Bots in Google Analytics 4: How to Spot Bot Traffic in Your Reports and Keep It Out of Your Conclusions

You launch a campaign, open Google Analytics 4 and see something odd: sessions have doubled while engagement has dropped. Or a city where you have never had a single customer suddenly appears in the city report, with hundreds of visits lasting a second each. That is bots in Google Analytics 4 — the share of automated traffic GA4 did not recognize and dutifully counted.

Bot traffic in analytics does not cost money by itself. It costs you conclusions: because of it you cut a good campaign, praise a bad one, miscalculate conversion rates and train ad platform algorithms on the wrong people. Below is how to find this traffic in your reports, what GA4 does with it on its own, what you can configure, and where the built-in tools run out.

What GA4 excludes on its own

GA4 has built-in exclusion of traffic from known bots and spiders. Google relies on an industry list of robots and its own data. Three things are worth understanding:

• You cannot turn it off. Unlike the old version of Analytics, there is no checkbox — exclusion is always on.
• You cannot measure it. GA4 does not show how many visits were dropped, so you cannot judge the scale from GA4 itself.
• It covers only known robots. The exclusion catches programs that identify themselves as robots or have long been known. A bot that launches a real browser, runs JavaScript and poses as a visitor on a home connection looks like a person to GA4.

It is that second kind — sophisticated invalid traffic, covered in detail in invalid traffic: GIVT and SIVT — that ends up in your reports.

Where bot traffic shows up in GA4 reports

A bot is given away not by one metric but by a combination. The easiest way is to go through four views.

Traffic sources

Open Reports → Acquisition → Traffic acquisition and look at the “Session source / medium” and “Session default channel group” dimensions. Red flags:

• a sharp rise in Direct with no visible reason — no newsletter, no offline ads, yet twice as many direct visits;
• Unassigned and (not set) — sessions GA4 could not attribute to a channel. Everyone has a small share, but a spike often means requests that did not come from a browser the usual way;
• referral sources with unfamiliar domains — referral spam that visits just to get a link into your report;
• paid traffic without tags. If an ad campaign brings a noticeable share of visits without a gclid or UTM, some of them may be robots that opened the landing page via a link rather than an ad click. How a click ID helps separate real clicks is covered in click ID and SubID.

Engagement

In GA4 a session counts as engaged if it lasted longer than 10 seconds, had a key event, or had at least two page views. Bounce rate here is just the flip side: the share of sessions that were not engaged.

Bots usually produce:

• an engagement rate near zero for a specific source, campaign or city;
• an average engagement time of one or two seconds — or exactly the same across hundreds of sessions;
• one page view per session on a good landing page where people normally click further.

The opposite happens too: advanced bots imitate scrolling and linger on the page. Engagement then looks decent, and what gives them away is uniformity and the absence of conversions.

Geography

Reports → User → Demographic details, with the “Country” and “City” dimensions. Signs:

• visits from countries you do not advertise in;
• one city with a disproportionate number of sessions and zero engagement;
• city (not set) at a noticeable volume — this happens when a visit came from a network that is hard to pin to a place, such as a data center.

In recent years analysts keep seeing waves of direct traffic from one or two cities with zero engagement: in essence, servers opening pages en masse. Why traffic from cloud networks is almost never a person is explained in VPN, proxies and data center IPs.

Technology and time

Reports → Tech → Tech details shows the browser, OS, screen resolution and browser version. A hundred sessions with the same rare resolution and an old browser version are not an audience but a script. More on the traces automation leaves in a browser — in our piece on headless browsers and browser fingerprinting.

Add the “Hour” dimension to any report in Explore: a flat line around the clock in one country is a bad sign, because a live audience sleeps.

Signs of bots in GA4: a quick table

A more general list of signs, not tied to GA4, is in bot traffic: signs and how to detect it.

How to filter bot traffic in GA4

There are few built-in tools, and each has a cost. It is important to tell filters, which change the data for good, from segments and comparisons, which only change how you look at it.

Internal traffic

Start with your own noise: you, your team, contractors and your monitoring tools also end up in the reports.

1. Admin → Data streams → your web stream → Configure tag settings → Define internal traffic. Set rules by IP address or range. Such visits get a traffic_type parameter with the value internal.
2. Admin → Data collection and modification → Data filters. An “Internal Traffic” filter is already there. First switch it to Testing: no data is removed, but a dimension with the test filter’s name appears in reports, so you can see exactly what would be cut.
3. Once you are sure the filter catches the right things, switch it to Active.

Remember: an active filter does not apply retroactively and excludes data permanently. Filtered data cannot be restored.

