Google Analytics Referral Spam: Spot It Before Clients Do

The client emails on a Tuesday morning: "Traffic doubled last week! What did you do?"

You open GA4. Sessions did double, all from a referral domain nobody has heard of. Every one of those sessions lasted about a second, landed on the homepage, and came from a city where the client doesn't do business. Nothing you did. No real people.

Now you have to walk back a number the client was excited about. That conversation is much easier when you start it, not them.

This guide covers how to spot referral spam and bot traffic in GA4, what Google already filters for you, what you can and can't do about the rest, and what to tell the client.

Signs Your Client's GA4 Has Spam or Bot Traffic

Real visitors are messy. Junk traffic tends to be suspiciously uniform. Look for several of these together:

A sudden referral spike from an unfamiliar domain. Especially one with "SEO," "traffic," or "buttons" in the name, or one that has nothing to do with the client's industry.
Near-zero engagement. Average engagement time of zero or one second, and an engagement rate far below the site's normal.
One landing page. Almost every session hits the same page, usually the homepage.
Odd geography. A burst of traffic from a country or city the client doesn't serve, with no campaign that would explain it.
Odd timing. Hundreds of sessions in a short window in the middle of the night, then nothing.
No key events. Thousands of new sessions, zero form fills, zero purchases.

One sign alone can be innocent. A press mention can send a spike from an unfamiliar domain. Three or four together is almost always junk.

What GA4 Filters Automatically (and What It Doesn't)

What Google handles: GA4 automatically excludes traffic from known bots and spiders. Google says it identifies them using its own research plus the IAB's International Spiders and Bots List, and that you can't turn this off or see how much was removed. See Google's page on known bot-traffic exclusion.

What still gets through: "Known" is the key word. Bots that aren't on the list, scrapers that behave like browsers, and junk referral hits can still land in reports. So does traffic that isn't spam but still isn't customers: your own team, the client's staff, and developers testing the site.

So the job splits into two parts: junk you can block going forward, and junk you can only work around in past data.

How to Identify It in GA4 (Step by Step)

1. Find the source. Go to Reports → Acquisition → Traffic acquisition, then switch the primary dimension to Session source / medium. Sort by sessions and look for unfamiliar referral domains near the top.

2. Check engagement. In the same table, look at average engagement time and engagement rate for the suspicious row. Junk traffic usually sits far below the site's average.

3. Confirm with a second dimension. Add a secondary dimension such as country, city, or landing page. Junk traffic tends to cluster in one value.

4. Compare with Search Console. If the spike shows up as Organic Search, compare it with clicks in Search Console for the same dates. If Search Console shows no matching rise in clicks, the "organic" visits probably aren't coming from Google search results.

5. Decide: real, internal, or junk. Real traffic you leave alone. Internal traffic you filter (below). Junk you handle with the steps in the next section.

How to Keep It Out Going Forward

Define internal traffic and turn on the data filter

Your agency's own visits, and the client's staff, aren't spam, but they still distort the numbers. GA4 lets you define internal traffic by IP address and then exclude it with a data filter.

Two cautions from Google's documentation:

Data filters are permanent. Excluded data is never processed and can't be recovered. Google's data filters page says to use report filters instead if you only want to hide data.
Test first. A new filter can be set to Testing, which labels matching traffic instead of removing it. Check it in Explorations for a few days, then switch it to Active.

List unwanted referrals

Some "referrals" are really part of the client's own checkout or login flow: a payment processor, a booking engine, a password-reset email. GA4 lets you identify unwanted referrals so those domains stop taking credit for the visit.

This setting is meant for legitimate third-party domains in the client's journey. It isn't a spam blocker, and adding spam domains here won't remove the junk sessions.

Handle past data with comparisons and report filters

Filters aren't retroactive. Google is explicit that data filters work from the moment they're created forward. They don't change historical data.

For past months, exclude the junk at the reporting level instead:

Add a comparison or report filter that excludes the spam source, so you can show the "clean" number side by side with the raw one.
In Explorations, build a segment that excludes the junk source or the near-zero-engagement sessions.
Keep a note of which months were affected, so year-over-year comparisons still make sense next year.

When to involve the developer

If bots are actually hitting the website (not just showing up in GA4), that's a site problem, not an analytics one. Signs include junk form submissions or a server load spike at the same time as the traffic spike. Bring in the client's developer or host. Bot protection at the server or firewall level is their job, and it stops the problem upstream of GA4.

What to Tell the Client

Send the note before the client spots the spike. Two sentences is enough:

"We noticed a jump in traffic last week from [source] that isn't real visitors. It's automated traffic, so we've excluded it from your report, and your actual traffic was [clean number], in line with the month before."

If you changed a setting, add one more line:

"We've also updated a setting in GA4 to catch more of this from now on, and we'll keep an eye on it."

That's it. No jargon about bots or IAB lists unless they ask. The point is simple: you caught it, here's the real number, and it's handled. For more on how to frame data conversations like this, see how to explain analytics to clients.

Add a "Data Notes" Line to Every Monthly Report

Make this a habit, not a one-off. Add a short Data notes line to every monthly report, even when it says "None this month." When something does happen, such as a spam spike, a filter change, or a tracking fix, it goes there.

GA4 now has built-in annotations for this. Users with Analyst access or above can add a note to a date on a report's line graph, so the next person who sees the spike knows what it was.

Data notes also help with the other common "why did the numbers change?" question: timing. If the client checks yesterday's numbers before GA4 has finished processing them, see our guide to GA4 data delays in reporting.

Frequently Asked Questions

Does bot traffic hurt SEO? Junk sessions in GA4 are a measurement problem: they make the report wrong. Bots that actually hammer the website can cause other issues, like slow pages or junk form submissions, and those are worth raising with the developer.

Can I delete spam data from GA4? Not selectively. You can't go back and remove specific past sessions from standard reports. Use comparisons, report filters, or segments to show the clean number for past periods, and data filters to keep internal traffic out from now on.

Why does my referral list show the client's own domain? That's a self-referral, and it usually means sessions are breaking somewhere: a subdomain without consistent tagging, or a second domain without cross-domain measurement. It's a tracking setup issue, not spam. Our GA4 audit checklist covers how to check for it.

Is this my fault as the agency? No. Spam and bot traffic can hit any site. What's on the agency is noticing it first and explaining it clearly, which is exactly what the client note above does.

Can I block a spam domain in GA4? Not by referral name. GA4's data filters cover developer traffic, internal traffic, and web hostname traffic. A hostname filter can help when junk hits claim to come from a hostname that isn't the client's site. For everything else: known bots are excluded automatically, internal traffic gets a filter, legitimate third-party domains go on the unwanted referrals list, and the rest is handled in reports.

The cleanest report is one the client can trust without asking how it was made. Helpful Analytics gives your agency a simple, shareable view of each client's GA4 property, so the conversation stays on what the numbers mean. Try it free for 14 days.

Related Articles