Identifying Bot Traffic in Google Analytics 4
Last updated: December 31, 2025
By default, GA4 automatically excludes known bots from your reports—but ~50% of all internet traffic is bots, and the sneaky ones disguise themselves as humans. This guide shows you how to spot them in your data.
In This Guide
Understanding what GA4 filters and what slips through
How do I spot bots from data centers?Check for traffic from AWS, Google, and Microsoft server locations
How do I identify bots by engagement patterns?Find traffic sources with zero engagement time
How do I detect bots using tech details?Look for suspicious screen resolutions, browsers, and operating systems
Why is my direct traffic spiking?Identify bot attacks disguised as direct traffic
What should I do about bot traffic?Practical steps to filter bots from your reports
How much of my website traffic is actually bots?
By default, you cannot see most bot traffic in GA4 because Google automatically identifies and excludes known bots (like Googlebot) from your reports—and you can’t even toggle this off.
However, “bad” bots (scrapers, spammers, AI crawlers) often disguise themselves as human users. Recent 2025 benchmarks suggest ~50% of all internet traffic is bots. Since GA4 blocks the obvious ones, any “human” traffic you see that looks suspicious is likely part of that bad bot percentage leaking through.
Human vs. Bot: Quick Reference
| Metric | Real Human Behavior | Sneaky Bot Behavior |
|---|---|---|
| Engagement Time | Varied (10s - 3m) | Exact 0s or 1s |
| Location | Distributed (NY, London, LA) | Clustered (Ashburn, Boardman) |
| Software | Chrome, Safari, Edge (Mobile/Desktop) | Linux, “Not Set”, Custom User Agents |
| Traffic Source | Organic, Social, Paid, Direct | Heavy “Direct” or Spam Referrals |
How do I spot bots from data centers?
Lazy bots often run on servers in data centers rather than residential internet connections. This is the easiest way to catch them:
- Go to: Reports > User Attributes > Demographic details
- Change the primary dimension to City
- Look for: Ashburn, Boardman, Columbus, Dublin, or Coffeyville
Why these cities?
These are locations of major data centers (AWS, Google, Microsoft). If you see a high volume of traffic from these tiny cities with 0m 00s engagement time, that’s 100% bot traffic.
| City | Data Center |
|---|---|
| Ashburn, VA | Amazon AWS |
| Boardman, OR | Amazon AWS, Google |
| Columbus, OH | Amazon AWS |
| Dublin, Ireland | Amazon AWS, Microsoft Azure |
| Coffeyville, KS | Various hosting providers |
How do I identify bots by engagement patterns?
Real humans rarely land on a site and leave instantly en masse. This pattern is a dead giveaway:
- Go to: Reports > Acquisition > Traffic acquisition
- Look for a specific Session source / medium (often “Direct” or a suspicious referral site) that has:
- High user count
- Engagement Rate near 0%
- Average engagement time of <1 second
What does this mean?
If you see 1,000 users from “Direct” with an average time of 0 seconds, those are bots hitting your page and leaving immediately. Real users—even those who bounce quickly—typically spend at least a few seconds on the page.
How do I detect bots using tech details?
GA4 removed the “Service Provider” dimension (which used to make it easy to spot “Amazon Technologies Inc” or “Microsoft Azure”), but you can sometimes catch bots via Tech details:
- Go to: Reports > Tech > Tech details
- Change dimension to: Screen resolution or Browser
Red flags to look for
| Dimension | Suspicious Value | Why It’s Suspicious |
|---|---|---|
| Screen resolution | ”800x600” | Rare for humans in 2025 |
| Screen resolution | ”(not set)“ | Bots often don’t report this |
| Browser | ”Mozilla Compatible Agent” | Generic bot identifier |
| Browser | Very old Chrome/Safari versions | Outdated user agents |
| Operating System | High spike in Linux desktop | Often server-side bots |
Why is my direct traffic spiking?
Bots often don’t send referrer data, so they get lumped into “Direct” traffic. A sudden spike in Direct traffic that doesn’t result in any sales or leads is a major red flag.
How to verify it’s bots
- Go to your Direct traffic report
- Add a secondary dimension: City
- Check if the spike is entirely from data center locations like “Ashburn, VA”
If yes, it’s a bot attack—not a sudden surge in brand popularity.
Common causes of bot-driven direct traffic
- Scrapers harvesting your content
- AI crawlers training language models
- Spam bots testing forms or links
- Competitors monitoring your site programmatically
What should I do about bot traffic?
Once you identify bot traffic patterns in your data, take these steps:
1. Create exclusion segments
Build segments that filter out suspicious traffic from your key reports:
- Exclude sessions with 0s engagement time
- Exclude traffic from known data center cities
- Exclude sessions with “(not set)” screen resolution
2. Set up custom alerts
Create alerts in GA4 for unusual spikes:
- Direct traffic increases by more than 50% day-over-day
- Traffic from Ashburn, VA exceeds normal thresholds
- Engagement rate drops suddenly
3. Filter conversion reports
Only include engaged sessions when analyzing conversions:
- Engagement time > 10 seconds
- At least one interaction event (scroll, click, etc.)
4. Adjust your expectations
Your actual human traffic may be 10-30% lower than reported if you have significant bot infiltration. Factor this into your analysis.
The goal isn’t to eliminate every bot from your reports—that’s impossible. The goal is to understand where your real humans are coming from so you can make better marketing decisions.
Looking for expert guidance? Schedule a free consult:
Book a Free Consultation