How to Identify Bot Traffic in Google Analytics

Noticed some suspicious spikes or unnaturally perfect engagement rates in your Google Analytics data? Don't break out the champagne just yet. You might be looking at bot traffic. This phantom data can wreak havoc on your reports, skewing your metrics and leading you to make bad decisions. In this tutorial, we’ll walk you through how to spot these digital ghosts in your GA4 reports and kick them out for good.

Why Bot Traffic Sucks (and What It's Costing You)

Before we jump into the "how," let's quickly cover the "why." Ignoring bot traffic isn’t just a minor annoyance, it can seriously undermine your marketing and sales efforts by poisoning your data. When bots crawl your site, they can inflate your session counts, warp your conversion rates, and make it impossible to tell what's actually working.

Here’s a breakdown of the damage:

• Skewed core metrics: Bot activity inflates your user, session, and pageview counts, making your site's performance look better (or just different) than it really is. This makes it impossible to gauge growth or the true impact of a new campaign.
• Misleading engagement data: Most bots visit a single page and leave immediately. This results in session durations of just a few seconds (or zero) and a near-100% bounce rate. If you see thousands of new "users" with these characteristics, you're not getting a sudden influx of speed-readers, you're getting bots.
• Inaccurate conversion rates: This is the big one. If your sessions double due to bots but your actual human conversions stay the same, your conversion rate gets cut in half. A profitable campaign can suddenly look like a failure, causing you to pause an ad that was actually working for your real customers.
• Wasted time and resources: Bad data leads to bad decisions. Teams waste hours analyzing phantom traffic spikes and may allocate budgets to channels that seem to be performing well on paper but are only attracting automated traffic.

Cleaning up your data isn't optional - it's essential for understanding your customers and growing your business.

Telltale Signs: How to Spot a Bot in Your GA4 Data

Bots, especially poorly designed ones, leave behind obvious footprints. Once you know what to look for, they become much easier to spot. Here are the most common red flags to watch for in your Google Analytics 4 reports.

Sign #1: Extremes in Engagement Time and Bounce Rate

Humans behave in varied and somewhat predictable ways. Bots, on the other hand, are often programmed for one simple task. They land on a page, scrape its content (or just log a visit), and leave instantly. This behavior leaves a dead giveaway in your engagement reports.

Look for traffic segments - particular sources, countries, or landing pages - with an average engagement time of 0 or 1 second and a bounce rate of nearly 100%. While a high bounce rate isn't always a cause for alarm (for example, on a blog post where users find their answer and leave), when paired with almost zero engagement time across thousands of sessions, it's a huge indicator of automated traffic.

How to check this:

1. In GA4, go to Reports > Acquisition > Traffic acquisition.
2. The default table shows data by Session default channel grouping. You can change the primary dimension to Session source / medium for more granular detail.
3. Look for sources with an abnormally low Average engagement time. Sort the table by this metric to bring the worst offenders to the top.

If you see a source with thousands of users, thousands of sessions, and an engagement time of "00:00:01," you've probably found a bot.

Sign #2: Sketchy Traffic Sources or Referrals

Sometimes, bots don't even try to hide where they're coming from. Scrutinize your referral traffic for domains that sound spammy or irrelevant. Names like "get-free-traffic-now.com" or random strings of letters and numbers are classic signs of referral spam.

These visits are designed to get your attention. Site owners often check their referral reports out of curiosity, visit the spammy URL, and a few may even fall for whatever service is being sold. It's a marketing tactic that pollutes your analytics.

How to check this:

1. In the same Traffic acquisition report, set the primary dimension to Session source.
2. Scan the list for any domains that look suspicious or that you don't recognize. A quick Google search of the domain will usually confirm your suspicions.

Sign #3: Traffic Spikes from Unexpected Geographic Locations

Are you a local San Diego plumber suddenly getting thousands of visits from a single city in Kazakhstan? Unless you've recently written a universally acclaimed blog post on pipe threading, a traffic spike like this is almost certainly from bots.

Bots operate from servers, which can be located anywhere in the world. Significant traffic from regions where you don't do business, have no audience, or aren't running ads is a strong signal that the traffic isn't genuine.

How to check this:

1. Go to Reports > Demographics > Demographic details.
2. Select Country or City from the dropdown menu to view sessions by location.
3. Look for any locations generating high traffic volumes that don't align with your target markets. Pay close attention to locations with the telltale signs we've already discussed: 100% bounce rate and minimal engagement.

Sign #4: “(not set)” Everywhere

When Google Analytics can't identify a piece of information, it labels it as (not set). While there are legitimate reasons for some (not set) values to appear, an unusually high volume of them across certain dimensions can point to bot activity. Bots often operate using scripts that don't pass standard information like screen resolution or a browser name.

High volumes of visitors with a screen resolution of (not set) or in unusual device categories can be a dead giveaway.

