How to Detect and Filter Bot Traffic in GA4

Bot traffic in GA4 is the reason your dashboard can say 30,000 visitors while Search Console says 30 real clicks a day. That gap isn't a glitch. It's automated, non-human traffic quietly inflating sessions while your actual conversion rate collapses underneath it.

GA4 does filter some bot traffic automatically. But that built-in filter only catches bots that identify themselves honestly, the well-behaved crawlers on Google's known list.

Headless browsers, scrapers, AI training crawlers, and click farms all pass straight through. Detecting and filtering bot traffic in GA4 the rest of the way is a manual job, and it happens in layers.

01What GA4's Built-In Bot Filter Actually Catches

Google's own documentation confirms known bot and spider traffic is automatically excluded, identified through a combination of Google's own research and the IAB/ABC International Spiders and Bots List. You cannot disable this, and you cannot see how much traffic it removed.

KISSmetrics' August 2026 guide is direct about the gap: this automatic list only catches bots that identify themselves honestly. Headless browsers, referral spam, internal QA traffic, and AI crawlers all pass straight through it.

02The Warning Signs of Bot Traffic in GA4

Mediology's 2026 guide lists the red flags worth watching for before you filter anything: sessions with zero engagement time, a high volume of one-page sessions, traffic spikes at unusual hours, suspicious referral domains, and unrealistic device or browser combinations.

Wellows' guide adds a practical validation step. Before acting on any suspicious pattern, confirm it holds across source/medium, landing pages, events, and conversions, not just one metric in isolation.

03Layer 1: Internal Traffic and Developer Filters

KISSmetrics' guide, referenced above, lays out the four-layer approach worth building. Layer one is the easiest: turn on internal traffic filters for your own office, agency, and vendor IP ranges, so your own team's activity never pollutes the data.

Conversios' guide adds the developer traffic filter as a companion piece, excluding hits sent while debug mode is active during QA and testing sessions.

04Layer 2: Hostname and Unwanted Referral Filters

Priority Pixels' 2026 guide flags this as the layer most sites skip: add an Unwanted Referrals exclusion to catch referral-style and direct traffic spam, which the built-in bot filter completely misses since it isn't technically a "known bot."

Stape's guide notes a specific, currently active pattern worth checking your own referral list against: spam sources like news.grets.store and statis.seders.website, both commonly tied to fake Poland-geolocated sessions in 2026.

05Layer 3: Engagement-Based Segments in Explorations

ClickCease's guide points to GA4's Explorations tool as the most powerful native option for this layer. Build a segment that filters for zero-second engagement time, then compare it against your standard reports to see how much of your traffic disappears.

Specificity Inc.'s 2026 guide adds an advanced technique worth trying in Google Tag Manager: flag form submissions completing in under 1.8 seconds as an "impossible speed" event, since no real human fills out a form that fast.

06Layer 4: Server-Side Detection for the Rest

ClickFortify's guide is honest about what this layer is for: sophisticated bot traffic runs a real browser, executes JavaScript, and often rides residential IP addresses. It looks exactly like a person in GA4's standard reports.

e-dialog's guide walks through the mechanic: mark traffic using a "traffic_type" parameter in Google Tag Manager, either client-side or through a server container, then build a GA4 filter that only accepts hits carrying that flag.

07Example: Flagging Bot Traffic in Google Tag Manager

A simplified example of the traffic_type approach used to flag suspicious sessions before they hit GA4's main reports.

function() {
  var formStartTime = window.formLoadTimestamp;
  var formSubmitTime = new Date().getTime();
  var elapsedSeconds = (formSubmitTime - formStartTime) / 1000;

  // Flag submissions faster than a human could realistically type
  if (elapsedSeconds < 1.8) {
    return 'suspected_bot';
  }
  return 'human';
}

// Push this value as "traffic_type" into the dataLayer
// Then build a GA4 Data Filter to exclude "suspected_bot" hits

08Quick Setup Checklist for Filtering Bot Traffic in GA4

Work through these in order, they build on each other.

09How Exposed Is Your GA4 Data?

Answer a few quick questions to check how much bot traffic in GA4 might be affecting your reports right now.

10Common Questions