How to Detect Bot Traffic in GA4 (Before It Wrecks Your Report)
Bot traffic is the most common data quality problem in GA4. Here is how to identify the patterns, exclude the noise, and prevent fake sessions from distorting your metrics.
Updated 6 min read
You are reviewing a client's monthly numbers and sessions are up 40%. Great news, except the engagement rate dropped to 12%, the average session duration is 2 seconds, and 80% of the new traffic comes from a single city you have never seen in the data before. That is not growth. That is bots.
Bot traffic is the most common data quality problem in analytics, and GA4's built-in bot filtering does not catch all of it. Google filters known bots from the IAB bot list, but that list covers crawlers that identify themselves. The bots that inflate your numbers pretend to be real visitors: click farms, scraper networks, and referral spam.
What bot traffic looks like in GA4
Bot traffic does not always look like a dramatic spike. Sometimes it is a slow drip that inflates sessions by 5 to 10 percent every month, barely noticeable until you compare six months of data.
The spike with no engagement. A sudden increase in sessions where the new sessions have near-zero engagement. In GA4, an engaged session lasted more than 10 seconds, had a key event, or viewed more than one page. If your ratio of engaged sessions to total sessions drops sharply during a traffic spike, you are looking at non-human traffic.
The geographic anomaly. A US-focused B2B site suddenly gets thousands of sessions from a city in Southeast Asia or a data center location. Pull the geographic report by city, not just country. Bot traffic often originates from cities where hosting providers or proxy services are concentrated. Legitimate surges (viral posts, conferences) come with engagement. The bot version has high sessions, low engagement, and no source/medium that explains it.
Referral spam. Sessions with a source/medium of a domain you do not recognize, zero engagement, and often a landing page that does not exist. GA4 is less susceptible than Universal Analytics was, but it still happens, especially if your measurement ID has been scraped from your site's source code.
The event flood. A sudden spike in a custom event count with no corresponding increase in sessions. If your scroll event count quadruples overnight but pageviews are flat, something is firing events programmatically. Check the DebugView event parameter values — real scroll events follow a natural distribution while bot-generated events often have uniform or impossible values.
Where GA4's built-in filtering falls short
GA4 automatically excludes traffic from known bots on the IAB/ABC International Spiders and Bots List — about 1,400 identified bots. What it does not catch: bots using headless Chrome with a standard user agent (indistinguishable from real visitors at the network level), click farms (actual humans clicking on instruction), internal traffic from remote teams whose home IPs are not in your filter, and automated testing tools like Selenium or Playwright running against production.
How to identify and exclude bot traffic
Bot Detection Workflow
Build a bot detection segment
In GA4 Explore, create a segment with: session duration under 1 second, engaged sessions equals 0, and event count equals 1 (only the session_start event). Apply this segment and check volume. If it exceeds 5% of total sessions, you have a measurable bot problem. Expand the geographic report to find source cities.
Check source/medium for anomalies
Pull a source/medium report for the last 90 days sorted by sessions. Look for sources you do not recognize, disproportionate growth in "(direct) / (none)" (bots without referrers show up as direct), and any source with engagement rate below 10% when similar sources are at 40% or higher.
Cross-reference with server logs
If you have access to server logs (Nginx, Apache, or Cloudflare), match bot traffic timestamps and IPs against the raw request log. Server logs show user agent strings that often reveal bots that disguise themselves in GA4. Cloudflare's bot analytics dashboard classifies traffic as verified bot, likely automated, likely human, or verified human.
Set up exclusion filters
If bots come from specific IP ranges or countries, block them at the CDN or firewall level to prevent hits from reaching GA4. For traffic you cannot block at the infrastructure level, create a segment in your reporting tool that removes sessions matching the bot pattern. Platform-level blocking is better because it prevents data contamination entirely.
Monitor for new patterns
Bot traffic is not static. Sources change, patterns evolve, and volumes fluctuate. A filter from January may not catch the bot traffic that starts in April. Build ongoing monitoring into your workflow.
What bot traffic does to your metrics
Even moderate bot traffic (5 to 10 percent of sessions) distorts your metrics in specific, predictable ways.
Engagement rate drops. Bot sessions have zero engagement. Adding 10% zero-engagement sessions to a pool with 60% real engagement brings the average down to about 54%.
Conversion rate drops. Sessions increase but conversions do not, so the rate declines mechanically. This is the most dangerous distortion because clients use conversion rate for spending decisions. A drop caused by session inflation might trigger budget cuts for campaigns that are working.
Geographic and attribution distortion. Bot-heavy regions gain disproportionate weight in geographic reports, and bots inflating direct or organic channels dilute those channels' conversion rates in attribution models.
The reporting decision: exclude or label?
When you have identified bot traffic, decide how to handle it in the client report. Exclude it for cleaner numbers that represent real behavior — but the client may see different numbers if they check GA4 directly. Label it with a note like "14,200 sessions (estimated 1,800 bot sessions excluded from engagement calculations)" for full transparency. Sophisticated clients who understand analytics data quality prefer the labeled approach. In either case, document your methodology so it is reproducible.
Ongoing Bot Monitoring Cadence
Monthly: check engagement rate trend for sustained declines that do not correlate with site changes
Weekly: scan the geographic report for new cities in the top 10 that were not there last week
On every traffic spike: check engagement metrics for the spike period before celebrating
Quarterly: re-scan source/medium for unfamiliar sources that have accumulated sessions
Prevention measures
You cannot prevent all bot traffic, but you can reduce it. Implement reCAPTCHA or similar challenges on forms to protect conversion data. Use CDN-level bot detection to block automated traffic before it reaches analytics. Keep your measurement ID out of public repositories — bots can scrape it and send fake hits. And use the Measurement Protocol API secret to authenticate server-side hits so unauthenticated endpoints cannot receive traffic from anyone who knows your measurement ID.
The goal is not to eliminate every bot session. It is to know how much bot traffic exists, exclude it from reported numbers, and prevent it from distorting decisions. For a broader look at detecting unusual patterns in your analytics, see our guide on anomaly detection in analytics.
Frequently Asked Questions
Does GA4 filter out bot traffic automatically?
GA4 filters known bots from the IAB/ABC International Spiders and Bots List, which covers about 1,400 identified crawlers. However, it does not catch bots that mimic real browsers (headless Chrome with standard user agents), click farms, internal traffic from remote teams, or automated testing tools hitting production.
How much bot traffic is normal?
Some bot traffic is unavoidable. If your bot detection segment (sub-1-second sessions with zero engagement) accounts for less than 5% of total sessions, it is within a typical range. Above 5% warrants investigation and active exclusion.
Can bot traffic affect my Google Ads performance?
Yes. If bot sessions inflate your total session count without contributing conversions, your conversion rate drops mechanically. If you use conversion rate to make bidding or budget decisions — or if Smart Bidding observes the inflated session volume — bots can indirectly cause budget cuts or campaign pauses for campaigns that are performing well.
Should I exclude or label bot traffic in client reports?
It depends on the client. Sophisticated clients who understand analytics prefer transparency — label bot sessions and show the adjusted numbers alongside the raw totals. Clients who want a clean headline number prefer exclusion. In either case, document your methodology so it is reproducible and auditable.
How can I tell if a traffic spike is bots or real growth?
Check the engagement metrics for the spike period. Real growth comes with engagement: longer session durations, multiple page views, conversions. Bot growth has high sessions with near-zero engagement, concentrated in a single geography or source, and no corresponding campaign or content change that explains it.