GA4 hostname filtering: check the host before excluding the event

GA4 can filter incoming web-hostname traffic. First establish which hosts your legitimate journeys need. A hostname filter can remove unwanted reporting context; it does not challenge website requests, authenticate a visitor or determine what Google Ads charged.

Use this guide when Analytics shows unfamiliar hostnames or a country spike persists after a website rule changes. For country cohorts, start with the China/Singapore investigation. For missing website observations, use the delivery and log-coverage diagnostic. Geography alone supplies no hostname to exclude.

1. Inventory the hosts before writing an allowlist

In a Free form exploration, add Hostname, Event name and Stream ID with Event count. Start with a completed review period and keep the unfiltered view. Inspect unusual hosts by event and stream, alongside missing or blank values. An incompatible field combination or unavailable value is a collection/reporting question, not a zero.

Google’s dimension and metric reference describes field compatibility and missing values. Record the property, scope, timezone and export time with your findings.

• Production: list the exact apex, www, shop and regional hosts that intentionally collect into this property.
• Other business domains: follow checkout, booking and customer-portal journeys. Confirm their actual hosts and the owner of each sender.
• Non-production: identify staging, previews and development. Decide whether their events belong in this property before excluding them.
• Other collection paths: review app streams and server/offline events separately. Do not presume every valid event has a browser page URL.

Compare the reported page context with one controlled browser trace, the relevant edge/origin records and the received business outcome. Cached responses and incomplete logs still matter. A website block and an Analytics event can describe different observation paths.

2. Match a hostname, not a familiar substring

The following strings demonstrate match behavior; they are not a suggested filter for your property. Replace them with your inventory. A broad substring can admit an unrelated hostname; a suffix without the domain separator can also match more than intended.

Use hostname strings without a scheme, path or query. Preserve actual missing values and test uppercase, internationalized and trailing-dot forms that occur in your data. This table demonstrates string boundaries; it does not establish undocumented normalization behavior in your property.

3. Keep the proposed filter in Testing

In Admin → Data collection and modification → Data filters, an Editor or above can create a Web hostname traffic filter. Choose Exclude or Include only, the intended host string and a supported match type: exactly matches, begins with, ends with or contains. This control does not offer a regular-expression match type.

Choose Testing. Google documents a 24–36 hour validation delay. In Explore, use Event count with Test data filter name and Event name; add Hostname explicitly to inspect the affected hosts. Check the named test against expected and unexpected journeys before considering Active. Activation can also take 24–36 hours.

Google: web-hostname filter setup and validation, reviewed 3 November 2026. If the option or required field is unavailable in your property, retain the report/export investigation instead of substituting another filter type.

Google: data-filter persistence and evaluation order. A reversible report view is the appropriate starting point for historical analysis.

Keep a before/after record for product browsing, accepted enquiries, checkout and booking, not just page views on the homepage. Include each legitimate sender and record missing context. Do not activate a filter while an important journey or server-event path remains unexplained.

4. Audit reported page hosts in an existing BigQuery export

If your property already exports to BigQuery, the SELECT-only query below inventories daily web event rows by date, stream, event and reported page host. It keeps missing, duplicate, non-string, empty and unparseable page-location observations in separate statuses. It does not choose a host from duplicate parameters and treat it as valid.

Replace YOUR_PROJECT.YOUR_DATASET and both date literals with a short completed period in your existing daily export. Review the dry-run estimate and set a maximum bytes billed limit in your own authorized query workflow. No account is connected here and we have not executed this query against a GA4 property.

Download the GoogleSQL hostname audit.

-- GoogleSQL: read-only inventory of reported page-location hosts in daily GA4 exports.
-- Replace YOUR_PROJECT.YOUR_DATASET and BOTH date literals before running.
-- The example scans seven completed daily suffixes; it excludes intraday tables.
-- Review the dry-run byte estimate and set a maximum bytes billed limit first.
-- No account query was executed by AdProtektor. Validate against your own schema.
-- Counts are exported event rows, not sessions, people, ad clicks or fraud.
WITH extracted AS (
  SELECT
    event_date,
    stream_id,
    event_name,
    (
      SELECT AS STRUCT
        COUNT(*) AS occurrences,
        COUNTIF(param.value.string_value IS NOT NULL) AS string_values,
        MAX(param.value.string_value) AS url
      FROM UNNEST(event_params) AS param
      WHERE param.key = 'page_location'
    ) AS location
  FROM `YOUR_PROJECT.YOUR_DATASET.events_*`
  WHERE _TABLE_SUFFIX BETWEEN '20261001' AND '20261007'
    AND platform = 'WEB'
), parsed AS (
  SELECT
    *,
    CASE
      WHEN location.occurrences = 1
        AND location.string_values = 1
        AND REGEXP_CONTAINS(location.url, r'(?i)^https?://')
      THEN NET.HOST(location.url)
    END AS reported_host
  FROM extracted
), classified AS (
  SELECT
    *,
    CASE
      WHEN location.occurrences = 0 THEN 'missing_page_location'
      WHEN location.occurrences > 1 THEN 'duplicate_page_location'
      WHEN location.string_values = 0 THEN 'non_string_or_null_location'
      WHEN location.url = '' THEN 'empty_location'
      WHEN NOT REGEXP_CONTAINS(location.url, r'(?i)^https?://')
        THEN 'not_absolute_http_url'
      WHEN reported_host IS NULL THEN 'host_not_extracted'
      ELSE 'host_extracted'
    END AS location_status
  FROM parsed
)
SELECT
  event_date,
  stream_id,
  event_name,
  location_status,
  CASE WHEN location_status = 'host_extracted'
    THEN LOWER(reported_host) END AS reported_hostname,
  COUNT(*) AS exported_event_rows
FROM classified
GROUP BY event_date, stream_id, event_name, location_status, reported_hostname
ORDER BY event_date, stream_id, event_name, location_status, reported_hostname;

