Bot traffic in Google Analytics 4
GA4 removes only known bots, using Google's research and the IAB bots list, and you cannot see or change that filter. Headless browsers and bot waves from data centers still land in your reports, usually as Direct traffic with almost no engagement. Find them with segments, keep them out of decisions, and block them before they reach the site.
What GA4 filters out by itself
Google Analytics 4 automatically excludes traffic from known bots and spiders. Google identifies them with its own research and the International Spiders and Bots List maintained by the IAB. Two details matter:
- You cannot turn this exclusion off.
- You cannot see how much traffic it removed.
The list covers bots that announce themselves: search crawlers, monitoring services, well-known tools. It does not catch a script that runs a real Chrome browser, executes your tracking code and sends no bot signature. Those sessions count like any visitor.
Why bot traffic still shows up in GA4
Modern scrapers and traffic bots run full browsers in the cloud. To GA4 they look like people: the page loads, the tag fires, a session starts. Many site owners see sudden waves of such sessions, often reported from countries they do not sell to, often as Direct traffic, often lasting a few days and then disappearing.
The cost is not the bandwidth. It is the decisions made on bad numbers. A store whose sessions double overnight with no new orders sees its conversion rate halve. Teams then cut ad budgets that were working, or redesign pages that were fine. In one store we analyzed, about 70% of GA4 sessions over three months turned out to be bots, and they were the main reason the conversion rate seemed to fall.
How to spot bot sessions in your reports
No single signal proves a session is a bot. A combination of several is a strong hint. These are the patterns that show up again and again in bot reports:
| Signal | Where to look in GA4 | What bots look like |
|---|---|---|
| Channel | Traffic acquisition: Session default channel group | Direct or Unassigned, rising without any campaign |
| Engagement | Engagement rate, average engagement time | Close to zero: one page view, a few seconds |
| Location | Demographic details: Country, City | Countries you do not sell to, cities "(not set)" or data center towns |
| Device | Tech details: Operating system, Screen resolution | Desktop Linux, unusual screen sizes repeated thousands of times |
| Language | Tech details: Language | English browser language in a country where people rarely use it |
| Timing | Hourly trend in Explorations | Spikes at night that do not match your customers' time zone |
Rule of thumb: check the sessions that match three or more of these signals. If they also have zero add-to-carts and zero purchases over weeks, you can treat them as bots. Never filter by country alone: real customers from that country disappear with the bots.
Filtering bots out of your GA4 reports
GA4 gives you fewer tools here than many people expect.
Data filters in Admin cover only three cases: internal traffic (by your own IP addresses), developer traffic in debug mode, and unwanted hostnames. They cannot remove a bot wave by country, device or behavior. Data filters also do not change data that was already collected.
Segments and comparisons are what works. In Explorations, build a segment that excludes sessions matching your bot signals, for example Direct sessions from desktop Linux with an engagement time under a few seconds. Save it and use it for every analysis you base decisions on. For standard reports, add a comparison with the same conditions. Your historical data stays as it was, but your conclusions stop being driven by bots.
Hostname filter: if bots send hits with your measurement ID from other domains, a hostname data filter removes those going forward.
Stopping bots before they reach GA4
Filtering in reports hides the symptom. The bots still load your server, scrape your prices and distort every other tool. The better fix is to stop them at the edge, before the page and the tag ever load.
If your site is behind Cloudflare, the traffic analytics there show what GA4 cannot: the network (ASN) each request comes from, the user agent and whether Cloudflare has verified the bot. A bot wave in GA4 almost always maps to one or two networks in Cloudflare. A custom rule can then challenge exactly that traffic, while letting verified crawlers through:
(ip.src.asnum eq 14061 and not cf.client.bot)This example targets DigitalOcean (AS14061). Replace the network number with the one your own data points to. Use Managed Challenge, not Block, so a rare real visitor on that network can still pass. Excluding cf.client.bot keeps search engines and ad crawlers safe, which also protects your SEO.
The step most people skip is checking which network it really is. A free bot traffic report matches the waves you see in GA4 with the networks, user agents and hours in Cloudflare, so the rule hits the bots and not your customers.
After the fix: compare clean numbers
Once bots are blocked at the edge, new GA4 data is clean, while your history is not. When you compare periods, use your bot-excluding segment on the older dates, or you will read the drop in bot sessions as a drop in traffic. Note the date of the change in an annotation so everyone who reads the reports knows where the line is.
FAQ
Can I delete bot traffic from GA4 history?
No. Data filters work only from the moment you create them, and there is no tool to remove past sessions by behavior. Use a segment that excludes bot sessions when you analyze older data.
Does GA4 exclude Googlebot?
GA4 excludes known bots and spiders automatically, and search crawlers are among the best-known bots there are. You cannot confirm it for a specific bot, because GA4 does not show what it excluded.
Why is the bot traffic marked as Direct?
Bots usually open your pages without a referrer and without campaign tags, so GA4 has no source to attribute them to.
Will blocking bots in Cloudflare lower my traffic numbers?
Yes, and that is the point. Sessions drop by the share bots had, while orders and leads stay the same, so your real conversion rate becomes visible.