Bot traffic in Google Analytics 4.

Google Analytics 4 excludes known bots automatically. Google’s help page says traffic from known bots and spiders “is automatically excluded”, using a combination of Google’s own research and the IAB’s International Spiders and Bots List, and that you can’t turn the exclusion off or see how much traffic it removed (known bot-traffic exclusion).

That is a list, so it removes the bots that announce themselves: declared crawlers, monitoring tools and the agents on the IAB list. Anything that presents itself as an ordinary browser is counted as a user. Universal Analytics had an optional checkbox for the same list; GA4 has no setting at all, so an article telling you to tick a bot-filtering box is describing the old product.

If you run ads there is a second gap. Google Ads filters invalid clicks out of your bill, but Google says Analytics “reports on all the resulting sessions” (Google Ads help). A click you weren’t charged for can still be a session in GA4, which is one reason Ads clicks and GA4 sessions never quite match.

None of these proves a session was a bot. Together, and concentrated in one source, they are worth a closer look.

• Near-zero engagement. GA4 counts a session as engaged when it lasts more than 10 seconds, has a key event or has two or more page views (engaged sessions). Bot sessions tend to sit at 0 seconds and a 0% engagement rate.
• Spikes from one city or country you don’t target, often arriving as Direct.
• (not set) values for the landing page, or empty page titles.
• Odd screen resolutions and old browsers, such as 800×600, in volumes no real audience produces.
• Hostnames that aren’t yours, a sign of data reaching your measurement ID from somewhere else.
• Many events from very few users, or several events a second in one session.

Where you see these matters more than whether you see them. Spread evenly across the site, they are background noise. Concentrated in one campaign, source or landing page, they show where bot traffic comes in.

From autumn 2025, site owners widely reported sudden GA4 traffic from China, often Lanzhou, and from Singapore: sessions of a few seconds, mostly Direct, frequently with (not set) landing pages, and on some small sites a large share of all sessions. Google’s own Analytics community has a thread on it (GA4 bot traffic from China and Singapore). Analysts attribute it to automated traffic, but the cause hasn’t been confirmed.

If you see it, treat it like any other unconfirmed pattern: set it aside in your analysis with a comparison or a segment rather than trying to delete it. GA4’s permanent filters can’t target a country anyway.

• Internal traffic, by IP. Define IP rules on a web data stream, then activate an internal-traffic data filter. It is the only IP-based exclusion GA4 has, and it is built for your own office, not for bots (internal traffic).
• Developer traffic. Removes debug-mode hits.
• Hostname. Google’s data-filter page lists a filter for excluded web hostnames (data filters), though its overview page still lists only internal and developer filters.
• Unwanted referrals. These remove nothing: matching referrers are ignored for attribution, and the sessions usually show up as Direct (unwanted referrals).

There is no data filter by country, city, network, browser or behaviour. And data filters are permanent: Google says excluded data is never processed and won’t be available in Analytics or BigQuery, and filters don’t apply to past data. For anything you suspect but haven’t confirmed, use the tools that change nothing: comparisons, report filters and Exploration segments.

1. Open Explore and start a free-form exploration.
2. Add the dimensions Session source / medium, Country, City, Landing page and Hostname, and the metrics Sessions, Engaged sessions and Average engagement time per session.
3. Build a session segment where Session engaged is 0, and compare it with all sessions.
4. Sort by sessions and look for the sources, cities and landing pages where the unengaged segment dominates.
5. Save the segment and use it as a comparison in standard reports, not as a permanent filter.

This shows where unengaged traffic concentrates. It can’t tell you whether any one session was a bot: a real visitor who reads one paragraph and leaves looks the same in GA4.

GA4 sees sessions, not where a paid click was bought. A campaign’s utm_source names the network, but not the publisher, zone or placement inside it, and on native, push and pop networks that sub-source is where bot traffic concentrates. GA4 also has no way to judge an individual visit.

That is the gap ValidVisit fills. One script checks every paid visit against 100+ data points, judges it Valid or Invalid with its evidence, and ties it to the campaign and to the sub-source token each network passes in the click URL. The tracking-token directory lists those tokens per network, and how it works covers the setup. Keep GA4 for behaviour and conversions, and read the invalid share per source before you decide what to cut.