How to filter bot traffic in GA4: Step-by-step guide

GA4 has no bot-filter checkbox. It removes known crawlers automatically using the IAB bot list, and everything that list misses lands in your reports. That gap keeps growing: automated traffic passed 53% of all web traffic in 2025, according to Imperva's 2026 Bad Bot Report, and for the second year in a row bots outnumbered people online.

This guide shows how to spot bot traffic in your GA4 property and how to filter it with the tools GA4 does give you: report customization, segments, internal traffic rules, tagging and BigQuery. It also covers the newest arrivals, AI crawlers and AI agents, and the one thing no GA4 filter can do: stop bots from spending your ad budget.

What is bot traffic?

Bot traffic refers to non-human visits to your website, performed by automated software or scripts. These bots range from helpful (such as search engine crawlers) to malicious (such as click-fraud bots or scrapers).

While not all bots are bad, many serve no purpose for your analytics. They inflate your session count, distort bounce rates, and create confusion when measuring user behavior. Types of bot traffic include:

• Good bots: search engine crawlers (like Googlebot), social media bots, or uptime monitoring bots.
• Bad bots: click fraud bots, spam bots, web scrapers, and DDoS tools.
• Unknown bots: unidentified or suspicious traffic patterns that do not follow human behavior.

Common sources of bot traffic

Knowing which kind of bot you are looking at decides whether you filter it in reporting or block it before it arrives.

• Search engine crawlers: Googlebot, Bingbot and similar crawlers that index your pages. GA4 already excludes the known ones.
• SEO crawlers: tools such as Ahrefs and Semrush, useful to whoever is running them and useless in your reports.
• Monitoring bots: uptime and performance checks that hit your site on a fixed schedule.
• Scraping bots: harvest content, prices or product data for reuse elsewhere.
• Spam bots: post comments and submit forms, which is where they start polluting your conversions.
• Impersonator bots: mimic human interaction closely enough to pass CAPTCHA and create accounts or transactions.
• Click bots: click paid ads and inflate click counts.
• DDoS bots: flood the site with requests to slow it down or take it offline.

The last two cost money rather than only clarity. A GA4 filter cleans the report, but by then the budget is already spent, which is why bot traffic is a paid-media problem before it is a reporting problem.

Does GA4 automatically filter bots?

Partly. GA4 excludes known bots using a list maintained by the IAB (Interactive Advertising Bureau), combined with Google's own research. You cannot turn this off, and you cannot see how much traffic it removed. Three limits matter in practice:

• The list only covers known, declared bots. Custom scripts and newer bots walk straight past it.
• There is no user-facing checkbox or report, unlike Universal Analytics. You cannot audit what was excluded.
• Nothing you configure works backwards. Filters and exclusions only clean data from the moment you apply them; polluted history stays polluted.

That last point catches many teams out. If bots inflated last quarter's numbers, no GA4 setting will repair those reports. You can only annotate the period and compare cleaned data going forward.

Why bot traffic matters in GA4

A polluted property does more damage than an ugly sessions graph. Bot traffic affects:

• Conversion tracking accuracy: if bots trigger your conversion events (like form submissions or purchases), it becomes hard to trust your data.
• Audience creation: bots added to remarketing or custom audiences lead to irrelevant ad targeting and wasted impressions.
• Marketing attribution: bots often arrive through specific channels, falsely inflating referral or paid performance.
• Campaign optimization: with polluted data, optimizing your ads, SEO, or content becomes slow and expensive.

How to identify bot traffic in GA4

Before applying filters, confirm that bots are actually the problem. Look for these signs:

• Unusual traffic spikes: a sudden, unexplained surge in sessions or users, especially from specific countries.
• 100% bounce rates or session durations of 0s: bots do not scroll, click, or browse multiple pages.
• Strange source/medium tags: unfamiliar referrers or campaign parameters can mean bots are faking sources.
• High volume from a single location or IP: especially from countries not in your target market.
• New users only: bots rarely repeat visits, resulting in abnormally high new-user counts.

