Bots fall into two very different buckets for measurement purposes. Declared bots — Googlebot, Bingbot, UptimeRobot, monitoring services — identify themselves cleanly in the user-agent string and are easy to filter. Undeclared bots are the hard problem: headless browser scrapers (Puppeteer, Playwright) that spoof a normal Chrome user-agent, SEO/competitive-intelligence crawlers run by tools like Ahrefs or SEMrush hitting your site directly rather than just their own index, and increasingly, AI model training crawlers and LLM-answer-engine fetchers (GPTBot, ClaudeBot, PerplexityBot among others) that may or may not honor a clean user-agent depending on configuration.

GA4's built-in bot filtering and its limits

GA4 applies IAB/ABC International Spiders & Bots List filtering automatically and silently — there's no toggle, it just happens before data reaches your property. This catches known, declared crawlers reliably. What it does not catch: bots that deliberately spoof a real browser user-agent and execute JavaScript (so they *do* fire the GA4 tag, unlike simple scrapers that never load JS at all), and any bot not yet present on the IAB list, which lags behind newly emerging scraper and AI-crawler traffic by design.

Detection layers and what they catch

Layer	Catches	Misses
GA4 built-in IAB filter	Known declared bots/spiders on the IAB list	JS-executing bots with spoofed UA, unlisted/new bots
Server-side user-agent + IP filtering (CDN/WAF)	Data center IP ranges, known bot UA patterns	Residential-proxy bots mimicking real devices
Behavioral heuristics (bounce rate, session duration, click patterns)	Statistically anomalous sessions regardless of UA/IP	Low-volume bots that stay under per-session anomaly thresholds
JS challenge / fingerprinting (Cloudflare Bot Management, DataDome)	Headless browsers, automation frameworks	Adds latency; cost scales with traffic volume

Behavioral signatures worth building a view around

When declared filters aren't enough, behavioral heuristics catch what slips through. The recurring signature across most non-human sessions: near-zero or impossibly uniform session duration, bounce rate pinned near 100% from a specific source/campaign combination, pageview sequences that don't follow any plausible navigation path (hitting deep internal pages directly with no referring internal page), and traffic volume from a single source that doesn't correlate with any real campaign spend or outreach. A session lasting exactly 1 second across thousands of hits from the same subnet is a stronger tell than any single UA string.

bot_like_sessions.sql

sql

-- Flag sessions in GA4 BigQuery export with bot-like behavioral signatures
-- that passed the built-in IAB filter.
SELECT
  user_pseudo_id,
  (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'source') AS source,
  (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'medium') AS medium,
  COUNTIF(event_name = 'page_view') AS pageviews,
  MAX(event_timestamp) - MIN(event_timestamp) AS session_duration_micros
FROM `project.analytics_123456789.events_*`
WHERE _TABLE_SUFFIX BETWEEN '20260101' AND '20260131'
GROUP BY 1, 2, 3
HAVING pageviews >= 5
   AND session_duration_micros < 2000000  -- under 2 seconds for 5+ pageviews
ORDER BY pageviews DESC

Don't filter on UA string alone and call it solved

Blocklisting known bot user-agent substrings feels like progress but catches almost exclusively traffic that was already going to be filtered by GA4's built-in IAB list. The traffic actually distorting your reports is, by definition, the traffic that doesn't announce itself — which means any serious bot program needs behavioral and infrastructure-level signals, not just string matching against a UA blocklist.

Where this matters most: paid media and lead gen

Bot contamination is a cosmetic annoyance in a pageview report, but it's a budget and pipeline problem in paid media and lead gen specifically. Click fraud and bot clicks drain ad spend on traffic that never converts (see ad fraud detection), and bot-submitted forms pollute CRM lead records with fabricated contact data, sometimes even triggering real automated email sequences and sales notifications for leads that don't exist. For lead gen forms specifically, adding a honeypot field (a hidden input real users never fill but bots scripted to fill every field do) plus server-side rate limiting by IP catches a large share of unsophisticated bot submissions without the friction cost of a visible CAPTCHA.

What's Next?

Bot contamination is one source of noisy, untrustworthy data in your reports — referral spam that fabricates entire fake sessions with no bot even visiting your site is a related but mechanically different problem worth understanding on its own terms.

I build these systems professionally.

Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.

Work With Me →

Need production AI or MarTech expertise? I build custom LLM workflows, server-side GTM tagging, and analytics infrastructures professionally.

Need custom AI or MarTech setup? Let's build together.

Let's talk →