Now Reading: Referral Spam Explained: How to Keep Analytics Data Clean
-
01
Referral Spam Explained: How to Keep Analytics Data Clean
Referral spam explained simply: fake traffic dressed up as a real visit. Here's how to spot it, filter it properly, and avoid the trap that just hides it.
Referral spam explained simply: it's fake traffic dressed up as a real visit from another website, sent by bots hoping curiosity gets you to click through and see who "referred" you. It shows up in GA4's Referral channel, inflates your session count, and quietly wrecks your bounce rate along the way.
The name gives it away. It exists purely to get attention, not to reflect anything a real visitor did.
GA4 handles this differently than old Universal Analytics did, with real tools to actually block it rather than just hide it. But those tools have limits worth understanding before you rely on them.
01Referral Spam Explained: What It Actually Is
Rocket.net's guide breaks it into the two forms worth knowing. Crawler spam actually visits your site and leaves fake referral data behind. Ghost spam never visits at all, it sends fake hits directly to Google's servers using your Measurement ID.
Medium contributor SNeefischer's guide adds the mechanism for ghost spam specifically: spammers don't even need to find your real GA4 ID. Automated scripts generate large batches of fake IDs and hope some happen to match real properties.
02How to Spot It in Your Reports
Medium contributor John Thomas' guide gives the clearest signal to check first: if a referral source drives hundreds of sessions with an engagement rate near zero, it's almost certainly spam. Real visitors don't behave that uniformly.
PEMAVOR's guide recommends checking average session duration alongside engagement rate. Genuine referral spam sessions typically last only a few seconds, since no actual browsing happened.
Several current guides flag the exact same spam domains showing up across different sites right now: news.grets.store, statis.seders.website, and trafficpeak.io. If you see these in your own referral report, you're not imagining a pattern, it's an active, widespread campaign.
03Using GA4's Unwanted Referrals List
Reporting Ninja's guide walks through the built-in feature: go to Admin, Data Streams, select your web stream, open Configure Tag Settings, then List Unwanted Referrals, and add the spam domain directly.
KRM Digital's guide notes a real limit worth planning around: you can exclude up to 50 domains per data stream. That's generous for most sites, but spam domains rotate constantly, so this list needs regular maintenance, not a one-time setup.
Medium contributor John Thomas' guide, referenced above, flags something important: adding a domain to the unwanted referrals list doesn't delete the spam hit. It just reroutes that traffic into your "Direct" channel instead, which makes the problem look solved while actually making it harder to diagnose. Referral spam explained this way sounds like a fix, but it's really just relocation, closer in spirit to the same detection gaps covered in our bot traffic guide.
04Building a Real Exclude Filter
Graphed's guide describes the more permanent method: create an Exclude data filter under Data Settings, using the Developer and Internal Traffic filter type, then target the specific spam domain by name.
The same guide notes a useful shortcut for blocking several domains at once: a single filter can use a regex expression like (spam-domain1\.com|another-spammy-site\.org) to exclude a whole list in one rule.
Carlos SEO's guide adds a Google Tag Manager alternative worth knowing for crawler spam specifically: define a variable for the referrer hostname, then trigger a block whenever it matches a known spam list.
05Crawler Spam vs Ghost Spam
These behave differently, which changes how you actually fight each one. Search Engine Land's spam traffic guide recommends treating detection and prevention as two separate, ongoing tracks rather than a single fix.
| Factor | Crawler Spam | Ghost Spam |
|---|---|---|
| Actually visits your site? | Yes | No, sends data directly to GA4 |
| Needs your real Measurement ID? | No | Sometimes guesses at random |
| Best defense | Server-side blocking, .htaccess, WAF | Hostname filters, API authentication |
| Shows a valid hostname? | Usually yes | Often shows "(not set)" or a fake domain |
06Hostname Filter for Ghost Spam
Since ghost spam never actually visits your site, filtering by hostname is one of the most reliable defenses. Here's the logic behind it.
# In GA4 Admin > Data Settings > Data Filters # Create a new filter: Filter type: Internal Traffic (or Developer filter) Filter name: Valid Hostname Only Condition: Hostname does NOT equal "yourdomain.com" Filter operation: Exclude # Ghost spam typically shows hostname as "(not set)" # or a domain that isn't yours, since the hit never # actually passed through your real website.
07Quick Cleanup Checklist
A practical sequence for getting referral spam under control.
Check engagement rate by source/medium first, near-zero engagement on high-volume referrals is the clearest tell.
Add a valid hostname filter to catch ghost spam that never actually visits your site.
Build an Exclude data filter for known spam domains rather than relying only on the unwanted referrals list.
Review referral sources monthly, new spam domains appear constantly and old lists go stale fast.
Remember filters aren't retroactive, use Explorations to clean historical views since past data stays as-is.
08How Clean Is Your Referral Data?
Answer a few quick questions to check your current exposure.
How Clean Is Your Referral Data?
Select the option that matches your GA4 property
09Common Questions
Crawler spam actually visits your site and leaves fake referral data. Ghost spam skips your site entirely, sending fake hits straight to Google's servers using your Measurement ID.
No. It reroutes that traffic into your "Direct" channel instead of deleting it, which can make the spam harder to spot rather than actually solving the problem.
Not directly. GA4 data filters aren't retroactive. You can build Explorations to view clean data going forward, but past reports keep the spam baked in.
Curiosity. Spammers hope you'll see an unfamiliar domain in your reports and click through, driving traffic and visibility to their own site.
No. Legitimate search engine bots like Googlebot are automatically excluded by GA4's known bot filtering and won't show up as referral spam.
What We Learn Today
Referral spam splits into crawler spam and ghost spam
Near-zero engagement on a high-volume source is the clearest tell
The unwanted referrals list reroutes spam, it doesn't delete it
Hostname filters catch ghost spam that never visits your site
You can exclude up to 50 domains per data stream
Filters aren't retroactive, so past reports stay polluted
Build a Complete Clean-Data Analytics Stack
Referral spam cleanup pairs directly with broader bot traffic filtering. Explore both guides next.
Related Posts
Previous Post
Next Post
Recent Posts
- PHP Error Logging and Monitoring: 7 Steps for Production Sites
- Generating PDF Reports in PHP: 7 Practical Steps With Real Code
- PHP Authentication System: Build It Securely in 6 Steps
- PHP PDO Prepared Statements: Stop SQL Injection in 5 Steps
- PHP Cron Jobs: Schedule Background Tasks in 5 Reliable Steps
