What is bot traffic? How to spot it in GA4 and what to do about it

Open your analytics and look at yesterday. Some of those visitors were not people. They were programs: search engine crawlers, price scrapers, spam scripts, uptime monitors. That is bot traffic, and on most sites it is a bigger share than people expect.

This guide explains what bot traffic is and which bots are fine. Then it shows how to spot the rest in Google Analytics 4 and keep it out of the numbers your team relies on.

Bot traffic, defined

Bot traffic is any request to your website made by software running on its own, rather than by a person in a browser. The word “bot” is short for robot.

The scale is large. Imperva’s 2025 Bad Bot Report found that automated traffic made up 51 percent of all web traffic in 2024, the first year it passed human traffic. Bad bots alone were 37 percent. On travel sites the bad-bot share was 48 percent.

Those numbers are measured at the network level, before analytics. Your GA4 reports show much less, because GA4 filters the bots it knows about and many bots never run the tracking script at all. That gap is the first thing to understand.

Good bots and bad bots

Not all bots are a problem. It helps to sort them into three groups.

Good bots are how you get into search. If you block Googlebot, you disappear from Google, which is one of the causes in why your website is not showing up on Google.

Bad bots cost money three ways. They load your server, they skew your data, and some of them commit fraud, such as clicking your ads or testing stolen passwords on your login page.

Why bot traffic wrecks your reports

Analytics is only useful if you know which sessions are people. A few thousand unlabelled bot hits can:

• Drop your engagement rate and average engagement time, so a healthy page looks broken.
• Inflate pageviews on a landing page, so a test looks like it worked.
• Fill the referral report with domains you have never heard of.
• Push your conversion rate down because bots never convert.

Every decision built on those numbers is a little wrong. That is the real cost.

Five signs of bot traffic in GA4

GA4 removes traffic from bots on the IAB’s known bots list automatically. You cannot see it or turn that off. What gets through is the unlisted rest, and it leaves fingerprints.

1. A spike with no reason

Traffic doubles on a Tuesday. No campaign launched, no press, no email. Open Reports, then Acquisition, then Traffic acquisition, and look at which channel jumped. Bot spikes usually land in Direct, Referral, or Unassigned.

2. Near-zero engagement time

People spend time on a page. Simple bots load it and leave. In the Traffic acquisition report, add the Average engagement time per session metric. Sessions averaging under two or three seconds across hundreds of visits are almost never human.

3. One page, no events

Bots rarely scroll, click, or fire your custom events. Compare Views per session and Event count for the suspicious segment against your normal traffic. A segment with exactly one page per session and only the automatic page_view and session_start events is a strong signal.

4. Countries and devices that do not fit

Open User attributes, then Demographic details, and switch to Country. A local plumber in Ohio with 400 sessions from a country they have never served is looking at bots. Do the same for browser and operating system under Tech details. Old browser versions and unusual screen sizes are common bot tells.

5. Referrers you cannot explain

Referral spam sends fake hits with a referrer domain in the hope you will visit it. In the Traffic acquisition report, filter to Referral and read the session source list. Domains you do not recognize, with the low engagement above, are spam. Real referrals come from sites that link to you and tend to engage well. Our guide to referral traffic shows how to tell the two apart.

A quick way to check any of these: open Realtime. If a spike is running right now, you will see the country, page, and source live.

How to keep bot traffic out of GA4

You cannot stop bots from visiting. You can stop them from counting.

1. Confirm known-bot filtering is on. It is, always, in GA4. There is no setting. Skip this worry.

2. Filter your own traffic. In Admin, then Data streams, choose your stream, open Configure tag settings, then Define internal traffic. Add your office and home IP addresses. Then in Admin, then Data filters, activate the internal traffic filter. Your own tests and monitors vanish from reports.

3. List unwanted referrals. In the same tag settings, open List unwanted referrals and add the spam domains you found. Those sessions get attributed as direct instead of referral, which stops the referral report from filling with junk.

4. Build a clean segment. In Explorations, create a segment that excludes sessions with engagement time under a few seconds and no events. Use it when reporting on anything that matters. Keep the raw view for spotting new bot patterns.

5. Block at the door. For heavy bot loads, use your CDN or host’s bot management, add rate limits to forms and logins, and block user agents that identify themselves as scrapers. This is not an analytics setting. It stops the requests before they reach the page.

Bots that never run JavaScript never appear in GA4 at all. If your server logs show ten times the requests GA4 shows, that is normal. Server logs count everything. GA4 counts browsers that ran the tag.

Bot traffic you pay for

Paid test traffic is bot traffic too. Many traffic tools, ours included, send visits from automated browsers. By the definition above, each of those visits is a bot.

Better bots are hard to spot with the five signs. They run a real browser, wait, scroll, open more pages and fire your events. So engagement time and events cannot prove that a visitor was a person. They only catch the cheap scripts.

So do not guess. Label paid test traffic and keep it apart:

1. Tag it. Add UTM tags to the target URL. Use a source name you never use for real channels, such as utm_source=qa_test.
2. Segment it. In GA4, save a comparison or an Explore segment that leaves that source out. Save a second one that shows only the test.
3. Exclude it from reports. Use the clean view for anything your team decides on. For pure tests, a separate GA4 property keeps the visits out of your main data.

Our guide on how to check website traffic in GA4 shows each step. If you need test traffic you can label and verify, Serplify sends automated visits in real Chrome browsers and lists every delivered visit, so you can match it to GA4. To plan one, set up a test campaign on a dedicated page. Before you pay any provider, run through the website traffic quality checklist.

Bot traffic and bounce rate

One side effect of bot traffic is a bounce rate that looks worse than it is. Bots land, leave, and count as unengaged sessions. Before you redesign a page over its bounce rate, filter the bots and look again. We cover how to read that number in how to reduce bounce rate.