GA4 Spam Traffic: How Hostname Filters Keep Client Reports Clean

A client's sessions jump overnight, the conversion rate falls by half, and the new visits come from referrers nobody on the team has heard of. That is GA4 spam traffic, and it does more damage to a client relationship than a real dip, because the report is now wrong and your agency is the one who sent it.

Google Analytics added hostname Include filters on September 21, 2026. They let you list the domains allowed to send data to a property and drop events from everywhere else. This guide explains how to spot fake sessions, how the filter works according to Google's own documentation, how to test it before it touches real data, and how to explain the change in the client's organic traffic reports for clients so nobody mistakes cleaner numbers for a drop in performance.

What does GA4 spam traffic look like in a client report?

GA4 spam traffic usually shows up as sessions that come from unfamiliar referrers or hostnames, barely engage, and never convert. It rarely announces itself, so the first sign is often a number that moves without a reason. Work through these checks when a client's traffic looks off:

1. Hostnames that are not the client's site. In an exploration, break sessions down by hostname. The hostname is the domain the event was recorded on, so real visits should only show the client's own domains.
2. Referrers nobody recognises. Spam domains often look like a sales pitch or an SEO offer rather than a real website that would link to the client.
3. Engagement close to zero. A source whose engagement rate sits far below the rest of the site, with almost no time on page, is rarely made of people.
4. A spike with no cause. No campaign, no email, no ranking change and no press mention, yet sessions doubled.
5. Conversion rate falling while conversions hold steady. This is the clearest sign that fake sessions are inflating the denominator.

That last point is why spam matters more than it seems. Conversion rate is conversions divided by sessions, so every fake session makes real marketing look less effective. A client who sees a falling rate may question the campaign, the landing page or the agency, when the only thing that changed was the noise in the data. Clean data protects the conversion story that most branded client reporting dashboards are built around.

Keep the two kinds of spam apart when you talk to clients. A Google Search spam update changes rankings and therefore real organic visits. Analytics spam is fake data that never involved a real searcher. One needs an SEO response, the other needs a data filter, and mixing them up in a client call causes confusion.

What do the new hostname filters do?

A hostname Include filter tells Google Analytics to process events only from the domains you list and to drop events from every other hostname. Google's What's new in Google Analytics entry for September 21, 2026 describes it as an allowlist of approved domains, and notes that filtering was previously limited to Exclude filters that needed ongoing manual updates to keep up with new spam sources.

Two details in that release note matter for setup. Include filters automatically block events that arrive with an empty hostname, which Google says usually indicates spam or abnormal traffic. And hostname Include filters are not applied to events sent through the Measurement Protocol, so that data stays unblocked. If a client's spam arrives that way, an allowlist alone will not stop it.

Google's data filters help article adds the rules that make this a one-way door. Filters are evaluated from the point of creation forward and do not touch historical data. Once a filter is applied, the excluded events are never processed and never appear in Google Analytics or BigQuery. When several filters are active, all Include filters are combined and applied first, followed by any Exclude filters.

How do you set up a hostname allowlist safely?

Build the list from the hostnames real traffic already uses, run the filter in Testing, and activate it only once the test shows nothing legitimate would be dropped. Creating a data filter needs the Editor role or above on the property, so agree with the client who owns this change before you start.

1. Inventory the real hostnames. Pull sessions by hostname for the last few months. Mark the client's main domain, www and non-www versions, subdomains such as a shop or blog, country sites, and any third-party domain where the client's tag runs, such as a booking or checkout page.
2. Ask about domains you cannot see yet. A landing page builder, a new microsite or a seasonal campaign domain may not have traffic today but will need to be on the list when it launches.
3. Create the filter. In Admin, under Data collection and modification, open Data filters, select Create filter and choose the web hostname template. Names must be unique, start with a letter and stay within 40 characters. Pick Exactly matches for precise rules or Contains for broader ones.
4. Set the state to Testing. In Testing, Google Analytics labels matching events with the Test data filter name dimension instead of changing your data.
5. Validate after 24 to 36 hours. In Explore, build a free form exploration with Test data filter name and Event name as rows, Event count as the value, and a filter on your filter's name. Review the hostnames it catches and fix the rules if any real domain appears.
6. Activate. Open the filter, set the state to Active and save. Google says it begins filtering within 24 to 36 hours.

One common worry is that an allowlist might block visits from ChatGPT, Gemini or social platforms. It should not, because the hostname is the site where the event happened, not the site the visitor came from. A visit referred by chatgpt.com still records the client's own domain as its hostname, so it passes the filter and still counts toward the AI assistant traffic you report next to AI search visibility tracking.

How do you annotate the report and explain it to the client?

Mark the activation date in the report, explain that numbers after it exclude spam, and compare only periods that were measured the same way. Because the filter is forward only, the months before activation still contain the fake sessions, and a straight month-on-month comparison will show a drop that is really a cleanup.

Write the note before the first filtered report goes out, not after the client asks. A short message works well: "On [date] we added a filter that stops fake visits from spam domains being counted. Sessions may look lower from that date, but conversions are unchanged, so your conversion rate now reflects real visitors. Earlier months still include the spam, so we will compare like for like going forward." Then repeat a one-line note on the traffic page of the next few scheduled PDF client reports until the comparison window is clean.

After that, make hostnames part of the monthly check. Review sessions by hostname once a month, add new client domains to the filter before they launch, and keep an eye on Measurement Protocol traffic, since the allowlist does not cover it. Spam is the kind of problem that tends to return in a new form, and a quick routine check catches it before a client does.

Because a data filter works at collection, every tool that reads the property sees the cleaned numbers from the activation date onward. In AgencyReportr, the SEO report pulls GA4 traffic and engagement (channels, landing pages, referrals, conversions and events) straight from the client's property, so it reflects the filter automatically. Each report opens with an AI-written summary of the period, carries your agency's logo and colors, and is emailed on a weekly or monthly schedule. You can see the full set of report sections before connecting a client.

GA4 Spam Traffic FAQ

How do I stop GA4 spam traffic?

Create a hostname Include data filter that lists only your client's real domains, run it in Testing state, validate it with the Test data filter name dimension, then set it to Active. GA4 has supported Include filters for hostnames since September 21, 2026.

Does a hostname filter remove spam from past data?

No. Google says data filters are evaluated from the point of creation forward and do not affect historical data. To hide spam hostnames in earlier periods, use report filters, which do not change the underlying data.

What is the difference between an Include and an Exclude hostname filter?

An Include filter is an allowlist: only the hostnames you list are processed. An Exclude filter is a blocklist: the hostnames you list are dropped and everything else is kept, so it needs updating whenever a new spam domain appears.

Will a hostname Include filter block Measurement Protocol events?

No. Google says hostname Include filters are not applied to events sent from the Measurement Protocol, so that data stays unblocked.

How long does a GA4 data filter take to work?

Google advises waiting 24 to 36 hours after setting a filter to Testing before you validate it, and says an Active filter begins to filter data within 24 to 36 hours.