Skip to main content

Identifying Bot Traffic in Google Analytics 4

Last updated: December 31, 2025

By default, GA4 automatically excludes known bots from your reports—but ~50% of all internet traffic is bots, and the sneaky ones disguise themselves as humans. This guide shows you how to spot them in your data.

How much of my website traffic is actually bots?

By default, you cannot see most bot traffic in GA4 because Google automatically identifies and excludes known bots (like Googlebot) from your reports—and you can’t even toggle this off.

However, “bad” bots (scrapers, spammers, AI crawlers) often disguise themselves as human users. Recent 2025 benchmarks suggest ~50% of all internet traffic is bots. Since GA4 blocks the obvious ones, any “human” traffic you see that looks suspicious is likely part of that bad bot percentage leaking through.

Human vs. Bot: Quick Reference

MetricReal Human BehaviorSneaky Bot Behavior
Engagement TimeVaried (10s - 3m)Exact 0s or 1s
LocationDistributed (NY, London, LA)Clustered (Ashburn, Boardman)
SoftwareChrome, Safari, Edge (Mobile/Desktop)Linux, “Not Set”, Custom User Agents
Traffic SourceOrganic, Social, Paid, DirectHeavy “Direct” or Spam Referrals

How do I spot bots from data centers?

Lazy bots often run on servers in data centers rather than residential internet connections. This is the easiest way to catch them:

  1. Go to: Reports > User Attributes > Demographic details
  2. Change the primary dimension to City
  3. Look for: Ashburn, Boardman, Columbus, Dublin, or Coffeyville

Why these cities?

These are locations of major data centers (AWS, Google, Microsoft). If you see a high volume of traffic from these tiny cities with 0m 00s engagement time, that’s 100% bot traffic.

CityData Center
Ashburn, VAAmazon AWS
Boardman, ORAmazon AWS, Google
Columbus, OHAmazon AWS
Dublin, IrelandAmazon AWS, Microsoft Azure
Coffeyville, KSVarious hosting providers

How do I identify bots by engagement patterns?

Real humans rarely land on a site and leave instantly en masse. This pattern is a dead giveaway:

  1. Go to: Reports > Acquisition > Traffic acquisition
  2. Look for a specific Session source / medium (often “Direct” or a suspicious referral site) that has:
    • High user count
    • Engagement Rate near 0%
    • Average engagement time of <1 second

What does this mean?

If you see 1,000 users from “Direct” with an average time of 0 seconds, those are bots hitting your page and leaving immediately. Real users—even those who bounce quickly—typically spend at least a few seconds on the page.


How do I detect bots using tech details?

GA4 removed the “Service Provider” dimension (which used to make it easy to spot “Amazon Technologies Inc” or “Microsoft Azure”), but you can sometimes catch bots via Tech details:

  1. Go to: Reports > Tech > Tech details
  2. Change dimension to: Screen resolution or Browser

Red flags to look for

DimensionSuspicious ValueWhy It’s Suspicious
Screen resolution”800x600”Rare for humans in 2025
Screen resolution”(not set)“Bots often don’t report this
Browser”Mozilla Compatible Agent”Generic bot identifier
BrowserVery old Chrome/Safari versionsOutdated user agents
Operating SystemHigh spike in Linux desktopOften server-side bots

Why is my direct traffic spiking?

Bots often don’t send referrer data, so they get lumped into “Direct” traffic. A sudden spike in Direct traffic that doesn’t result in any sales or leads is a major red flag.

How to verify it’s bots

  1. Go to your Direct traffic report
  2. Add a secondary dimension: City
  3. Check if the spike is entirely from data center locations like “Ashburn, VA”

If yes, it’s a bot attack—not a sudden surge in brand popularity.

Common causes of bot-driven direct traffic

  • Scrapers harvesting your content
  • AI crawlers training language models
  • Spam bots testing forms or links
  • Competitors monitoring your site programmatically

What should I do about bot traffic?

Once you identify bot traffic patterns in your data, take these steps:

1. Create exclusion segments

Build segments that filter out suspicious traffic from your key reports:

  • Exclude sessions with 0s engagement time
  • Exclude traffic from known data center cities
  • Exclude sessions with “(not set)” screen resolution

2. Set up custom alerts

Create alerts in GA4 for unusual spikes:

  • Direct traffic increases by more than 50% day-over-day
  • Traffic from Ashburn, VA exceeds normal thresholds
  • Engagement rate drops suddenly

3. Filter conversion reports

Only include engaged sessions when analyzing conversions:

  • Engagement time > 10 seconds
  • At least one interaction event (scroll, click, etc.)

4. Adjust your expectations

Your actual human traffic may be 10-30% lower than reported if you have significant bot infiltration. Factor this into your analysis.

The goal isn’t to eliminate every bot from your reports—that’s impossible. The goal is to understand where your real humans are coming from so you can make better marketing decisions.

Looking for expert guidance? Schedule a free consult:

Book a Free Consultation