In Universal Analytics, keeping known bots and spiders out of your data meant adjusting view settings to manually "Exclude all hits from known bots and spiders." This helped, but spam and ghost referrals - including cases where spammers used the UA measurement protocol to send fake hits directly into accounts still sometimes got through. This meant most properties still needed extra exclusion filters for unwanted referrals or hostnames. GA4 takes a different approach that fixes a range of issues although some gaps remain.

What GA4 does automatically

Within GA4, known bots and spiders are excluded from your data automatically. Bot traffic is identified using a combination of Google's own research and the IAB/ABC International Spiders and Bots List. This is a maintained registry of known crawlers such as search engine bots. GA4 also tightens up the measurement protocol itself - sending data to your property now requires an API secret which resolves the issue with ghost referrals in Universal Analytics.

The trade-off is visibility and control. At present there's no report showing how much traffic GA4 identified as bot activity and no way to add your own rules to by adding filters. This means that more sophisticated automated traffic that mimics a real browser can sometimes still appear in your reports.

How can you identify bot traffic in GA4?

The first sign of a bot hitting your site is often an anomaly rather than anything explicitly labelled as one. This may be a sudden spike in traffic or a drop in engagement rate from a particular channel. A sudden rise in direct or unassigned traffic can often be a warning sign although do check whether your channel definitions and UTM codes are up to date. Another flag comes with a spike in traffic with a low number of engaged sessions or a low average engagement time.

If you suspect a bot is behind an anomaly, GA4's Explore reports are the best place to investigate. Things to check include:

  • Was there a sudden, one-off spike in traffic from a particular source?
  • Does the anomaly repeat at regular intervals - for example, every six hours or every few days?
  • Where is the traffic coming from geographically and are those locations expected for your audience?
  • What pages is the traffic landing on - is it concentrated on the homepage and are there unusual query strings attached to the page views?
  • Are the browser, device type and screen size suspiciously uniform across sessions?

What can you do about bot traffic?

Once you've identified a likely bot traffic problem, your options inside GA4 itself are unfortunately limited. At present GA4's Data Filters only let you exclude traffic by IP address - useful for filtering internal or developer traffic but not built for general bot exclusion. Some other options worth considering:

  • Check server logs. Ask your developers to look for suspicious activity tied to specific IP addresses. If any are identified, explore whether they can be blocked at server level or added to an IP exclusion filter in GA4.
  • Explore third-party bot blocking tools. Dedicated bot management and fraud-detection tools are built to catch the sophisticated, human-like traffic that GA4's built-in filter is not designed to stop.
  • Add a robots.txt file. A robots.txt file in your site's root directory. This won't block malicious bots, but it does instruct legitimate search engine crawlers on what they can and can't crawl.
  • Use segments and filters downstream. If suspicious traffic shares a region or combination of technical dimensions - screen size, device type, and so on - you may be able to exclude it using segments in GA4 Explore, or filters in Looker Studio. Be cautious here as broad rules can exclude genuine visitors too.
  • Explore exclusions at the tracking layer. If you manage Google Analytics through Google Tag Manager, there may be options to prevent suspect traffic from firing tags at all. This may be able to stop bot traffic before it reaches GA4 although this can be complex to implement.
  • Set up anomaly detection alerts. Set up alerts in GA4 to detect anomalies - the "Anomaly in daily users" and "Anomaly in daily views" alerts are both useful in detecting unusual activities early.

Unfortunately none of these fully replace the flexibility of the old view-level bot filters and custom exclusion rules in Universal Analytics. Used together however they can give you a reasonable way to catch and manage bot traffic that GA4's automatic filtering is unable to.