• Scope: the literal suffix range selects daily tables and excludes events_intraday_*. Do not combine both for the same date and call the sum a deduplicated total. Daily export tables can update for up to three days after the event date.
• Counting: one input event row contributes once to the grouped output. Repeated parameters stay inside a correlated subquery; they do not multiply the event rows. These are not sessions, people, ad clicks, paid leads or a fraud percentage.
• Parsing: only a single string beginning with HTTP(S) is passed to NET.HOST. The function parses on a best-effort basis and performs no normalization. The query lowercases extracted hosts for grouping; it does not canonicalize trailing dots or internationalized forms, validate the entire URL or test domain ownership.
• Limits: this audit extracts host context from page_location. It is not an implementation of GA4’s Hostname dimension or data-filter engine, and cannot reproduce their processing or missing-value behavior. No export means no historical export to query; events previously discarded by an active filter are absent.

Public schema and syntax references: GA4 BigQuery export, NET.HOST, constant table-suffix conditions and query cost controls. A LIMIT on output rows is not a substitute for controlling scanned data.

5. Inspect the destination without sending it anywhere

When the controlled journey crosses domains, paste its before-and-after URLs below to check tracking-parameter preservation. Use your observed destinations, not a reported hostname copied into an invented URL. The checker works locally and does not visit either address, authenticate the host, test a GA4 filter or prove an event arrived.

Follow the redirect-hop diagnostic if an identifier disappears. Repairing a redirect and permanently excluding incoming Analytics events are separate decisions.

6. Choose the next action from the finding

• Unexpected host, legitimate sender: repair the sender’s page context or property choice, then retest. Do not discard real orders to make an allowlist look clean.
• Unwanted host, understood source: review a narrowly scoped filter in Testing with both positive and negative journey checks.
• Expected host, suspicious activity: continue the event and outcome investigation. The host name alone cannot establish a person’s identity or intent.
• Requests require protection: inspect the website/ad-protection control boundaries. Analytics filters cannot stop a request or verify an applied ad exclusion.

Google allows page_location to be set explicitly. Therefore a plausible reported page URL is context to investigate, not authenticated proof that the event originated from that website. Check the actual sender and request evidence before accepting the hostname as a trust signal.

Google tag: page_location configuration. The trust conclusion follows from the field being configurable; it is not a claim that every unusual event uses the same delivery mechanism.

Download the hostname investigation and filter-review worksheet.

GA4 hostname investigation and filter review

Property / stream / owner:
Review dates / property timezone / export time:
Symptom and baseline event counts:
Existing active include-only / exclude filters:

HOST INVENTORY
Exact reported hostname | expected use | owner | journey verified | decision
Production / www / shop / checkout / booking / other linked domains:
Preview / staging / development domains:
Missing, empty, malformed or duplicate page_location observations:
App streams and server/offline events that need separate review:

COLLECTION CHECK
Controlled page URL / final destination / event name:
Browser tag / server sender / page_location override:
Edge request coverage / origin coverage / clock offsets / cache handling:
Received enquiry or order / qualified outcome (aggregate only):
Finding / alternatives still unresolved:

PROPOSED FILTER -- do not activate from an unreviewed template
Operation / exact hostname string / match type / unique filter name:
Expected matching hosts / expected non-matching hosts:
Legitimate checkout / booking / server-event tests:
State: Testing
Created at / validation after the documented processing delay:
Exploration: Hostname + Event name + Test data filter name; Event count
Unfiltered comparison retained / test-label results / unexpected hosts:
All active include-only filters reviewed as a union; excludes reviewed afterward:
Activation owner / success criterion / recovery plan / follow-up date:
If made inactive later, previously discarded data cannot be recovered by that change.

OPTIONAL BIGQUERY REVIEW
Project / dataset / exact daily suffix start and end / schema checked:
Dry-run byte estimate / maximum bytes billed / authorized operator:
Query version / export completeness / daily-table update timing:
Grouped event-row results / missing-value statuses / unresolved hosts:
This export audit is not a simulation of GA4's hostname filter.

Keep raw URLs, query parameters, personal information and credentials out of
shared notes. Hostname context is not authenticated origin or a fraud verdict.
No Analytics, security or advertising settings are changed by this worksheet.

Review the visits your site observes

AdProtektor supplies site-side visit signals and configured protection for traffic its integration observes. It cannot observe an Analytics event that never reaches its collection path. Keep recorded hosts, applied protection, qualified outcomes and native advertising billing as separate evidence.

Start the free traffic audit for observed site visits, or use the free tools and read-only scripts for the checkpoint you can investigate. For a different symptom, return to the traffic troubleshooting hub.