Customize your acquisition reports to surface those signs

GA4's default reports leave out the metrics that separate a bot from a person. Add them once and the pattern becomes visible in the two reports where bot traffic lands first.

Open Reports, expand Acquisition in the life cycle collection and pick either Traffic acquisition or User acquisition. Use the pencil icon in the top right to customize the report, then add metrics under Report data.

• Traffic acquisition: engagement rate, average engagement time, sessions, engaged sessions, views per session.
• User acquisition: total users, active users, new users, event count, engaged sessions per user.

Read those columns together rather than one at a time. A source that delivers a lot of new users with an engagement rate near zero and almost no engaged sessions is rarely human.

Filter bot traffic in GA4 step by step

GA4 does not offer the view-level filters Universal Analytics had, but practical methods exist to filter or flag bot traffic. Work through these steps:

Use segments in explorations

GA4 Explorations let you build custom reports using segments, and exclude traffic that meets suspicious criteria.

• Go to Explore in GA4 and choose a report type (like Free Form).
• Under Segments, click + to create a new segment.
• Exclude users or sessions based on source/medium (suspicious referrers), country (if junk clusters in certain regions), session duration of 0, or a 100% bounce rate.
• Apply the segment and analyze your clean traffic separately.

Exclude internal traffic

Internal visits from your team, agencies, or developers also pollute your data. GA4 lets you exclude them by IP.

• In GA4 Admin, go to Data Streams and open your web stream details.
• Scroll down to Tagging Settings, then Define Internal Traffic.
• Enter IP addresses and give them a name (e.g. Office IP).
• Under Data Settings, Data Filters, set the internal traffic filter to Testing first, check the result, then switch it to Active.

Use Google Tag Manager to set bot indicators

Google Tag Manager (GTM) can flag suspicious visits by setting custom parameters when conditions are met.

• Create a GTM variable that checks for screen resolutions bots typically report.
• Use a trigger for abnormal user agents.
• Pass this as a custom parameter (like is_bot = true) into GA4.

Later, you can segment or exclude that traffic in GA4 reports.

Set up a referral exclusion list

GA4 lets you stop specific domains from being counted as referrals, up to 50 per data stream. Go to Admin, open Data Streams, select the relevant web stream and list unwanted referral domains. This is the quickest way to keep one recurring spam referrer from distorting your whole channel report.

Filter on the signals bots get wrong

Universal Analytics let you build view-level filters and GA4 does not, but the same signals still work inside segments and explorations. The dimensions worth testing:

• Hostname: traffic reported against a hostname you do not own is almost always spam.
• User agent: known crawler strings, passed into GA4 as a custom parameter via GTM.
• ISP and data center origin: hosting providers and proxies instead of consumer ISPs.
• Browser language: bots often keep a default that matches no market you sell in.
• Screen resolution: default or improbable resolutions cluster tightly around a few values.
• Engagement: one page view, no scroll, under a second of engagement time.

None of these is conclusive on its own. Two or three of them on the same source is a reliable signal.

Block known bad referrers at the server

If you consistently see bot traffic from specific spammy sources, block them via server-side rules, .htaccess (for Apache), or Cloudflare rules that challenge or block that traffic. This does not show up in GA4; it prevents the visits from happening at all.

Use GA4 DebugView to monitor anomalies

DebugView is primarily for testing, but you can use it to detect repeated visits from the same device, unusual sequences of events, and traffic with suspicious metadata.

Integrate with bot protection tools

For businesses running paid campaigns or dealing with high traffic volumes, a dedicated bot protection layer catches what report filters cannot. Platforms like ClickCease, Cloudflare Bot Management, and ClickPatrol use behavioral analysis and real-time monitoring to identify fraudulent activity as it happens. ClickPatrol's bot detection and custom rules sit on the advertising side of the problem, which is the side a GA4 filter cannot reach.

By connecting insights from these tools with your GA4 reports, you can cross-check suspicious spikes, validate anomalies in session data, build cleaner custom audiences, and tune your exclusions on trusted third-party signals. If the bots are clicking ads specifically, start with blocking bot traffic in Google Ads rather than in analytics.

