spam actually made the problem worse.

In GA4, the proper method for blocking spam for good is by creating an "Exclude" data filter. This filter tells GA4 to stop processing and recording data from sources you define as spam. It’s important to note that these filters are not retroactive, they only apply to data from the moment you activate them. However, it's the most effective way to keep your data clean moving forward.

Step-by-Step Guide to Creating a GA4 Data Filter

Follow these steps to set up your anti-spam filter:

1. Go to Your Admin Settings

Click the gear icon in the bottom-left corner of GA4 to open the Admin panel.

2. Navigate to Data Filters

In the "Property" column, find Data Settings, then click on Data Filters.

3. Create a New Filter

Click the blue "Create filter" button. Select the "Developer and internal traffic" filter type for now, as it gives us the precise options we need for referrals.

4. Configure the Filter

• Filter name: Give it a specific, descriptive name you'll recognize later. For example, "Blocklist - referral-spam.com".
• Filter operation: Set this to Exclude.
• Parameter name: In the filter expression for the source of the traffic, look for the custom parameter named traffic_source. You may need to start typing it in the field for it to appear. This parameter holds the referral domain info.
• Filter expression: This is where you enter the spammy domain name. Enter the domain exactly as it appears in your reports (e.g., spam-site-to-block.com).

5. Set the Filter State to "Testing"

Before permanently activating the filter, it's a good practice to test it. Leave the filter state as Testing. This allows GA4 to apply the filter and show you the potential impact without actually discarding the data yet. You can see the effect by adding a comparison in your reports with the dimension "Test data filter name."

6. Activate the Filter

Let the filter run in "Testing" mode for at least 24-48 hours. Once you are confident it is working correctly and not blocking any legitimate traffic, go back to your list of Data Filters, click on your new filter, and change its state from "Testing" to Active. Click "Save."

Once active, any traffic matching that domain will be permanently excluded from your GA4 reporting. You'll have to repeat this process for each new spam domain you find, but it's the most reliable way to keep future reports clean.

To block a list of domains at once, you can use a regular expression (regex) in the filter expression field. For example:

(spam-domain1\.com|another-spammy-site\.org|get-traffic-free\.net)

This tells the filter to exclude traffic from any of the sites listed, separated by a pipe (|) character.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Cleaning Up Your Historical Data (The Workaround)

Since data filters aren’t retroactive, your past reports will still be filled with junk. You can't delete it, but you can create analyses that temporarily hide it so you can see your true historical performance.

The best way to do this is with Explorations.

1. Navigate to the Explore tab in the left-hand navigation menu and start a new "Free form" exploration.
2. In the "Variables" column, click the "+" sign next to "Dimensions" and import Session source. Do the same for "Metrics" and add metrics like Sessions and Engaged sessions.
3. Drag the Session source dimension into the "Rows" area and the metrics into the "Values" area. You'll now see a table resembling your traffic acquisition report.
4. At the bottom of the "Tab Settings" column, drag the Session source dimension into the Filters box.
5. Configure the filter:
6. Click "Apply". The spam domain will disappear from your report.

You can add multiple conditions to this filter to exclude several spam domains at once, giving you a clean view of your past data for analysis. Save this exploration to reference anytime you need to review historical performance without the noise.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Proactive Measures to Add Another Layer of Protection

In addition to filters, GA4 provides some built-in tools. One of the most useful features is an automated bot-filtering system that is typically enabled by default. It works by cross-referencing incoming traffic against the IAB/ABC International Spiders & Bots List.

It's always a good idea to ensure it's turned on. You can check this by going to Admin > Data Streams > [Select your web stream]. The "Filter known bots" option should be checked. This takes care of a lot of common crawler spam automatically.

For more advanced protection, particularly against ghost spam, consider setting up a hostname filter. Your GA4 property should only receive data from your own website domain (and any related subdomains). Any traffic from other hostnames is likely spam. By creating an "Include only" filter in the data filter settings for your valid hostnames, you can effectively block most ghost spam before it ever enters your reports.

Final Thoughts

Referral spam is a frustrating mess, but it's a manageable one. By regularly checking your traffic sources, setting up data filters to block junk domains, and using explorations to clean historical analysis, you can reclaim your data's integrity. An accurate dataset empowers you to make smarter, more confident decisions about where to focus your marketing efforts.

Keeping your data clean is the foundation of trustworthy reporting. That tedious 'data wrangling,' like downloading CSVs and fighting spam, takes you away from finding real insights. At Graphed, we handle the boring parts for you. We connect securely to sources like Google Analytics, so all your data is automatically synced and ready for analysis - without the noise. You can ask for a dashboard in plain English, and Graphed builds it instantly with real-time, trustworthy data, allowing you to focus on growing your business instead of cleaning up messy reports.