How to Stop the Spam in Google Analytics

Nothing ruins a good marketing report faster than discovering half your website traffic came from spam bots. It skews all your key metrics, making it impossible to know what’s actually working. This guide will walk you through exactly how to identify and stop spam in Google Analytics 4, so you can trust your data again.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What is Google Analytics Spam and Why Does It Matter?

Google Analytics spam is any fake traffic recorded in your reports that doesn't come from real, interested users. It's designed to inflate your numbers or, in some cases, to get you to visit a scammy website by leaving its URL in your reports. Dirty data leads to bad decisions, and GA spam is some of the dirtiest data you can get.

Imagine you launch a new blog post and see a huge spike in traffic. You get excited, thinking you’ve hit a home run. You decide to put more ad budget behind similar topics, only to realize later that the spike was just bots. Bot traffic almost always has a 100% bounce rate (or a low engagement rate in GA4) and a session duration of zero seconds because they aren't real people browsing your content. This completely messes up your averages and makes it hard to gauge real user engagement.

There are generally two flavors of spam you'll encounter:

• Ghost Spam: This is the most common and clever type. Ghost spam never actually visits your website. Spammers use a feature called the Measurement Protocol to send fake data directly to Google's servers, creating "ghost" visits that never happened. They essentially trick Google Analytics into thinking someone was on your site when they weren't.
• Crawler/Bot Spam: These are actual automated bots that visit and crawl your website. While some bots are good (like Google's own crawlers for SEO), many are malicious or just annoying. They show up as real sessions, inflating your user counts and pageviews but providing zero value.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

How to Identify Spam Traffic in Your Reports

Before you can block spam, you need to know how to spot it. Spammers are getting sneakier, but they often leave behind tell-tale signs. Here’s what to look for in your Google Analytics 4 property.

1. Check Your Traffic Sources for Suspicious Names

The most obvious red flag is referral traffic from sketchy-looking domains. Spammers often hope you’ll get curious, see their domain in your report, and visit it.

Here’s how to check:

1. In your GA4 property, navigate to Reports > Acquisition > Traffic acquisition.
2. Look at the "Session source / medium" column.
3. Scan the list for anything that doesn't look legitimate. Red flags include URLs promoting "free traffic," pornographic sites, or random strings of letters and numbers. For example, domains like free-traffic-for-you.com or buttons-for-your-website.com are classic spam.

Another sign is behavior. If a traffic source brings in a decent number of sessions but has an engagement rate of 0% and an average engagement time of 0m 00s, it's almost certainly spam.

2. Analyze Your Hostnames

This is the single most effective way to identify ghost spam. The "hostname" is simply the domain on which the Google Analytics tracking code was fired. For most of your traffic, this should be your own website's domain (e.g., yourwebsite.com).

Since ghost spam never visits your site, the data they send to Google often has a fake or missing hostname. By filtering your reports to only include data from valid hostnames, you can eliminate most of this spam with one move.

Here’s how to check your hostnames in GA4:

1. Go to the Explore section on the left-hand menu and create a new "Free form" exploration.
2. In the "Variables" column on the left, click the '+' sign next to "Dimensions."
3. Search for and import the "Hostname" dimension.
4. Drag the "Hostname" dimension from the Variables column to the "Rows" area in the "Tab Settings" column.
5. In the "Variables" column, click the '+' sign next to "Metrics."
6. Search for and import a metric like "Sessions" or "Users."
7. Drag your chosen metric to the "Values" area in the "Tab Settings" column.

Your report will now show a list of all hostnames that sent data to your GA4 property. The list should primarily contain your own domain(s). You might also see legitimate third-party domains if you use tools for payments (e.g., checkout.stripe.com), video hosting (e.g., youtube.com), or translations (e.g., translate.googleusercontent.com). Any other domains, especially ones that are obviously spam or have (not set), are a problem.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Filtering Out Spam in Google Analytics 4 (Step-by-Step)

Now that you know how to find the spam, it's time to get rid of it. GA4 has some powerful built-in tools to help you clean up your data for good. Setting these up will ensure your future reports are as accurate as possible.

Step 1: Check the Default Bot-Filtering Setting

Google has an automatic filter designed to exclude traffic from known bots and spiders. It’s pretty good at catching common crawler spam. For most properties, this setting is enabled by default, but it's always worth double-checking.

