How to Block Referral Spam in Google Analytics

Opening Google Analytics and seeing traffic from domains like semalt.com or buttons-for-your-website.com can be confusing and alarming. This isn't real traffic, it's referral spam, and it’s slowly corrupting your data, making it harder to understand your actual performance. This article will show you exactly how to identify referral spam and, more importantly, how to block it in Google Analytics 4 for good.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What Exactly Is Referral Spam and Why Does it Matter?

Referral spam is fake traffic sent to your website's Google Analytics property. Spammers do this for a few reasons, like hoping you'll visit their URL out of curiosity (potentially leading to a malicious site) or trying to get their link crawled for black-hat SEO purposes. It clutters your reports and makes your data unreliable.

There are two main types you'll encounter:

• Ghost Spam: This is the most common type. These spammers never actually visit your site. They find your GA Measurement ID and send fake data directly to Google's servers. Think of it like someone registering a fake delivery in a shipping company's system without ever sending a physical package, the data appears in the system, but nothing ever arrived at your warehouse. This is why some spam shows up with a 100% bounce rate or 0s session duration - because no "real" session ever happened.
• Crawler Spam: This is a more traditional bot. These are actual automated crawlers that land on your site, ignore rules set in your robots.txt file, and execute the GA tracking code. They show up as real visitors in your reports, but their behavior is clearly robotic and offers no value. While less frequent than ghost spam, it's still a nuisance that can skew your metrics.

Why You Absolutely Need to Get Rid of It

Ignoring referral spam isn't an option if you rely on data to make decisions. Leaving it unchecked will slowly poison your analytics and lead to bad conclusions.

• It Skews Your Metrics: Spam traffic typically has bizarre engagement metrics - often a 0% engagement rate or a single page view. A sudden surge in spam can artificially tank your site-wide engagement rates, making it look like your content is performing poorly when it’s not.
• It Pollutes Your Reports: The most significant problem is that it becomes impossible to trust your traffic acquisition reports. How can you know which marketing channels are working if a chunk of your "referral" traffic is pure junk? You can’t properly measure ROI or allocate your budget effectively.
• It Wastes Your Time: Manually filtering out junk from reports every time you analyze performance is a frustrating and tedious process. You should be spending your time on insights, not on data janitorial work.

How to Identify Referral Spam in Google Analytics 4

Before you can block the spam, you need to confidently identify it. This is a simple process of looking for traffic that just doesn't behave like a human visitor.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Step 1: Finding Spammy Domains in Your Reports

First, you need to find where these fake referrers are hiding. In GA4, the primary report for this is the Traffic Acquisition report.

1. Navigate to Reports → Acquisition → Traffic acquisition.
2. The default primary dimension is "Session default channel group." Click the dropdown and change this to Session source / medium. This will give you a list of the specific domains sending traffic.
3. Extend the date range to the last 90 days to get a bigger data sample.
4. Now, scroll through the list and look for anything suspicious.

Spam domains usually stand out. Their names contain things like "seo," "buttons," "share," "videos," or gibberish. They often have nothing to do with your industry. Domains like traffic-generator.org, event-tracking.com, or social-buttons.com are common culprits.

Step 2: Checking for Suspicious Behavior

Once you’ve spotted a suspicious domain, look at its engagement metrics. Real visitors click around, scroll, and spend a few moments on a page. Spam bots typically don't.

Look for these telltale signs for a specific traffic source:

• Extremely Low Engagement Rate: A 0% or close-to-zero engagement rate is a massive red flag. This indicates the "user" landed and did absolutely nothing recognized as engagement before the session ended.
• Very Low Engaged Sessions: Look for sources sending hundreds of sessions but generating only one or two engaged sessions. This behavior is unnatural.
• Irrelevant or Strange Hostname: This is the single most effective way to spot ghost spam. The "hostname" is the domain where the GA tracking code was fired. Normally, this should only be your website's domain (e.g., yourwebsite.com). Ghost spam often shows up with a hostname that is (not set) or the spam domain itself.

To check the hostname for a referral source, add it as a secondary dimension to your report:

1. In the Traffic Acquisition report, click the blue + icon next to the primary dimension dropdown.
2. In the search box, type and select Hostname.
3. Now you'll see the hostname associated with each traffic source. If you see your main suspicious referrer has a hostname that isn't yours, you've found ghost spam.