Where to check this:

1. Go to Reports > Tech > Tech details.
2. Use the dropdown menu to inspect dimensions like Browser, Device category, and Screen resolution.
3. Filter or watch for large volumes of traffic that fall under the (not set) category. If a huge spike in your traffic comes from sources with a (not set) screen resolution, it's time to be skeptical.

Time to Take Action: Filtering Out Bots in GA4

Once you've identified the bot traffic, it's time to get it out of your reports. Fortunately, GA4 provides a few tools to help you clean up your data both now and in the future.

Step 1: Rely on Google's Built-In Bot Filter

The good news is that GA4 automatically works to exclude traffic from known bots and spiders on the IAB/ABC International Spiders & Bots List. This setting is active by default, and unlike in the old Universal Analytics, there's no checkbox to turn it on or off. This functionality is automatic and handles a good chunk of generic, large-scale bot activity without you having to lift a finger.

However, this filter isn't foolproof. It primarily catches well-known, public bots. It won't catch custom-built scrapers, referral spammers, or more sophisticated ghost traffic targeting your specific site. That’s where manual filtering comes in.

Step 2: Create Data Filters for Suspicious IP Addresses

If your bot analysis pointed to a specific IP address or a consistent range of IPs sending junk traffic, you can create a filter to exclude them from your reports going forward. This is akin to blocking a known troublemaker's phone number.

How to set it up:

1. Navigate to Admin in the bottom-left corner of GA4.
2. Under the Property column, click on Data Settings > Data Filters.
3. Click Create Filter.
4. Choose the Internal Traffic filter type (you can also use Developer Traffic, but most people use Internal for this). Name your filter "Bot Exclusion - [Name of Bot/Source]."
5. Set the Filter operation to Exclude.
6. Under the filter expression, define the traffic to exclude. You can match the traffic based on parameters, but for bots, you'll want to select an IP address condition like IP address equals or IP address begins with.
7. Enter the offending IP address.
8. Change the Filter state from Testing to Active when you are confident it's configured correctly, then click Save.

Remember, data filters in GA4 are not retroactive. They will only apply to data collected after the filter is activated. This method is effective but can turn into a game of whack-a-mole, as bots often cycle through thousands of different IP addresses.

Step 3: Block Unwanted Referral Domains

If you identified spammy referral domains earlier, you can add them to a blocklist to keep them out of your reports. This is one of the most effective ways to clean up referral spam for good.

How to block a referral:

1. Go to Admin > Data Streams and select your web data stream.
2. Scroll down and click on Configure tag settings.
3. Under the Settings section, click Show all, then select List unwanted referrals.
4. Set the Match type (e.g., Referral domain contains) and enter the domain you want to block (e.g., "spam-site.com").
5. Click Save. Any traffic from this domain will no longer be labeled as a "Referral."

Going Deeper: Using Segments for Retroactive Analysis

One major frustration with filters is that they aren't retroactive - they only clean data moving forward. But what if you need to analyze a report from last month without all that bot noise? This is where Segments in GA4's Explore reports come in handy.

Segments allow you to isolate a subset of your data for analysis based on criteria you define. By creating a segment that excludes your identified bot traffic, you can effectively look at your historical data with clean glasses.

How to create an exclusion segment:

1. Go to the Explore section and open a 'Free Form' exploration report.
2. In the Variables column on the left, click the “+” icon in the Segments box.
3. Choose to create a Session segment.
4. Name your segment "Bot Traffic Excluded."
5. Instead of including sessions, switch to "Permanently Exclude" or create an exclusion group using the 'Exclude sessions when' logic.
6. Now, add conditions based on the signs you discovered earlier. For example:

• Country | exactly matches | "Kazakhstan" (or whichever anomalous country you found).
• Session source | contains | "spammydomain.com".
• Screen resolution | exactly matches | '(not set)'.

1. You can add multiple "OR" conditions to create a single, powerful segment that excludes traffic from all the bot profiles you've identified.
2. Save and apply the segment to your Exploration. Now, all the charts and tables in your report will show data only from the sessions that do not match your bot criteria.

This is by far the most powerful and flexible method for analyzing historical data after identifying bot activity, giving you a much clearer picture of what really happened.

Final Thoughts

Identifying and filtering bot traffic may feel like a chore, but it’s a non-negotiable step toward achieving data clarity. By regularly checking for telltale signs like zero-second engagement times and sketchy referral sources, and by using GA4’s built-in filters and exploratory segments, you can restore trust in your metrics and make smarter, more confident decisions.

Constantly sifting through GA4 reports to find these anomalies, however, can quickly turn into a full-time job. With Graphed, we connect directly to your Google Analytics account so you can stop wrestling with reports and start getting insights. You can ask for exactly what you want - like "Show me sessions from the US with engagement time over 10 seconds" - and get an instant visualization. We handle the data connection and let you slice and dice your metrics in plain English, helping you filter out the noise and focus on what your real customers are doing.