The same mechanism works for known bot addresses — for example, if a particular monitoring service crawls you regularly. But IP rules are only good for stable addresses. Against bots that come from a new address every time, including through residential and mobile proxies, they are useless.

Developer traffic and unwanted referrals

The Developer Traffic filter removes events sent in debug mode. Tag settings also have a List unwanted referrals option: domains on it will not count as a source. This does not remove bot visits, but it clears fake sources from reports — payment gateways or spam domains, for example.

Segments in Explore

For past periods and doubtful cases, use segments in Explore. For example, an “engaged sessions” segment, or an exclusion segment “city = suspicious AND engagement time < 1 second”. A segment deletes nothing: you simply view the report without the junk and see how your conclusions change.

A good habit is to keep two saved explorations: “everything as is” and “without obvious bots”. If your verdict on a campaign changes when you switch from one to the other, the decision was being made on noise.

Comparisons in standard reports

Standard reports have an Add comparison button: you can put, say, “Country = target” next to “Country ≠ target”, or different channels side by side. It is a quick way to show colleagues that all the growth in sessions came from a single non-target slice.

Filtering before the tag

GA4 has no “bot by behavior” filter and no access to IP addresses in reports, so the most effective approach is not to let the bot reach the analytics tag at all. You can do this with a trigger condition in Google Tag Manager (for example, not sending data from certain hostnames) or by filtering traffic on the site side. The general approach to weeding out bots before they hit the page is described in how to filter bots, and a comparison of two approaches — checking the browser or a list of addresses — in JS check or IP blocking.

Why GA4 numbers differ from your ad account and tracker

This is the main source of distrust in analytics, and most of the time the gap can be explained. The three systems simply count different things.

Hence the typical reasons for the gap:

• The click never became a session. The person clicked and closed the tab, a slow page did not finish loading, a browser ad blocker blocked the tag.
• Cookie consent. If the visitor declined, GA4 either gets no data or gets anonymized signals and models part of the picture.
• Bots. Robots that do not run JavaScript are seen by the ad account and the server-side tracker, but not by GA4. Robots with a browser, on the other hand, can get into GA4 even though the ad account marked their clicks as invalid and did not charge for them.
• Attribution. GA4 distributes conversions across channels using its own model, while the ad account credits conversions to itself by its own rules. The same sale can land in different campaigns.
• Time zones and dates. If the ad account and the GA4 property are in different time zones, daily numbers will never match.
• Thresholds and modeling. GA4 may hide rows at low volumes and fill in data with models — this changes report numbers.

So it pays to watch not the absolute gap but its trend. If the ad account shows 1,000 clicks and GA4 shows 850 sessions, month after month, that is normal for your traffic. If the gap suddenly grows to half, and a new city with zero engagement appears in the reports, that is bot traffic, and it costs money. How to turn this into a dollar figure is covered in how much budget is lost to bots.

The limits of GA4 against bots

GA4 is a tool for analyzing human behavior, not an anti-fraud system. It has limits no setting will get around:

• No IP or network in reports. You cannot see that a visit came from a data center or through a proxy.
• No per-visit verdict. There are only aggregates; you cannot open a specific session and see why it is suspicious.
• Filters are irreversible and not retroactive. A mistake in a filter wipes out real data for good.
• Bots without JavaScript are invisible. And you may already have paid for their clicks.

That is why media buyers complement analytics with a system that checks every visit before the page. ArtisanClo filters out bots, data center traffic, VPNs and proxies, and shows a reason code for every click in its log — why the visit was let through or filtered out. Its built-in tracker counts spend, conversions, profit and ROI per campaign, so you see how much money went on junk traffic, not just how many sessions it added to your reports. More on the features page.

What to do once you have found bots in GA4

1. Find the slice. Campaign, source, city, screen resolution — where the junk is concentrated.
2. Cross-check with the ad account. See which of these clicks the platform marked as invalid and whether it refunded the money.
3. Turn on a “without obvious bots” segment and revisit your conclusions for the past period.
4. Filter what is known — internal traffic, monitoring tools, stable addresses.
5. Stop sending junk conversions to ad accounts so the algorithm does not go looking for more of the same. How to set up tracking so that only real events reach the report is covered in conversion tracking.
6. Cut bots off before the page if their share is noticeable and growing.

Summary

GA4 automatically excludes known robots, but not those that run JavaScript and pretend to be people. They are given away by combinations of signs: Direct and Unassigned spikes, zero engagement, one-second engagement time, unexpected cities, identical devices. With built-in tools you can filter internal traffic and known addresses; for the rest, use segments and comparisons, remembering that filters are irreversible. A gap between GA4, your ad account and your tracker is normal as long as it is stable; a sharp jump in the gap is a reason to look for bots and work out what they cost you.