Bot traffic in analytics: how to spot it and filter it
How GA4 and other tools filter bots, the patterns that give bots away in your reports, and what you can do about the bots that get through.
On this page
A share of every site's traffic is software: search crawlers, uptime monitors, link previews, price scrapers, AI agents and click fraud. Analytics tools try to keep it out, each with its own rules, so the same site shows different numbers in each tool. That is one of the reasons analytics numbers never match.
This guide explains how filtering works, how to find the bot traffic that got through, and what you can do about it.
Kinds of bots, by how easy they are to catch
| Kind | Examples | How it identifies itself |
|---|---|---|
| Declared crawlers | Googlebot, Bingbot, AI crawlers | Names itself in the user agent |
| Link previews | Chat apps and social sites fetching a card | Usually names itself |
| Monitors and audits | Uptime checks, Lighthouse, SEO crawlers | Usually names itself |
| Headless browsers | Scrapers, test scripts | Often hides, but may report automation |
| Disguised bots | Click fraud, spam, some scrapers | Pretends to be a normal browser |
The first three are easy. Many of them never run JavaScript, so a script-based tool never sees them at all. The last two are the problem.
How tools filter bots
GA4 excludes known bots and spiders automatically, using Google's own research and the IAB/ABC International Spiders and Bots List. You cannot turn it off, and you cannot see how much it removed (Google, IAB). GA4 has no setting for your own bot rules beyond internal and developer traffic filters.
CDNs such as Cloudflare keep a list of verified bots: bots that say who they are in a way that can be checked, such as a published IP list or a cryptographic signature (Cloudflare). Some plans also give each request a bot score from 1 to 99, where 1 means almost certainly automated (Cloudflare).
Script timing catches more. A tool that waits until the page has been visible for a moment before counting misses bots that load a page and leave, and tabs that open in the background and close unseen.
No method catches everything. A bot that runs a real browser from a home network, waits, and scrolls looks like a person to every tool.
The signs of bots in your reports
Look for traffic that no group of real people would make:
- A spike from one city or one network with no campaign behind it.
- One page, zero seconds. Hundreds of visits to one page, with a bounce rate near 100% and no time on the page.
- A flat line through the night. People sleep; schedulers do not.
- Odd screen sizes or old browsers in large numbers, such as one exact resolution, or a browser version years out of date.
- Visits from cloud networks such as AWS, Google Cloud or DigitalOcean. Real people do browse through VPNs hosted there, so this is a clue, not proof.
- Referrers you never heard of, especially ones promoting SEO services. That is referral spam.
- Form spam or fake signups in the same hours as a traffic spike.
Ghost spam is mostly gone
In older Universal Analytics properties, spammers sent fake hits straight to Google with your tracking id, without visiting your site. GA4's Measurement Protocol requires an API secret that only your property has (Google), which ended most of that. Spam that shows up today usually came through your real pages.
A worked example
Example numbers, made up for illustration. A shop's visits jump from about 900 a day to 2,600 on a Tuesday. Steps to find the cause:
- Break down by page. 1,650 of the extra visits land on
/products/brass-lamp. No campaign links there. - Break down by country and city. All of them come from one city where the shop has never sold.
- Look at engagement. Bounce rate 99%, and no time on the page.
- Check the hour. The visits arrive at an even rate from 01:00 to 05:00 local time.
That is a scraper checking a product page, probably a price monitor. The fix is at the server or CDN, not in analytics: block or challenge that traffic. For reports, compare the week with that city excluded, and note the spike in the client report so nobody reads it as demand.
What you can do
- Block at the edge. Your CDN or host sees every request, not just the ones that run your script. Bot rules there stop scrapers from costing you bandwidth too.
- Exclude in reports, not in raw data. Keep the raw numbers and build a comparison or segment that leaves out the bad city, network or referrer. You can undo a segment; you cannot undo deleted data.
- Protect forms. A challenge such as Cloudflare Turnstile or reCAPTCHA stops fake signups that would otherwise count as conversions.
- Watch your ad clicks. Google filters invalid clicks, including automated traffic, and does not charge for them (Google). If ad clicks spike without visits or sales, ask the platform for a review.
- Judge by outcomes. Bots rarely buy. A source with visits and no sales, ever, deserves a closer look.
How Sporetag filters bots
Sporetag's rules are in its code and its help article on bot filtering:
- Never recorded: a user agent that names a crawler, a link preview, a monitor, a headless browser or an HTTP library; an empty user agent or a bare
Mozilla/5.0; and bots that Cloudflare has verified. - Never sent: the script does not run in browsers that report
navigator.webdriver, which most automation tools set. - Counted only when seen: a pageview goes out after the tab has been visible for 1.5 seconds, or half a second if the visitor leaves sooner.
- Marked and left out of the numbers: a user agent that names no browser and no operating system, and a low Cloudflare bot score when Cloudflare provides one.
- Marked and still counted: visits from cloud and hosting networks, because people on VPNs browse from them too.
Short links follow the same user agent rules. A browser prefetching a link, or a HEAD request checking it, is not counted as a click.
Common questions
How do I know if my website traffic is bots?
Look for patterns people do not make: a spike on one page from one city, near 100% bounce with no time on the page, an even rate through the night, or many visits from cloud networks. Bots rarely buy, so a source with traffic and no sales is a clue.
Does GA4 filter bot traffic?
Yes, known bots and spiders are excluded automatically, using Google's research and the IAB/ABC list. You cannot turn it off or see how much was removed, and it does not catch bots that pass as normal browsers.
Why does one tool show more visitors than another?
Each tool filters bots with its own rules, and script-based tools miss bots that do not run JavaScript. A tool that counts server requests sees far more bots than one that counts pageviews from a script.
Can I remove bot traffic from past reports?
Most tools do not delete it, but you can exclude it in a segment or comparison. Filter by the city, network, page or referrer that gives the bots away.
Is referral spam harmful?
It does not harm your site, but it pollutes reports and invites you to visit the spammer's site. Do not visit it. Exclude it in your reports.
Sources
- Google Analytics Help: Known bot-traffic exclusion. Google for Developers: Measurement Protocol reference. Checked October 2026.
- IAB: IAB/ABC International Spiders and Bots List. Checked October 2026.
- Cloudflare: Verified bots, Bot scores. Checked October 2026.
- Google Ads Help: Invalid clicks. Checked October 2026.
Spotted something wrong or out of date? Email hello@sporetag.com and we will fix it.