How to verify your data after filtering

A filter you never checked is a guess. After the changes above have run for a week or two, confirm they work:

• Compare pre- and post-filter metrics: engagement rate should rise and the new-user share should fall if the removed traffic was automated.
• Re-check the source/medium report: the referrers that triggered the cleanup should be gone or marginal.
• Perform test visits from trusted devices and confirm they still appear in reports. If real visits go missing, a rule is too blunt.
• Watch conversion counts: cleaned data usually shows fewer conversions but a higher conversion rate. If both drop hard, you filtered humans.

AI crawlers and AI agents in GA4

Since 2024, a new traffic class sits alongside classic bots. Imperva's 2026 report treats AI agents as a separate category of internet participant, and they behave differently in analytics.

• AI crawlers stay invisible. GPTBot, ClaudeBot, PerplexityBot and similar crawlers fetch your pages without executing JavaScript, so they never fire the GA4 tag. You will only see them in server logs or a CDN dashboard, not in GA4.
• AI referrals are humans. Sessions arriving from chatgpt.com, perplexity.ai or gemini.google.com show up as referral traffic. These are people who clicked through from an AI answer. Do not exclude them; segment them, because they often convert well.
• AI agents blur the line. Agent browsers that render pages on a user's behalf do execute JavaScript and can fire your tag, with bot-like engagement patterns. Expect this slice to grow and judge it by the same engagement signals as any other source.

A practical setup: create an exploration segment where session source matches the known AI domains, and review it monthly. It keeps the AI slice visible without letting it distort your channel totals.

Using BigQuery for advanced bot filtering

If you have connected GA4 to BigQuery (a free integration for GA4 users), you can run queries to detect and filter bot traffic based on patterns. Sample ideas for BigQuery filters:

• Sessions with fewer than two events and under one second of duration.
• Traffic from countries not in your market.
• Suspicious event parameters or campaign tags.

You can use this cleaned data for deeper analysis or dashboarding in Looker Studio.

Best practices for minimizing bot traffic in GA4

Even if you cannot catch every bot, you can reduce the impact:

• Regularly review traffic sources: inspect your source/medium report and look for odd referrers or traffic spikes.
• Use honeypots: place invisible form fields that users will not fill out, but bots will. A completed honeypot field marks the session as a bot.
• Apply country-based filtering: if your business is regional, create segments or tag rules for traffic outside your operating areas.
• Monitor performance metrics closely: sudden changes in bounce rate, session duration, or conversion rates can indicate bot activity.
• Enable CAPTCHA or reCAPTCHA on forms: prevent bots from completing forms or triggering conversions that skew data.
• Use event validation: make key events (such as purchases or form submissions) depend on human signals like clicks, scrolls, or mouse movement.

Will filtering bot traffic remove real visitors?

Done correctly, no. Every signal above separates automated behavior from human behavior, so real visitors stay in your reports. The risk sits in blunt rules: excluding an entire country or ISP that also contains paying customers costs you data you wanted to keep. Segment first, confirm the pattern, then exclude.

How often should you check for bot traffic?

Weekly if you run paid campaigns, monthly if you do not. Bot patterns change, so a segment or exclusion that matched last quarter can quietly stop matching without anything looking broken.

Why GA4 needs better bot detection features

The transition from Universal Analytics to GA4 brought real upgrades, but the bot filtering tools remain thin. GA4 filters some bot traffic automatically, yet Google has never published what its bot logic covers, which leaves blind spots you cannot measure. Until advertisers get real control over what counts as invalid, the practical route is the one in this guide: segments, internal traffic rules, GTM tagging, and BigQuery.

Do not let bots ruin your GA4 data

Bot traffic keeps growing and GA4 only removes the known part of it on its own. The rest is your job: recognize the signs, customize your reports, segment the junk out, and verify that the cleanup worked.

One caveat worth repeating: a GA4 filter fixes the report, not the traffic. The bots still arrive, and if they are also clicking your ads they are still spending your budget. A free click fraud analysis shows how much of your paid traffic is invalid before you change a single setting.