1. Navigate to the Admin section (the gear icon in the bottom-left).
2. In the "Property" column, click on Data Streams and select your web data stream.
3. Click on Configure tag settings at the bottom.
4. Under "Settings", click Show all.
5. Click on Identify internal traffic. Make sure the option "Google Tag identifies internal traffic" is enabled. Though not directly bot traffic, this step is part of the filtering ecosystem.
6. Go back and click on List unwanted referrals. Then, go back one more time, and in your main Data Stream details go down to Google Tag, choose Configure tag settings. In this new screen, go to Admin and make sure the Data filter for "Internal Traffic" is either 'testing' or 'active'. The most important setting here is to make sure that in GA4, bot filtering cannot be "turned off". GA automatically filters bot traffic, and doesn't give users an easy "on/off" method in the user interface.

Step 2: Create a Valid Hostname Filter

As we discussed, this is your most powerful weapon against ghost spam. The goal is to tell Google Analytics to only include traffic that comes from your own website and any other legitimate domains you use. Traffic from all other hostnames will be ignored.

In GA4, this is done by setting up a Data Filter.

1. Go to Admin > Data Settings > Data Filters.
2. Click the Create filter button in the top right.
3. Select the "Include only" filter type.
4. Name your filter something descriptive, like "Include only My Valid Hostnames."
5. Under "Filter details":
6. Leave the "Filter State" as "Testing" for 24-48 hours. This allows you to verify it's working correctly without permanently affecting your data. You can see the effect of test filters by applying the "Test data filter name" dimension in your reports.
7. Once you've confirmed it's working as expected, come back, open the filter, and change the state from "Testing" to "Active." Click "Save".

Heads up: Once activated, this filter is permanent and not retroactive. It will only apply to data moving forward, so it's a good practice to set this up as soon as you create a new GA4 property.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Step 3: Exclude Your Internal Traffic

While not "spam," traffic from your own team, employees, and home offices can inflate your data and make a small site look more popular than it is. You should filter this out.

1. Figure out your office's public IP address (just Google "what is my IP").
2. In GA4 Admin, go to Data Streams and select your web data stream.
3. Click Configure tag settings. Then Show all.
4. Select Define internal traffic.
5. Click Create. Give it a rule name (e.g., "Main Office IP"). Leave traffic_type value as a default "internal."
6. Under "IP addresses," choose "IP address equals" and enter the IP address you found. If you have multiple locations, you can add more rules.
7. Click Create. Now GA4 knows what traffic to define as "internal."
8. Next, you have to tell GA4 to actually exclude that traffic. Go back to Admin > Data Settings > Data Filters.
9. GA4 automatically creates a filter called "Internal Traffic." Click the three dots next to it and select "Activate filter." Or you can create your custom Exclude filter where Traffic type "equals" a parameter value internal. And activate that.

Step 4: Use the Unwanted Referrals List Carefully

In GA4, there's a feature to block certain domains from appearing as "referrals."

1. You can find this at Admin > Data Streams > [Select your stream] > Configure tag settings > Show all > List unwanted referrals.
2. Here you can add spammy domains you find. However, it's crucial to understand how this works: this does not block the traffic. It just stops GA4 from crediting the source as a referral. The fake sessions will still be in your reports, but they will be re-categorized as "(direct)" traffic.
3. Because of this, the unwanted referrals list is less effective for fighting spam than the hostname filter. It's better used for its intended purpose: blocking self-referrals or preventing payment gateways (like paypal.com) from stealing attribution from the real traffic source.

Final Thoughts

Keeping your Google Analytics data clean from spam isn't a one-time fix, but an important, ongoing maintenance task. By regularly applying these filters - especially the valid hostname filter - you build a strong defense that ensures your reports are accurate, trustworthy, and ready for you to make smart marketing decisions.

We know that manually setting up filters and constantly battling spam is tedious. We built Graphed because we believe getting actionable insights should be simple. By connecting your Google Analytics account, we not only help you look at clean, real-time data but also let you create entire dashboards just by describing what you want to see. Instead of wrestling with filters and report settings, you can simply ask, "Show me my top landing pages from organic search last month," and get an instant, beautiful visualization.