How to Detect and Filter Bot Traffic in GA4

Traffic is up. Engagement time is 2 seconds. New users from one mid-sized city you don't target are at 100%, and not one of those sessions converted. If that pattern looks familiar, you're not looking at a marketing win — you're looking at what bot traffic looks like after Google's automatic filter has already removed the easy part.

This guide covers all three layers most GA4 bot guides collapse into one: what GA4 filters on its own (and what that filter structurally misses), a repeatable exploration recipe for exposing the rest, and — the part that actually protects budget — how to convert each GA4 symptom into a blocking action in Google Ads and Meta. Because the uncomfortable truth is that GA4 can describe bot traffic in detail, but it cannot stop a single click.

What GA4 already filters — and what it structurally can't

GA4 automatically excludes known bot traffic. The filter combines Google's own research with the IAB/ABC International Spiders & Bots List, it runs on every property, and you don't manage it: there is no toggle to disable it, no settings to tune, and no report showing how much traffic it removed. It simply happens upstream of your reports.

That filter is real, and it's also narrow. It catches declared crawlers and known bots — the automated traffic polite enough to identify itself or notorious enough to be on an industry list. What it does not catch is the traffic that costs advertisers money: bots built to look human. Modern click fraud runs full browser environments that execute JavaScript, fire your GA4 tag, scroll, and move through pages; it routes through residential proxies so the IP belongs to a real household rather than a data center. None of that matches an IAB list entry. Imperva's bad-bot research now puts automated traffic at 53% of all web traffic — and the sophisticated share of it is precisely the share a known-bots list can't see.

And there's a third category most guides never mention: the bot traffic GA4 never records at all. Plenty of click bots hit your ad and never execute the analytics tag on the landing page — no JavaScript, no session, no trace. In GA4 they are invisible; in your Google Ads invoice they are fully present. That's why a widening gap between paid clicks in Google Ads and paid sessions in GA4 is itself one of the strongest bot signals you have, and why analytics-side detection can only ever be half the picture.

So set expectations accordingly. In GA4 you are hunting the middle tier: automated traffic that executed your tag, passed the known-bots filter, and left behavioral fingerprints in your data.

Seven signals that expose bot traffic in GA4

No single metric proves bot traffic. Clusters do. Look for several of these landing on the same source, campaign, or city at once:

1. Near-zero average engagement time. Real visitors from paid campaigns spend measurable time on a page. Sessions averaging 0–2 seconds of engagement time, at volume, from one source, are automation. This is GA4's sharpest single signal.
2. Engagement-rate collapse from one segment. If your property's paid traffic engages at 55–65% and one campaign, placement, or city suddenly engages at 5%, that segment has a traffic-quality problem, not a creative problem.
3. ~100% new users from a single source. Bots rotate identities; humans return. A source that never produces a returning visitor — especially paired with signal #1 — is a strong automation marker.
4. Geography that doesn't match your targeting. Clusters of sessions from cities or countries you don't advertise in, or improbable volume from one small city, point to proxy exits and click farms. (Some wrong-geo traffic is a settings issue too — more on that below.)
5. Improbable technology fingerprints. Outdated browser versions, screen resolutions like 800×600, or (not set) where device data should be — headless and spoofed environments leak inconsistencies real consumer devices don't.
6. Spikes in sessions with flat conversions — or junk conversions. Traffic surges that produce nothing are one flavor; surges that produce fake leads with disposable emails and dead phone numbers are the more expensive flavor, because those fake leads feed your bid automation.
7. Direct-traffic surges and referral oddities. Sudden unexplained direct traffic with bot-like engagement, or referral sources you don't recognize, round out the picture. Classic referral spam is rarer in GA4 than it was in Universal Analytics, but unwanted referrals still show up and are worth excluding.

A copy-paste exploration recipe

You can spot most of the above in one free-form exploration. In GA4: Explore → Free form, then configure:

• Dimensions: Session source/medium, Session campaign, City, Device category, Browser
• Metrics: Sessions, Engaged sessions, Average engagement time per session, New users, Key events
• Filter: Session default channel group = Paid Search (repeat for Paid Social / Display / Cross-network)
• Rows: start with Session source/medium + City; swap City for Browser on the second pass

Then read each row against these thresholds:

| Metric | Healthy paid traffic | Bot-like | |---|---|---| | Average engagement time / session | 30s+ | Under ~5s | | Engagement rate | Near your property's paid average | A fraction of it | | New users / total users | Mixed | ~100% new | | Key events (conversions) | Present, plausible | Zero, or junk form fills | | Geography | Matches targeting | Outside it, or one odd city |

Rows failing three or more columns at meaningful volume deserve investigation. Rows failing all five are your action list for the next section. Run the same exploration weekly — bot campaigns move, and the comparison against last week's baseline is what makes a spike obvious.

