Strange traffic spikes in GA4: bots, spam and filters

Short answer: GA4 already removes known bots automatically, so a sudden spike usually means one of four things: unknown bots, spam hitting your measurement ID, your own team's visits, or a tracking setup problem such as a payment provider showing up as a referral. Find which one by looking at where the spike came from, then use the matching GA4 setting. Data filters are permanent once active, so test them before you switch them on.

You open GA4 and yesterday's users are five times higher than normal. Before you celebrate (or panic), work through the checks below. Each section starts with what you see, then how to confirm it, then what to change.

First, what GA4 already does

Google's help page on known bot-traffic exclusion says GA4 automatically excludes traffic from known bots and spiders, identified through Google's own research and the International Spiders and Bots List maintained by the IAB. You can't switch this off, and you can't see how much was removed. So when a spike gets through, it is, by definition, traffic GA4 doesn't recognize as a bot.

Symptom 1: A burst of users from one country or city you don't serve

Check: In the Traffic acquisition or Demographic details report, add country and city. Then compare engagement: real visitors scroll, click and visit more than one page; bots often show near-zero engagement time and a single page view. Look at device, browser and screen resolution too. Hundreds of sessions with an identical, unusual combination is a strong tell.

Confirm outside GA4: Your server or CDN logs show the IP addresses and user agents behind the requests. A behavior tool such as session recordings will often show "visits" with no movement at all.

Fix: GA4 has no built-in country or IP exclude for strangers' traffic (IP filters are designed for internal traffic). Your options:

Block or challenge the traffic before it reaches your site, at the CDN or firewall level, if it's hammering your server.
Use report filters or comparisons to hide it from the reports you share, without deleting data.
Build a segment in Explorations that excludes the pattern when you need clean numbers.

Symptom 2: Hits to pages or hostnames that don't exist on your site

Check: Add the "Hostname" dimension to a report. If you see domains that aren't yours, or page paths your site has never had, someone is sending data straight to your measurement ID without visiting your site at all.

Fix: GA4's data filters include a web hostname filter, which Google describes as a way to filter out domains where your property's event data comes from. Restrict data to your real hostnames (including any booking or shop subdomains). Test first, as explained below.

Symptom 3: Your own visits inflate small numbers

On a low-traffic site, the owner, staff and the web developer refreshing pages can be a large share of the total, and a day of redesign work can look like a spike.

Check: Does the spike line up with a launch, a content update or a staff training session? Does it come from your city on desktop during office hours?

Fix: Google's guide to filtering out internal traffic has two parts. First, define internal traffic in your web data stream by IP address or range (IPv4 or IPv6), which tags those events with a traffic type. Second, create an internal traffic data filter that excludes that traffic type. For people testing changes, the developer traffic filter excludes activity sent with debug mode switched on. Google notes you can't filter internal traffic from app users this way, and that a property can have up to 10 data filters.

Symptom 4: A referral source that is really your own checkout or login

Check: If "referral" traffic from your payment provider, booking engine or an email domain jumps after a promotion, it's not new visitors; it's existing ones coming back after paying or resetting a password.

Fix: Google's "List unwanted referrals" setting is designed for exactly this: third-party payment processors and website-managed steps like password recovery. Add those domains in the web stream's tag settings. Google points out that returning users who arrived before you added the domain can still be credited to it, because of how attribution works, so the change isn't instant in reports.

Symptom 5: Events doubled overnight

Check: Compare page views per session before and after. A sudden jump with no change in users often means the tag fires twice: once in the site code and once through a tag manager or a plugin added during an update.

Fix: Remove the duplicate installation, then annotate the date so you don't misread that period later.

Before you activate any data filter

Google's data filters page is blunt: once a data filter is applied, the effect is permanent, and excluded data is never processed or available in GA4 or BigQuery. Filters also only apply from the point of creation forward, so they won't clean up the spike you've already got.

That's why each filter has states. In "Testing", GA4 tags matching data with a "Test data filter name" dimension so you can check in Explorations that it catches the right traffic. Only switch to "Active" once you're sure. If you only want cleaner charts, Google recommends report filters instead, which hide data without destroying it.

A short routine for small sites

Set up internal and developer traffic filters on day one.
Add your payment and booking domains to unwanted referrals.
Check the hostname dimension once a month.
Keep an annotation log of launches, campaigns and tracking changes.
When a spike appears, read the engagement metrics before reading the user count.

FAQ

Can I remove spam traffic that's already in my GA4 reports?

Not permanently. Data filters only affect new data. Use report filters, comparisons or Exploration segments to view past data without it.

Why doesn't GA4 catch all bots?

GA4 excludes known bots from a maintained list. New or disguised bots that behave like browsers aren't on that list, so they can slip through.

Should I block a whole country to stop bot traffic?

Only if you genuinely don't serve it, and do it at the firewall or CDN level rather than in analytics. Blocking can stop real customers who travel or use VPNs.

Could a spike be real after all?

Yes. A mention in the news, a viral social post or a newsletter link can all send genuine bursts. Real spikes come with a clear referral or campaign source, normal engagement time and visits to several pages.

If spikes keep distorting the numbers you use to make decisions, ask us to audit your GA4 setup and filters.