How to Filter Out Bots in Google Analytics

Seeing your website traffic go up is exciting, but what if those "visitors" aren't real? Bot traffic can quietly inflate your numbers, making your reports inaccurate and leading you to make bad decisions. This guide will walk you through exactly how to spot and filter out bots in Google Analytics 4, ensuring the data you rely on is clean, accurate, and truly reflects your human audience.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

First, What’s the Big Deal About Bot Traffic?

You might be wondering if a few bots really matter. In short, they absolutely do. When bots and spam crawlers hit your site, they wreak havoc on the metrics you use to measure performance, leading to a distorted view of your marketing efforts.

Here are a few ways junk traffic can throw you off:

• Inflated Session and User Counts: The most obvious impact is that bots make it look like you have more visitors than you actually do. This can give you a false sense of growth and make it difficult to understand your real audience size.
• Skewed Engagement Metrics: Most bots visit a single page and leave immediately. This behavior drives your engagement rate down and makes your average session duration appear shorter than it really is. You might think your content is failing to engage users when, in reality, it's just bots interacting with it.
• Inaccurate Conversion Rates: If you're getting 1,000 bot visits and 100 real visits, but only 5 conversions, your conversion rate looks dismal. But when you factor out the bots, your conversion rate on actual human traffic might be quite healthy. Bots don't buy products or fill out contact forms, so they dilute your real conversion performance.
• Misleading Demographic and Geographic Data: Spam traffic often originates from specific servers around the world. You might suddenly see a spike in traffic from a country where you don't do business, leading you to waste time investigating a "new market" that doesn't actually exist.

Ultimately, bad data leads to bad strategy. Cleaning up your analytics is a foundational step to making smarter decisions about your website, content, and marketing campaigns.

How to Spot Bot & Spam Traffic in Your GA4 Reports

Before you can filter out bots, you need to know what to look for. While some junk traffic is obvious, other types can be subtle. Here are a few telltale signs that you've got bots crawling your website.

Sudden, Unexplained Traffic Spikes

Did your traffic double overnight for no apparent reason? While we all hope for a viral hit, a sudden, massive spike without a corresponding marketing push, press mention, or viral social media post is often a red flag. Dig into the 'Traffic acquisition' report to see where this new traffic is coming from. If it's all "Direct" or from a strange-looking referral source, it's likely not legitimate.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Weird Referral Sources

One of the most common signs of junk traffic is "referral spam." This is when bots visit your site, making it appear as though you're getting traffic from another website. Look at your 'Traffic acquisition' report and check the referral sources. If you see domains that look fishy (e.g., "seo-for-free.com," "buy-crypto-now.xyz"), it's spam. These are not real visitors and are simply trying to get you to visit their site.

Location Data That Makes No Sense

Head to the 'Demographic details' report and view users by country. Does your traffic map make sense for your business? If you're a local plumber in Cleveland, Ohio, but you're seeing thousands of sessions from Moldova or Ukraine, that's almost certainly bot traffic. Unless you have a specific reason to expect an international audience, geographically irrelevant traffic is a huge indicator of spam.

High Traffic with Almost Zero Engagement

A key difference between a human and a bot browsing your site is engagement. A human clicks around, scrolls down the page, and spends time reading. A bot usually hits one page and leaves. In GA4, this is reflected in the Engagement rate metric. If you see a traffic source that's sending hundreds of users but has an engagement rate of 0% or 1%, you've found a source of bot traffic.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Cleaning Your Data: Two Key Ways to Filter Bots in GA4

The good news is that Google Analytics 4 has some built-in tools to help you manage this. While GA4 is better at filtering bots automatically than its predecessor (Universal Analytics), there are still a few essential steps you should take to keep your data as clean as possible.

Method 1: Identify and Exclude Unwanted Referrals

Unlike the old Universal Analytics, GA4's general bot filtering is automatic and can’t be turned off. This is a big improvement and catches most of the generic bot activity. However, you still need to tell Google which specific referral domains you consider spam.

This is perfect for blocking those weird domains you found earlier. Here's how to do it:

1. Navigate to the Admin section by clicking the gear icon in the bottom-left corner.
2. Under the "Property" column, click on Data Streams.
3. Select the appropriate data stream for your website.
4. Scroll down and click on Configure tag settings.
5. On the new screen, click Show all if you don't see the option, then select List unwanted referrals.
6. Under Match type, select an option like "Referral domain contains".
7. In the Domain field, enter the spammy domain you identified (e.g., spam-seo-website.com).
8. Click Add condition to add more domains, and repeat the process until you've listed all the unwanted referrers.
9. Click Save.

This will prevent traffic from those spam sources from appearing in your reports going forward. It's a good idea to perform this check once a month to catch any new spam domains that pop up.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Method 2: Create Data Filters to Exclude Internal & Developer Traffic

Another source of "unwanted" traffic often comes from you, your team, and your web developers. While not malicious like spam bots, your own activity can still skew your data, especially if you have a team frequently visiting the site to make updates or check content.

GA4 provides a great way to filter this out using what it calls "Internal Traffic" filters. It’s a two-step process.

Step 1: Define Your Internal IP Addresses

First, you need to tell Google which IP addresses belong to your team.

1. Go back to Admin → Data Streams → [Your Data Stream] → Configure tag settings.
2. Click Define internal traffic.
3. Click the Create button.
4. Give your rule a name, like "Office IP Address."
5. The 'traffic_type' value is 'internal' by default. Leave this as is.
6. Under IP address, choose a "Match type" (e.g., "IP address equals") and enter an IP address. You can find your current IP by Googling "what is my IP address."
7. If your team works from various locations, you can add a range of IPs or add multiple conditions for different office locations or team members' homes.
8. Click Create to save the definition.

Step 2: Activate the Data Filter

Just defining the traffic isn't enough, you now need to create and activate a filter to exclude it.

1. Go to Admin and, under the "Property" column, click Data Settings → Data Filters.
2. You will see a filter named "Internal Traffic" that GA4 creates by default. It's in "Testing" mode.
3. Click the three dots on the right side of that filter and select Activate filter.
4. Confirm your choice in the pop-up.

After activating, GA4 will start excluding all data that matches the IP addresses you defined. This keeps your reports focused on real, external customers.

Final Thoughts

Cleaning bot traffic from your Google Analytics is a non-negotiable step for anyone serious about making data-driven decisions. By regularly monitoring your traffic for suspicious activity and using GA4's built-in filters for unwanted referrers and internal traffic, you ensure your reports reflect true customer behavior, giving you the confidence to build a better strategy.

Wrestling with data in Google Analytics is often just the beginning. The real challenge comes from pulling together your analytics, ad performance, sales data from Shopify, and CRM activities into one cohesive picture. This is where we built Graphed to help. We make it easy to connect all your data sources and create live dashboards using simple, natural language. Instead of fighting with filters and manual reports, you can just ask questions like "Show me which ad campaigns are driving the most Shopify sales this month" and get an instant, real-time-updated dashboard.