Filtering what you find — and GA4's hard limits

GA4 gives you exactly three native cleanup tools, and it's worth being honest about the ceiling on each:

• Internal-traffic and IP filters. You can define internal traffic by IP and filter it out. The catch for fraud: the filter requires knowing the IPs in advance, and GA4 never shows you visitor IP addresses. It's built for excluding your own office, not rotating bot exits.
• Unwanted-referral exclusions. Useful for cleaning referral spam and payment-gateway noise out of attribution. Does nothing about bot sessions arriving through paid clicks.
• Comparisons and segments. Your everyday hygiene tool: build a comparison that excludes the offending city, source, or browser cluster so decisions are made on clean data. Understand that this hides junk from reports — the data underneath stays.

Two limits matter more than any feature. First, data filters are forward-only: nothing removes bot sessions already processed into your property. Second, GA4 dropped the ISP/service-provider dimension that Universal Analytics users once used to spot data-center traffic — so even the "find hosting-provider ISPs" trick is gone. GA4 simply does not carry the network-level evidence (IPs, ISPs, ASNs) that separating bots from humans ultimately requires.

That's not a bug; it's a scope boundary. GA4 is a measurement product. Which brings us to the part that actually saves money.

From symptom to action: what to do on the ads side

Every signal your exploration surfaced maps to a control that lives outside GA4. This mapping is the step most bot-traffic guides skip:

| GA4 symptom | Where to act | |---|---| | Wrong-geo sessions | In Google Ads, check the user-location report, switch targeting from "Presence or interest" to Presence only, and add location exclusions | | One placement or site with bot-like engagement | Placement exclusions (account-level for Performance Max) | | Junk sessions via search partners | Evaluate the search-partner network toggle for that campaign | | Repeat automated visitors | IP exclusions — with caveats below | | Junk paid-social traffic | Meta audience exclusions and conversion-signal filtering — Meta offers no IP exclusion at all | | Fake leads counted as conversions | Conversion-level filtering (next section) |

The IP-exclusion caveats deserve a paragraph, because this is where the GA4 workflow dead-ends. Google Ads caps IP exclusions at 500 per campaign, campaign-level exclusions don't apply to Performance Max at all, and — the structural problem — GA4 can't tell you which IPs to exclude in the first place, because it doesn't expose them. Bots on residential proxies rotate through more addresses in a day than the cap allows in total. Closing that gap requires click-level bot detection: an independent layer that sees every paid click with its full network and device fingerprint, identifies the visitor behaviorally, and writes exclusions automatically. That's the job of dedicated click fraud protection software rather than an analytics property — GA4 tells you the attack happened; a protection layer is what makes it stop.

Google's own invalid-click system does filter and credit the traffic it catches, and that baseline is real. But it optimizes for the auction at platform scale, and as we covered above, the middle tier of human-looking automation is exactly what slips through — on your dime.

The most expensive bots never touch your website twice: protect the conversion signal

Here's the compounding failure mode. Bot traffic that reaches your forms doesn't just pollute analytics — it submits fake leads, and if those fake leads are reported to Google and Meta as conversions, your Smart Bidding and Advantage+ campaigns learn from them. The algorithm dutifully goes and buys more of whatever produced the junk. At that point you're not losing the cost of the bad clicks; you're paying the platform to scale them.

GA4 has no role to play here. The fix is filtering at the conversion layer:

• On Google, that means validating leads before they're uploaded through enhanced conversions for leads, so bidding trains only on real prospects.
• On Meta, it means fraud-filtered signals through the Conversions API — scoring each event server-side and sending only verified conversions, so Advantage+ optimizes toward humans. Meta gives advertisers no IP exclusions and few manual levers, which makes conversion-signal quality the single control you still own on that platform.

If your GA4 exploration showed junk form fills from paid traffic, treat conversion filtering as more urgent than report cleanup. Clean reports are nice; a clean training signal is money.

The bottom line

GA4's automatic bot filter handles the traffic that announces itself. For everything else, GA4 is a smoke detector: run the exploration recipe weekly, read engagement time, new-user ratio, geography, and click-to-session gaps as a cluster, and use comparisons to keep decisions clean. Then do the part that actually changes the invoice — act on the ads platforms, and put click-level bot detection and conversion filtering in front of the traffic so the junk stops reaching your property, your forms, and your bidding algorithms in the first place. Measurement shows you the leak. Protection plugs it.