How to filter and exclude bot traffic in GA4 (and what the built-in filter misses)

The most common question about bot traffic in GA4 has an awkward answer: there is no bot-filtering setting to switch on. Google applies the IAB/ABC International Spiders and Bots List automatically to every property, and there is no control over it. What you can control are data filters, exclusions and segments — and those are where the real work happens.

What the built-in filter actually removes

Only traffic from user agents on the known-bots list, meaning crawlers that announce themselves honestly and register with the IAB. Googlebot, Bingbot and the major SEO crawlers are covered. Anything that spoofs a Chrome user agent — most scrapers, most fraud tooling, most form spam — passes straight through.

Filters you can configure

Internal traffic

Admin → Data streams → Configure tag settings → Define internal traffic. Add your office ranges and any VPN or CI runner IPs. Then activate the filter in Admin → Data filters; a new filter is in testing mode and does nothing until you set it to active.

Unknown hostnames

Create a custom data filter excluding any hostname that is not yours. This kills a whole class of pollution: staging copies, translation proxies and scraper mirrors that carry your tag.

Developer traffic

The developer traffic filter removes hits flagged by debug mode. Cheap to enable and it keeps QA sessions out of production numbers.

Segments for what filters cannot catch

Data filters are permanent and destructive — filtered hits never enter the property. For suspicious-but-unproven traffic, build an exclusion segment instead so you can compare both views:

• Sessions where engagement time = 0 and pageviews = 1
• Sessions from a specific city with a 0% conversion rate over 90 days
• Sessions with a landing page nobody links to internally

The structural blind spot

Every technique above filters traffic that reached GA4. None of them show you the traffic that never did. A scraper pulling your pricing page every ten minutes, or GPTBot reading your documentation, leaves no trace in GA4 because neither runs your tag.

For most marketing teams this is the bigger number. The pragmatic setup is GA4 for humans, plus a dedicated bot layer that records requests at the server or edge, classifies the agent, and reports the split. Then GA4 stays clean and you finally have a number for the traffic it was never able to see.