Sort traffic acquisition
Reports → Acquisition → Traffic acquisition. Sort by sessions and flag referrals from domains you don't recognise.
Google Analytics & Bot Traffic
What your Google Analytics doesn't tell you about bot traffic
GA4 filters the bots it already knows about — and quietly counts the rest as real visitors. Here's what slips through, how to spot it, and how to see your true number.
Start Free Trial
No credit card requiredAt a glance
Does Google Analytics catch bot traffic?
Only partly. GA4 automatically excludes traffic from known bots and spiders on the IAB/ABC International Spiders and Bots List. It does not catch sophisticated invalid traffic that mimics human behaviour, rotates IPs or runs through residential proxies — so the bot share you see in GA4 is an under-count.
For context on how big the gap can be: across 2 billion clicks in the Opticks Ad Fraud Report 2025, invalid traffic ranged from 2.18% on search to 15.9% on native ads, and the large majority of detected bot activity was bad-bot traffic with no genuine intent.
The gap
What GA4 catches — and what it misses
Google Analytics was built to measure human behaviour, not to police fraud. Its bot filtering is a single on/off setting that matches a known list. Anything not on that list, and anything designed to look human, sails straight through.
What GA4 catches
- Known crawlers and spiders on the IAB/ABC list
- Obvious data-centre crawlers that self-identify
- Some basic spam once you build manual filters
What GA4 misses
- Bots that mimic real mouse movement and scrolling
- Residential-proxy and rotating-IP traffic
- Ghost traffic injected via the Measurement Protocol
- Click farms and human-driven fraud
- Invalid clicks on your paid campaigns before they hit the site
Ghost traffic, referral spam & fake sessions
Ghost traffic is fake traffic that never actually visits your site. It's sent straight to Google Analytics through the Measurement Protocol using spoofed tracking IDs, inflating your sessions and referral reports without a single real pageview. Because the hit never touches your server, server-side filters can't see it.
Referral spam is the broader family: junk referrals from domains you've never heard of, designed to get you to visit them. Self-referrals, where your own domain shows up as a traffic source, usually point to a tracking misconfiguration rather than fraud — but they distort the same reports.
The common thread: all three inflate the numbers you use to make decisions, and GA4's default filtering catches almost none of it.
Step by step
How to identify bot traffic in Google Analytics
You can't get an exact figure inside GA4, but these five checks surface the patterns that betray bots, ghost traffic and referral spam.
Check engagement time
Add Average engagement time. High-volume sources with near-zero engagement are almost always automated.
Segment by city & network
Traffic concentrated in one city or a single data-centre ISP is rarely a room full of real customers.
Inspect direct spikes
Sudden jumps in Direct / (none) with no campaign behind them are a classic ghost-traffic signature.
Compare conversions
A source sending hundreds of sessions and zero conversions is invalid traffic, not an audience.
Remember GA4's bot filtering is automatic
GA4 excludes known bots automatically — it's always on and can't be switched off. It only catches bots on the IAB/ABC list, so treat it as a floor, not the answer.
Why it matters
"Good enough" analytics costs real money
When bot traffic is counted as real, every metric downstream is wrong: inflated sessions, distorted bounce and conversion rates, and a cost-per-acquisition that looks better than it is. On paid channels the damage is direct — budget is spent on clicks that can never convert.
How much depends on where your traffic comes from. These are the benchmark invalid-traffic rates by channel from the Ad Fraud Report 2025:
| Channel | Invalid traffic rate |
|---|---|
| Native advertising | 15.9% |
| Programmatic / display | 15.43% |
| Social | 10.61% |
| Affiliate | 9.09% |
| SEM / Search | 2.18% |
GA4 will never show you these by channel, because it can't tell a clean click from an invalid one once the visit is recorded. A detection tag can — it validates each visit in real time against device, network and behavioural signals GA4 never collects.
See what GA4 is hiding
Start with a free benchmark in the bot traffic checker, then deploy a detection tag to measure your real invalid-traffic rate by channel. Setup takes 5 minutes.
Start Free Trial
No credit card required