What is Bot Traffic in Google Analytics?

Seeing a sudden, unexplained spike in your website traffic can feel exciting, but excitement often turns to confusion when none of those new visitors are engaging with your content or buying your products. This is a classic sign of bot traffic, and this article will teach you exactly what it is. We’ll cover why it's a problem for your data, how to spot it in Google Analytics 4, and what steps you can take to clean up your reports.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What Exactly Is Bot Traffic?

Bot traffic is any non-human visit to your website. These visits are generated by automated scripts, or "bots," that are programmed to perform specific tasks. It’s important to know that not all bots are created equal, they generally fall into two categories: good bots and bad bots.

• Good Bots: These bots perform helpful, necessary functions for the internet to work as we know it. The most common example is search engine crawlers, like Googlebot or Bingbot. They visit your site to index your pages so they can appear in search results. Monitoring services that check your website's uptime are also considered "good" bots.
• Bad Bots: This is the type of traffic that causes problems. These malicious bots are designed for activities like scraping content from your site, looking for security vulnerabilities, posting spam comments, or simply sending junk traffic to skew your analytics for competitive or mischievous reasons. These are the bots we want to identify and remove from our data.

Why Bot Traffic Hurts Your Data

Allowing junk bot traffic to go unchecked in Google Analytics can completely undermine your decision-making. Bad data leads to bad strategy. It creates a fuzzy picture of your performance by distorting nearly every key metric you rely on.

It Inflates Your Traffic Numbers

The most immediate impact of bot traffic is inflated Sessions and Users. A sudden surge in visitors might look great at a high level, but if these visitors aren't real people, you're looking at a mirage. Making budget or content decisions based on fake traffic is a recipe for wasted time and money.

It Distorts Engagement Metrics

Most bots visit a single page and leave immediately. This behavior results in tell-tale signs in your data:

• Low Engagement Rate: In GA4, the "Engagement Rate" metric replaced bounce rate. It measures the percentage of sessions that lasted longer than 10 seconds, had a conversion event, or had at least two pageviews. Bots almost never meet these criteria, dragging your overall engagement rate down.
• Zero Session Duration: An engaged session in GA4 has a non-zero time. Spam bots that visit and leave instantly will register with a 0-second average session duration, making it appear that your site isn't holding visitors' attention.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

It Sinks Your Conversion Rate

One of the most damaging effects of bot traffic is how it destroys your conversion rate. Your conversion rate is calculated by dividing the number of conversions by the total number of sessions. If thousands of bot sessions are added to your denominator with zero conversions in the numerator, your actual conversion rate will appear much lower than it really is. This could lead you to mistakenly believe a campaign or landing page is failing when it's actually performing well among real users.

How to Spot Bot Traffic in Google Analytics 4

Finding bot traffic requires a bit of detective work inside your GA4 property. You're looking for patterns that defy normal human behavior. Here are the most common places to start your investigation.

1. Check Your Traffic Acquisition Report for Suspicious Sources

One of the easiest places to spot spam is in your traffic sources. Bots often show up as Referral traffic from sketchy-sounding domains.

1. Navigate to Reports > Acquisition > Traffic acquisition.
2. Change the primary dimension from "Session default channel grouping" to "Session source / medium".
3. Look through the list for any domains that seem strange or irrelevant to your business. Common offenders often have names with terms like "free-traffic," "buttons-for-your-website," or random character strings.

If you see a lot of sessions from these spammy referrers with an exclusively low Engagement Rate (often 0.00%), you’ve likely found a source of bot traffic.

2. Analyze Behavioral Metrics

As mentioned, bot behavior leaves very distinct fingerprints on your engagement metrics. You can look at these metrics across different dimensions to pinpoint where the spam is coming from.

• Go to Reports > Engagement > Pages and screens.
• Add a secondary dimension by clicking the blue "+" icon next to the primary dimension and selecting "Session source".
• Scan the report for pages that have a high number of views coming from a specific referral source but have an abnormally low Average engagement time (e.g., 0m 00s). This pattern suggests an automated script is repeatedly hitting that page and immediately leaving.

3. Look at Geographic and Browser Data

Bots often don't bother to falsify all of their information, leading to odd or incomplete data in your demographic reports.

