Bot / Spam Filtering
In GA4, bot and spam filtering automatically excludes traffic from known bots and spiders. Google checks incoming hits against the IAB/ABC International Spiders and Bots List and drops anything that matches, so your reported sessions are meant to reflect real visitors rather than crawlers, scrapers, and automated monitoring tools.
Why it matters
Bot traffic inflates the numbers that small business owners care about most: sessions, pageviews, and users. If a chunk of your traffic is automated, every metric built on top of it is misleading. The good news is that GA4 handles the obvious cases for you, automatically, with nothing to switch on. The catch is that "known bots" is a much smaller set than "all bots."
A concrete example
Say your sessions jump 40% in a week, almost entirely from one country you don't serve, with average engagement time near zero. GA4's automatic filtering didn't catch it, because the source wasn't on the known-bots list — it was a fresh scraper or a cheap traffic source. The spike is real in the data but meaningless for your business. Filtering reduces noise; it doesn't eliminate it.
The common misreading
The mistake is assuming that because GA4 filters bots, every session you see is a genuine human. It isn't. Automatic filtering only removes recognised bots. Sophisticated or brand-new automated traffic still slips through and shows up as a referral spike, a self-referral, or unexplained growth. When a number moves sharply, check where it came from before you celebrate it.
WebSignalytics reads your traffic in context — flagging spikes that look automated rather than real — and tells you each week whether anything has actually changed. No dashboards, no logging in.
See how it works