What Is Bot Traffic? How to Spot It in GA4 and What to Do About It

Open your analytics and look at yesterday. Some of those visitors were not people. They were programs: search engine crawlers, price scrapers, spam scripts, uptime monitors. That is bot traffic, and on most sites it is a bigger share than people expect.

This guide explains what bot traffic is and which bots are fine. Then it shows how to spot the rest in Google Analytics 4 and keep it out of the numbers your team relies on.

Bot traffic, defined

Bot traffic is any request to your website made by software running on its own, rather than by a person in a browser. The word “bot” is short for robot.

The scale is large. Imperva’s 2025 Bad Bot Report found that automated traffic made up 51 percent of all web traffic in 2024, the first year it passed human traffic. Bad bots alone were 37 percent. On travel sites the bad-bot share was 48 percent.

Those numbers are measured at the network level, before analytics. Your GA4 reports show much less, because GA4 filters the bots it knows about and many bots never run the tracking script at all. That gap is the first thing to understand.

Good bots and bad bots

Not all bots are a problem. It helps to sort them into three groups.

Good bots are how you get into search. If you block Googlebot, you disappear from Google, which is one of the causes in why your website is not showing up on Google.

Bad bots cost money three ways. They load your server, they skew your data, and some of them commit fraud, such as clicking your ads or testing stolen passwords on your login page.

Why bot traffic wrecks your reports

Analytics is only useful if the sessions in it are people. A few thousand bot hits can:

• Drop your engagement rate and average engagement time, so a healthy page looks broken.
• Inflate pageviews on a landing page, so a test looks like it worked.
• Fill the referral report with domains you have never heard of.
• Push your conversion rate down because bots never convert.

Every decision built on those numbers is a little wrong. That is the real cost.

Five signs of bot traffic in GA4

GA4 removes traffic from bots on the IAB’s known bots list automatically. You cannot see it or turn that off. What gets through is the unlisted rest, and it leaves fingerprints.

1. A spike with no reason

Traffic doubles on a Tuesday. No campaign launched, no press, no email. Open Reports, then Acquisition, then Traffic acquisition, and look at which channel jumped. Bot spikes usually land in Direct, Referral, or Unassigned.

2. Near-zero engagement time

Real people spend time on a page. Bots load it and leave. In the Traffic acquisition report, add the Average engagement time per session metric. Sessions averaging under two or three seconds across hundreds of visits are almost never human.

3. One page, no events

Bots rarely scroll, click, or fire your custom events. Compare Views per session and Event count for the suspicious segment against your normal traffic. A segment with exactly one page per session and only the automatic page_view and session_start events is a strong signal.

4. Countries and devices that do not fit

Open User attributes, then Demographic details, and switch to Country. A local plumber in Ohio with 400 sessions from a country they have never served is looking at bots. Do the same for browser and operating system under Tech details. Old browser versions and unusual screen sizes are common bot tells.

5. Referrers you cannot explain

Referral spam sends fake hits with a referrer domain in the hope you will visit it. In the Traffic acquisition report, filter to Referral and read the session source list. Domains you do not recognize, with the low engagement above, are spam.

A quick way to check any of these: open Realtime. If a spike is running right now, you will see the country, page, and source live.

How to keep bot traffic out of GA4

You cannot stop bots from visiting. You can stop them from counting.

1. Confirm known-bot filtering is on. It is, always, in GA4. There is no setting. Skip this worry.

2. Filter your own traffic. In Admin, then Data streams, choose your stream, open Configure tag settings, then Define internal traffic. Add your office and home IP addresses. Then in Admin, then Data filters, activate the internal traffic filter. Your own tests and monitors vanish from reports.

3. List unwanted referrals. In the same tag settings, open List unwanted referrals and add the spam domains you found. Those sessions get attributed as direct instead of referral, which stops the referral report from filling with junk.

4. Build a clean segment. In Explorations, create a segment that excludes sessions with engagement time under a few seconds and no events. Use it when reporting on anything that matters. Keep the raw view for spotting new bot patterns.

5. Block at the door. For heavy bot loads, use your CDN or host’s bot management, add rate limits to forms and logins, and block user agents that identify themselves as scrapers. This is not an analytics setting. It stops the requests before they reach the page.

Bots that never run JavaScript never appear in GA4 at all. If your server logs show ten times the requests GA4 shows, that is normal. Server logs count everything. GA4 counts browsers that ran the tag.

Bot traffic and traffic you pay for

If you buy website visits, the question you care about is whether you bought people or scripts. The five signs above answer it.

Run a small campaign to a page you can watch. During delivery, open GA4 and check the engagement time, pages per session, events, country, and device. Real visits look like real visits: engagement in the tens of seconds, a mix of bounces and multi-page sessions, the targeting you asked for, and events firing. Bots look like sign 2 and sign 3 together.

Our website traffic quality checklist turns this into ten questions to ask any provider, and how to check website traffic in GA4 walks through the verification step by step. If you want the bought traffic kept out of your main reports entirely, the tagging and filtering setup is in how to buy website traffic without wrecking GA4.

Bot traffic and bounce rate

One side effect of bot traffic is a bounce rate that looks worse than it is. Bots land, leave, and count as unengaged sessions. Before you redesign a page over its bounce rate, filter the bots and look again. We cover the honest way to read that number in how to reduce bounce rate.

Quick recap

• Bot traffic is visits from software. About half of all web traffic is automated, and more than a third is bad bots.
• Good bots get you indexed. Let them in. Bad bots load your server and poison your data.
• In GA4, look for unexplained spikes, near-zero engagement time, single-page sessions with no events, strange countries and devices, and unknown referrers.
• GA4 filters known bots on its own. You filter internal traffic and unwanted referrals yourself, and block the heavy stuff at the network level.
• The same checks tell you whether traffic you paid for is human.