1. Go to Reports > Tech > Tech details.
2. Set the primary dimension to "Country".
3. Look for a sudden, unexpected spike in traffic from a single country where you don't typically do business or have an audience. If this traffic is also responsible for a large number of sessions with near-zero engagement, it's a huge red flag.
4. Another common sign is traffic showing up with a "(not set)" value for the Country, City, or Browser dimension. While some legitimate users might have privacy settings that cause this, a large volume of "(not set)" traffic combined with poor engagement is highly indicative of bots.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

4. Investigate Unfamiliar Hostnames

Your "hostname" is the domain where your GA4 tracking code fires - meaning it should be your website's domain (e.g., yourwebsite.com). Sometimes, spammers use a technique called "ghost spam," where they send data directly to Google's servers using your Measurement ID without ever actually visiting your site. This malicious traffic will show up with a fake or irrelevant hostname.

1. Go to the Reports > Engagement > Pages and Screens report.
2. Click the "+" icon to add a secondary dimension and search for/select "Hostname".
3. Carefully review the list of hostnames. You should mostly see your own domain and possibly any subdomains you use (like blog.yourwebsite.com) or translation service domains (like googleusercontent.com). If you see other random domains in this list, it’s ghost spam.

How to Filter Bot Traffic from your GA4 Reports

Once you’ve identified bot traffic, the next step is to clean it out of your reporting. GA4 has a few tools built-in to help you do this.

Method 1: Rely on Google's Automatic Bot Filtering

This is the easy part. Unlike Universal Analytics, which required you to manually check a box, Google Analytics 4 filters known bots and spiders automatically. This feature is enabled by default for all data streams and cannot be turned off. It uses a combination of Google's research and the IAB (Interactive Advertising Bureau)’s International Spiders & Bots List to identify and exclude traffic from known bad actors. While this handles a large portion of generic bot traffic, it won't catch everything, especially more sophisticated or targeted spam.

Method 2: Create a Referral Exclusion List

For those spammy referrer domains you found earlier, you can specifically tell GA4 to ignore any traffic coming from them. This is one of the most effective ways to combat referral spam.

1. Go to the Admin section (the gear icon at the bottom-left).
2. In the "Property" column, click on Data Streams and select your web data stream.
3. Scroll down and click on Configure tag settings.
4. Click Show all, then click on List unwanted referrals.
5. Under "Match type," select "Referral domain contains".
6. In the "Domain" field, enter the spammy domain you want to exclude (e.g., spam-domain.com).
7. Click Add condition to add more domains, then click Save.

Traffic from these sources will now be processed as "Direct" traffic instead of "Referral" and will be less likely to credit them with conversions, but it might not stop the hits themselves. The best solution is blocking them at the server level, but this is a solid analytics-level fix.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Method 3: Filter Out Internal and Known IP Addresses

If you've identified bot attacks from a specific, recurring set of IP addresses, you can exclude them entirely. This is also commonly used to filter out traffic from your own company's internal network to avoid inflating data with employee visits.

1. First, find the IP address you want to exclude. If it's your own, you can simply search "What is my IP address?" on Google.
2. In GA4 Admin, go to Data Streams > [Your Web Stream] > Configure tag settings.
3. Click Show all, then click Define internal traffic.
4. Click Create. Give your rule a name (e.g., "Office Network" or "Known Spam IP").
5. Leave the "traffic_type value" as "internal".
6. Under "IP address," set the "Match type" to "IP address equals" and paste the IP address you want to exclude.
7. Click Create.

Important Note: Defining the IP address is only the first part. You now have to create a filter to actually exclude it.

1. Go back to the main Admin screen and click on Data Settings > Data Filters.
2. Click Create Filter, and select the Internal Traffic filter type.
3. Give your filter a name, like "Exclude internal traffic".
4. Make sure the "Filter operation" is set to "Exclude".
5. Select the "internal" parameter name you defined in the previous steps.
6. Set the "Filter state" to Active and click Create to save it. It can take up to 24 hours for this filter to take effect on new data.

Final Thoughts

Cleaning up bot traffic isn't just a technical exercise, it's a fundamental step toward achieving data accuracy. By understanding how to identify spammy sessions and using GA4's built-in filters, you can ensure the data you're analyzing reflects real-world user behavior, which leads to smarter marketing decisions and better results.

Manually digging through reports to spot anomalies is a necessary chore for any analyst, but it can be time-consuming. With Graphed, we help you get to these insights faster. By connecting your Google Analytics account, you can simply ask questions in plain English, like "Show me a table of referral sources with an engagement rate under 1%" or "which countries sent traffic with an average session duration of 0 seconds last month?" We turn hours of report-building and data-sleuthing into a 30-second conversation, so you can spend less time hunting for bad data and more time acting on the good stuff.