Dealing With Spam and Bot Traffic in Google Analytics

Enable Built-in Bot Filtering

Google Analytics automatically excludes known bots and spiders in GA4 properties, with no option to disable it. For Universal Analytics (UA) views, manually enable "Exclude all hits from known bots and spiders" in Admin > View Settings.

Distinguish UA vs. GA4 Approaches

Universal Analytics (legacy):

• Use Referral Exclusion List in Admin > Property > Tracking Info to block spam domains like urlumbrella.com, preventing them from appearing as referrals (traffic may shift to "Direct").
• Create custom filters in Admin > View > Filters to exclude by IP, hostname, city, ISP, or user agent; test on a non-primary view first.
• Set up custom alerts for spikes in direct/referral traffic.

Google Analytics 4 (GA4, recommended):

• GA4 auto-filters known bots, reducing spam compared to UA.
• Add spam domains to Unwanted Referrals list in Admin (though GA4 lacks direct referral filtering, shifting to Direct).
• Apply temporary exclude filters or segments in reports, Explorations, or Comparisons (e.g., exclude high bounce rates, suspicious regions, or event spam); cannot save standard filters permanently.
• Filter by IP addresses (limited due to privacy; mainly for internal traffic) via Admin > Data Streams > Configure tag settings > Define internal traffic.

Block Bots at Source (Server-Side)

• Edit .htaccess (Apache) or nginx config to deny IPs, IP ranges, user agents, or referrers (e.g., Deny from 234.45.12.33; customize from server logs).
• Update robots.txt to block bad bots (e.g., User-agent: BadBot Disallow: /).
• Use tools like Google Tag Manager (GTM): Set traffic_type parameter to flag bots, prevent tag firing, or block via IP/headers.
• Third-party options: Stape Bot Detection (adds headers to filter in sGTM), Cloudflare (threat scores, IP blocks), or DataDome for dashboards/alerts.

Detect and Monitor Spam

• Check for anomalies: Sudden spikes in direct/referral traffic, high bounce rates, impossible geographies, or event spam (e.g., via server logs or anti-spam plugins).
• Add annotations to charts noting spikes.
• Implement data quality reviews: Monitor reports regularly, segment suspicious traffic (e.g., low engagement).
• Good bots (e.g., Googlebot) should also be filtered from analytics to avoid skewing data.

These steps minimize spam impact without altering historical data; enable prospectively and verify via test views. For advanced setups like GTM or Cloudflare, consult server logs for specific bot signatures.