How to protect your reports from spam and bots
Spam and bot traffic can significantly distort your analytics data, making it difficult to trust the insights you rely on for decision-making.
One common issue GA4 users encounter is sudden spikes in traffic that don't reflect real user activity. For example, last autumn, many websites experienced an unexpected increase in sessions originating from China and Singapore. These visitors weren't genuine users - they were automated bots. The issue affected a large number of Google Analytics 4 properties.
The example below shows one of our clients who experienced this problem.
One common issue GA4 users encounter is sudden spikes in traffic that don't reflect real user activity. For example, last autumn, many websites experienced an unexpected increase in sessions originating from China and Singapore. These visitors weren't genuine users - they were automated bots. The issue affected a large number of Google Analytics 4 properties.
The example below shows one of our clients who experienced this problem.
Why GA4 Doesn't Always Catch Bots
Google Analytics 4 includes built-in bot filtering based on the IAB/ABC International Spiders & Bots List, and this feature is enabled by default. While it successfully filters many well-known crawlers, it isn't designed to detect every type of malicious or low-quality traffic.
In the case described above, GA4's default filtering wasn't sufficient. The platform also offers data filters, but they are relatively limited and don't provide an effective way to block this type of bot traffic before it reaches your reports.
Fortunately, there are several practical approaches you can use to reduce or eliminate spam traffic before it affects your analytics.
1. Use Stape Bot Detection
If you're using Stape for server-side tagging, you can enable the Bot Detection power-up.
The feature assigns every incoming request a score from 0 to 100, indicating the likelihood that the request originated from a bot.
Google Analytics 4 includes built-in bot filtering based on the IAB/ABC International Spiders & Bots List, and this feature is enabled by default. While it successfully filters many well-known crawlers, it isn't designed to detect every type of malicious or low-quality traffic.
In the case described above, GA4's default filtering wasn't sufficient. The platform also offers data filters, but they are relatively limited and don't provide an effective way to block this type of bot traffic before it reaches your reports.
Fortunately, there are several practical approaches you can use to reduce or eliminate spam traffic before it affects your analytics.
1. Use Stape Bot Detection
If you're using Stape for server-side tagging, you can enable the Bot Detection power-up.
The feature assigns every incoming request a score from 0 to 100, indicating the likelihood that the request originated from a bot.
- 50–75 indicates suspicious traffic that may be automated.
- Above 75 is considered highly likely to be bot traffic and can be blocked automatically if blocking is enabled.
- Add the bot score to a request header so you can analyze traffic in GA4.
- Automatically block requests with a score higher than 75.
Rather than enabling blocking immediately, it's best to start by sending the bot score as a request header. This allows you to collect data, understand how the scoring behaves for your website, and determine the most appropriate threshold before blocking requests.
To do this, create a Request Header parameter in your server-side GTM container
To do this, create a Request Header parameter in your server-side GTM container
and send the value to Google Analytics 4
Next, register the parameter as a Custom Dimension in GA4 and allow enough time for data to accumulate.
Once you've collected sufficient data, you'll be able to identify a threshold that separates legitimate users from bot traffic with confidence.
2. Use Cloudflare Bot Protection
If your website is protected by Cloudflare and the spam originates primarily from specific countries—as in our example with China and Singapore—you can create firewall rules that apply Bot Checks only to traffic coming from those locations.
This approach works well if you don't expect legitimate visitors from the affected countries.
Cloudflare also offers several additional bot protection features, including:
3. Block Spam at the GTM Trigger Level
If you've identified specific characteristics shared by spam traffic, you can prevent those requests from being tracked in your web GTM container.
For example, you can exclude events based on:
For existing data, you can apply report filters using available dimensions such as Country.
2. Use Cloudflare Bot Protection
If your website is protected by Cloudflare and the spam originates primarily from specific countries—as in our example with China and Singapore—you can create firewall rules that apply Bot Checks only to traffic coming from those locations.
This approach works well if you don't expect legitimate visitors from the affected countries.
Cloudflare also offers several additional bot protection features, including:
- Known Bots — blocks traffic from Cloudflare's database of known bots.
- Verified Bot Categories — allows you to block or allow verified bots based on their category.
3. Block Spam at the GTM Trigger Level
If you've identified specific characteristics shared by spam traffic, you can prevent those requests from being tracked in your web GTM container.
For example, you can exclude events based on:
- Referrer URL
- Screen resolution (for example, 0×0)
- Other request parameters that reliably identify spam traffic
For existing data, you can apply report filters using available dimensions such as Country.
If you export your data to BigQuery, you have even greater flexibility and can remove unwanted traffic directly in your SQL queries.
4. Track Leads Server-Side
If your primary goal is measuring lead generation, consider sending lead events directly from your CRM instead of relying solely on client-side tracking.
Because the data originates from your backend, you can validate and filter incoming requests before sending them to GA4, ensuring that only genuine leads are included in your reports.
4. Track Leads Server-Side
If your primary goal is measuring lead generation, consider sending lead events directly from your CRM instead of relying solely on client-side tracking.
Because the data originates from your backend, you can validate and filter incoming requests before sending them to GA4, ensuring that only genuine leads are included in your reports.
