How to Exclude Bot Traffic From Google Analytics and GA4

Google Analytics is a tool your team likely uses to analyze and understand the traffic on your site. Since online marketing and business decisions are only as good as the data that informs them, it is critical to keep your Google Analytics reports as clean and accurate as possible. 

Bot traffic is a known source of inaccurate and irrelevant Google Analytics data. Let’s take a look at how to exclude bot traffic from Google Analytics, as well as other steps you should take to prevent bots from skewing your business outcomes.

In this article, we’ll cover:

• What is bot traffic in Google Analytics?
• How to identify bot traffic in google analytics
• How to exclude bot traffic from Google Analytics.
• What are the limitations of excluding bots from Google Analytics?
• What else you can do to mitigate bot traffic.

What is bot traffic in Google Analytics?

Bots, spiders, crawlers, and scrapers are software applications that run automated tasks on the internet. There are a lot of them. In fact, bot traffic now represents around half of the world’s total internet traffic.

That’s one bot hit for every human-generated hit to all web servers, everywhere on the planet. 

While some bots can be beneficial—like Googlebot, which indexes your website to show it in search results—there are many “bad bots” trying to steal your data or degrade the performance of your site.

Good or bad, bots don’t reflect the behavior of your human users, so it’s important to control how bot traffic is reflected in your Google Analytics data.

How to Identify Bot traffic in Google Analytics

Bad bot traffic in your Google Analytics data often stands out as unusual. As you’re reviewing your data, look for traffic spikes that are not associated with any business reason (such as the launch of a new product or marketing campaign).

If there’s no obvious reason for a drastic traffic spike, chances are it’s bot traffic.

Then, look for other unusual variables. For example, it’s not normal to have a 0% or a 100% bounce rate on a page with traffic. Only bots could produce such an absolute number for a metric. The same goes for sessions that only ever include one page per session, traffic from strange locations, and browser dimensions that are “not set.”

Anything out of the ordinary is probably bot traffic.

Sometimes unconcealed and/or less sophisticated bots will be easily searchable in Google Analytics, because the word “bot” will be in the SourceName. Go to the Acquisition tab of Google Analytics and select Source/Medium under All Traffic. Then select Source as the primary dimension and search for “bot.” You might be surprised at what you find.

How to Exclude Bot Traffic From Google Analytics

There are three ways you can remove bot traffic from your Google Analytics data:

1. Exclude traffic in Admin

By far the easiest way is to go to View Settings in the Admin section and simply check the “exclude all hits from known bots and spiders” option. 

NOTE: Checking this option will only remove bots from new data starting from the point the box is checked onward. It will not change any of the data you collected up to this point.

2. Create filters and apply them to your Master View

You can create a filter to exclude any suspicious traffic you’ve identified by creating a new View in which you will uncheck your bot setting and add a filter that excludes suspicious traffic using variables such as city, IP, ISP, HostName, SourceName, etc. Test the filter to see if it works. If so, then apply it to your Master View.

3. Exclude suspicious domains from your data

You can use the Referral Exclusion List, which you can find under Tracking Info in the Property column of the Admin section. This list gives you the ability to exclude domains from your Google Analytics data. So if you’ve identified suspicious domains, you can remove them from your future data by adding them to this list.

What are the limitations of ‘google analytics bot filtering’?

The first method is useful, easy to implement (check a box and forget it), and will ensure that all bots on the Interactive Advertising Bureau’s International Spiders & Bots List are excluded from your Google Analytics data. However, bots that are not on the list will still go undetected.

Option two, manually identifying and excluding bots through filters is a lot less practical and reliable. A popular website might have too much suspicious-looking traffic to manually evaluate and filter out. Also, bots are always getting better at imitating humans. A common bot tactic is to spread their requests across a vast number of different IP addresses, including residential IPs, to appear less suspicious than hundreds of hits from the same IP address.

Finally, using the referral exclusion list is the least reliable option. Excluding a referral source (e.g. bot-traffic.xyz, bottraffic.live, bottrafic.live, bot-traffic.icu, or trafficbot.live) does not mean that hits from the source won’t be tracked. It just means that the hits get stripped of their referral information. Therefore, hits from the excluded referral source will still show up as direct traffic, possibly skewing your data worse than before. In short: Other methods are preferred for removing bot traffic from Google Analytics.

Essentially, the “Exclude all hits from known bots and spiders” checkbox is the only practical way of removing known bot traffic from your Google Analytics data. The setting is a helpful tool, but it is not a bot management solution.

Removing Bots in Google Analytics is Not Enough

Removing bots from your Google Analytics data is smart, but keep in mind that it doesn’t actually remove the bot traffic from hitting your website, app, or APIs. While the bots may no longer skew your site’s performance data, they might still be impacting your site’s performance—slowing it down, hurting the user experience, and getting in the way of conversions. 

Cleaner Google Analytics data will help you make better marketing decisions. But without sophisticated bot and online fraud protection, you run the risk of distributed denial of service (DDoS), account takeover (ATO), ad fraud, content theft, credential stuffing, and all the other malicious attacks that leverage bots.

In the grand scheme of things, removing bots from your Google Analytics data solves a symptom—not the far more dangerous root problem of bots attacking your platform. You need to block malicious bots from your websites and apps altogether, not just remove them from your data.

How to Detect & Deflect Bots From Your Websites, Apps, & APIs

DataDome offers a solution that gives you visibility into your bot traffic to help you detect bot traffic on your website, mobile app, and APIs. DataDome’s user-friendly dashboard lets you analyze your traffic (if you want) and control which kinds of bot traffic you allow on your site. The solution notifies you if/when your site is being attacked by bots, and can help you stop unwanted bot traffic.

Setting up DataDome takes minutes, and you can try it for free for 30 days. In less than half an hour from now, you can be looking at the volume and nature of bot traffic on your website, mobile app, and/or APIs.

Once you see which bad bots are hitting your platform, you can decide whether you want to be able to block them with a simple click. Then, not only are you protecting your business and customers, but you can forget about skewed data analytics data forever.

Want to see what type of bot traffic is on your site? 

You can test your site today. (It’s easy and free—no credit card required.)