How to identify bot traffic in Google Analytics 4

If your sessions jumped last month and nothing in your marketing changed, bots are the first thing to check. Google Analytics 4 removes traffic from the IAB known-bots list automatically, but that list covers well-behaved crawlers that identify themselves. Scrapers, headless browsers, AI agents and click-fraud tooling do not.

Signals that a segment is bot traffic

No single metric proves a session is automated. Look for two or three of these appearing together in the same segment:

• Engagement time near zero with a pageview recorded — a real person almost never registers 0s on a content page.
• One page per session, repeated thousands of times, on a page nobody links to.
• Traffic spikes that begin and end exactly on the hour.
• A city or region that never appears in your CRM but suddenly ranks top three.
• Browser versions that are years out of date, or a single browser version dominating a spike.
• Direct traffic to deep URLs with query strings — humans rarely type those.

Three reports to run today

1. Engagement time distribution

Reports → Engagement → Pages and screens. Add average engagement time and sort ascending. Pages with meaningful pageviews and sub-second engagement are almost always automated hits.

2. Hostname check

Explore → Free form → dimension 'Hostname'. If your measurement ID appears on a hostname you do not own, someone has copied your tag onto a staging clone or a scraper mirror. Exclude those hostnames in your data filters.

3. Hour-of-day pattern

Human traffic follows a daily curve. Build an exploration with hour of day against sessions for a suspicious source. A flat line, or a perfect spike at 03:00 local time, is machine traffic.

Why GA4 can only ever show you part of the picture

GA4 is a JavaScript tag. It fires when a browser executes JavaScript. The bots that matter most to a marketing team — AI crawlers indexing your content, scrapers lifting your pricing, form-spam scripts posting to your CRM — usually never run JavaScript at all. They fetch the raw HTML and leave. As far as GA4 is concerned, that visit did not happen.

The bot traffic you can see in GA4 is the least interesting bot traffic you have.

That gap is why server-side detection matters. Recording the request at the edge, before any JavaScript runs, is the only way to count crawlers that never execute a tag — and the only way to know whether GPTBot, ClaudeBot or PerplexityBot have read the page you just published.

A practical clean-up sequence

1. 1Create an internal-traffic filter for your office and VPN IP ranges.
2. 2Exclude unknown hostnames with a data filter so tag theft stops polluting reports.
3. 3Segment out sessions with zero engagement time and one pageview, and compare your conversion rate with and without them.
4. 4Add server-side bot logging so you can see the crawler traffic GA4 structurally cannot record.
5. 5Re-baseline your reporting once the noise is out — then set alerts on the clean numbers.

Bot Analytics does step four in about a minute: a 4.2kb script for browser traffic plus an optional server endpoint for everything JavaScript misses, with a dashboard that splits human from bot and names every crawler that hits you.