GA4 already removes traffic from known bots and spiders, automatically, and you can't switch that off or see how much it removed. What it can't remove is automation it doesn't know about: bots built to look like ordinary visitors. Those are the ones that click ads and fill in forms, and in your reports they look like users. Here is how to spot them, what GA4's own tools can and can't do about them, and what matters most if you advertise.
What GA4 already filters out
Google identifies known bots and spiders with its own research and the International Spiders and Bots List maintained by the IAB, and excludes their traffic from every GA4 property. There is no setting for it: you can't disable the exclusion, and GA4 doesn't report how much traffic it excluded.
A list of known bots catches automation that announces itself or has already been catalogued, such as search engine crawlers and monitoring services. Automation designed to pass as a real browser isn't on it, so it reaches your reports with the same dimensions a visitor has.
Why engagement rate doesn't prove a visitor is human
GA4 counts a session as engaged when it lasts longer than 10 seconds, has a key event, or has two or more page views. Bounce rate is the share of sessions that weren't engaged.
Each of those is easy for automation to meet. A bot that waits a few seconds, loads a second page or submits your form produces an engaged session, and if the form submission is a key event, it produces a conversion too. A good engagement rate tells you the sessions did something. It doesn't tell you who did it.
Signs to look for in your reports
None of these proves a bot on its own. Together, and especially when they start on the same day, they are worth a closer look. An exploration that breaks sessions down by these dimensions makes them easy to compare.
- A spike from one source, campaign or landing page with no matching rise in sales or qualified leads.
- Traffic from places you don't sell to, or concentrated in a few cities that host data centers rather than customers.
- Many new users with an identical setup: the same browser version, screen size and device, arriving within minutes of each other.
- Key events that lead nowhere: leads with fake details, phone numbers that never answer, carts that never become orders.
- Sessions that are either instant or oddly uniform: near-zero engagement time, or the same few seconds on every visit.
What GA4's own tools can do
| Tool | What it does | Limit |
|---|---|---|
| Known bot exclusion | Removes traffic from known bots and spiders | Always on; known bots only; no report of what it removed |
| Internal traffic data filter | Excludes events from IP addresses or ranges you define | Websites only, not app users; up to 10 data filters per property |
| Web hostname data filter | Excludes event data that arrives from domains you choose | Covers data from other domains, not bots on your own site |
| Report filters and comparisons | Hide or isolate traffic in a report | Changes what you see, not what was collected |
Data filters apply from the moment you create them and don't touch historical data, and their effect is permanent: excluded events are never processed and can't be brought back. An IP filter also only works on the addresses you list, and automated traffic rarely keeps the same address for long. To study suspected bots in data you already have, use report filters and comparisons instead.
Sources: Analytics Help, Known bot-traffic exclusion, [GA4] Engagement rate and bounce rate, Data filters and Filter out internal traffic.
Where it matters most: what you send to your ad platforms
A bot in your reports skews a chart. A bot conversion that reaches Google Ads or Meta changes what you buy next. If GA4 key events are imported into Google Ads as conversions, or your forms and checkouts report to your ad platforms directly, every bot that converts tells their bidding to find more traffic like it. Filtering the report afterwards doesn't undo that.
Fix it upstream
Cleaning reports is worth doing, but the bigger win is keeping bot conversions out of what your ad platforms learn from. Our guide to fake leads from Google Ads covers the form side, and bot checkouts on Shopify the store side.
Where AdProtektor fits
- It checks every visit. AdProtektor scores each visit to your site and sorts traffic into real visitors, crawlers, bots, competitors and click farms, with the evidence behind each verdict in the dashboard.
- It blocks repeat sources. Visitors who cross your threat threshold are blocked, and the strongest sources go on your Google Ads IP exclusion lists.
- It keeps blocked visitors out of the learning. With ConversionOS and fraud protection on, a conversion from a visitor AdProtektor has blocked is withheld instead of being sent to GA4, Google Ads or Meta.
Withholding covers the conversions ConversionOS sends. Events your own GA4 tag records directly are outside it, so if you also count key events from the tag, compare them with the visitors AdProtektor flagged.
GA4 tells you a session was engaged. It can't tell you a person was.
To see which of your visitors are bots, start a free trial and add the script to your site.