Spam Referral Filtering in GA4
Ghost traffic vs. crawler traffic
Referral spam in GA4 comes in two structurally different flavors, and the fix for each is different. Ghost spam never visits your site at all — the sender fires a Measurement Protocol hit directly at a GA4 property using a guessed or scraped measurement ID, injecting fake pageviews with a fabricated referrer (often something like best-seo-offer.com or a cryptocurrency site) purely to get the domain name in front of anyone who checks their analytics. Crawler spam does actually hit your server — a real bot requests real pages with JavaScript enabled, executes the GA4 tag, and shows up with a legitimate-looking session but a spam-indicative referrer or hostname.
The single most reliable ghost-spam tell: hostname
page_location parameter often shows your property's measurement ID being hit directly, or a hostname that is (not set), a completely unrelated domain, or a malformed value. Real traffic to your site always carries your actual domain as the hostname. Filtering to known-good hostnames is the highest-leverage single filter for ghost spam.Why GA4 handles this differently than Universal Analytics did
In Universal Analytics, referral spam filtering required manually maintained view-level filters — regex exclusion lists that had to be constantly updated as new spam domains emerged, applied at the view level with no undo once historical data was processed. GA4 shifted the model: instead of regex referrer blocklists, filtering is primarily done through data stream configuration (restricting which hostnames are considered valid for a stream) and through BigQuery-side filtering for analysis, since GA4's UI-level custom filter options are more limited than UA's view filters were.
-- Filter GA4 BigQuery export to only sessions with a legitimate hostname,
-- removing ghost-spam hits that never actually touched your site.
SELECT
event_date,
event_name,
(SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'page_location') AS page_location,
COUNT(*) AS event_count
FROM `project.analytics_123456789.events_*`
WHERE _TABLE_SUFFIX BETWEEN '20260101' AND '20260131'
AND (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'page_location')
LIKE '%yourdomain.com%'
GROUP BY 1, 2, 3
ORDER BY event_count DESCConfiguring the data stream to reject the problem at the source
GA4's Admin > Data Streams > Configure tag settings includes a "Define internal traffic" and, more relevantly, hostname restriction isn't a native UI toggle the way UA's view filters were — the practical fix is enforcing it downstream. Two approaches that actually work: first, if you're on server-side GTM, validate the incoming request's Host header at the server container and drop or tag-block anything that doesn't match your expected domain list before it ever reaches a GA4 client/tag — ghost spam sent via Measurement Protocol directly to your measurement ID can't be stopped at the client at all, since it skips your client-side JS entirely, which makes server-side validation the only real intercept point. Second, in Looker Studio or BigQuery-based reporting, apply a hostname LIKE filter as a standing data source filter so every report built on top of it inherits the exclusion automatically.
Ghost spam cannot be stopped at the GA4 UI level
A practical triage checklist
When a referrer or source/medium combination looks suspicious: check the hostname first (illegitimate hostname is near-certain ghost spam), check whether the session has any pageview beyond the landing hit (ghost spam is almost always exactly one event), check whether the referrer domain resembles known spam patterns (SEO offer sites, adult content, crypto schemes — a quick search of the domain usually confirms it instantly), and check volume concentration — legitimate referral traffic rarely arrives as a single massive spike from one unfamiliar domain with zero engagement.
What's Next?
Spam and bot contamination are threats to data accuracy that originate outside your own measurement pipeline — but GA4 also silently alters reported numbers from the inside, through sampling and thresholding behavior that every analyst needs to recognize before trusting a report at face value.
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.