How to Block Referral Spam in GA4 for Cleaner Data

Google has been making improvements, and GA4 does have a default setting to filter out known bots and spiders. You should ensure this is active first:

• Go to Admin → Data Collection and Modification → Data Streams.
• Click on your web data stream.
• Under "Events," click on Configure tag settings.
• Under "Settings," click Show more.
• Select List unwanted referrals. Hang tight, we'll configure this next.
• Go back and click on Manage known bots. Ensure that "Exclude all traffic from known bots and spiders" is checked. This won't catch everything, but it's your first line of defense.

Now, let's move on to the more direct methods for filtering out the spammers that sneak past this default filter.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

The Best Method: Using 'List Unwanted Referrals' in Admin Settings

Unlike Universal Analytics, GA4 does not have View Filters where you could create complex rules to block spam. The modern equivalent - and the most effective weapon against referral spam - is the "List Unwanted Referrals" feature.

This tells Google Analytics that traffic coming from certain domains should not be considered "Referral" traffic. Instead, if referral traffic from a domain you list matches a new session, it will be labeled as (direct) traffic. This effectively removes it from your referral report, cleaning up your attribution data.

Here’s how to set it up:

1. Click on Admin in the bottom-left corner of GA4.
2. Under the "Property" column, go to Data Streams and select your web stream.
3. In the "Google tag" section, click Configure tag settings.
4. On the settings screen, click the Show more button.
5. Click on List unwanted referrals.
6. Under "Match type," select Referral domain contains.
7. In the "Domain" field, enter the spam domain you identified (e.g., semalt.com). Click Add Condition for each new domain you want to block.
8. Rinse and repeat for every spam domain on your list.
9. Click Save when you are finished.

This is the most direct and "official" way to clean up your referral reports moving forward. The biggest benefit is that it keeps the junk out permanently without you needing to apply a filter every time you open a report.

What About Your Historical Data?

It's important to understand that the "List unwanted referrals" rule you just created does not work retroactively. It will only clean your data from the moment you save the changes. Your past data will still be polluted with spam referrals.

When you need to analyze historical data, you'll have to use temporary report filters to see the clean truth. This is also a good way to double-check that your new filters are working as expected.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

How to Temporarily Filter Spam in Your Reports

For one-off analyses or creating a clean report to share, using a filter is the way to go.

1. Open the report you want to analyze (e.g., Reports → Acquisition → Traffic acquisition).
2. At the top of the report, click the Add filter button (it has a pencil icon).
3. A panel will open on the right. In the "Build filter" section, set the following conditions:

• Keep the "Include" radio button selected.
• Dimension: Search for and select Session source.
• Match Type: Select does not contain.
• Value: Enter the name of a spam referral source (e.g., "semalt"). Wait to hit apply!

1. To filter multiple spam sources at once, click Add new condition and repeat the step above with an "OR" logical operator. This is tedious, which is why the permanent Admin-level filter is a better long-term solution.
2. Alternatively, you can create a more complex filter using "does not match regex." For the value, you can enter multiple domains separated by a pipe (|). For example: semalt|buttons-for-website|event-tracker.
3. Once your conditions are set, click the blue Apply button.

Your report table and charts will now refresh to show data excluding the spam domains you filtered out. Just remember that this filter is temporary, if you navigate away and come back, you'll have to reapply it.

Final Thoughts

Blocking referral spam in Google Analytics isn't just about technical housekeeping, it's about reclaiming the integrity of your data. By routinely identifying spammers and using GA4's "List Unwanted Referrals" tool, you can ensure your reports are accurate, making your insights reliable and your strategic decisions sound.

We know how critical it is to get clear, trustworthy answers from your data without spending hours wrestling with reports. At Graphed, we designed our platform to eliminate this friction. By seamlessly connecting with your Google Analytics, you can use simple, natural language to get the insights you need. Instead of creating manual report filters, you can just ask, "Show me my top 10 traffic sources this quarter, excluding traffic from semalt.com," and get an instant, real-time dashboard, so you can focus on strategy, not data cleaning.