GA4 automatically removes only bots that Google and the IAB list as "known," and you can neither see how much was removed nor switch it off. Admin data filters cover just three kinds — internal traffic (IP), developer traffic, and hostname — not country or user agent, and filtered data is gone for good. So we handle suspicious traffic by excluding it when viewing, and, assuming that still won't catch everything, decide in advance which numbers each decision rests on — numbers whose conclusion doesn't change when bots get in (Search Console for search, your own records for sign-ups and sales).
Observation: Over 40% of 28 Days of Sessions Were Bot Clusters
We split this site's (Direbase) GA4 data for the 28 days from October 6 to November 2, 2026 by channel and country. Our own visits are already removed with an internal-traffic data filter. Share is the share of all sessions; engagement rate is within each row.
| Country · channel | Share | Engaged | Avg. time |
|---|---|---|---|
| Japan · Direct | 27% | 45% | ~3 min |
| Singapore · Direct | 27% | 2% | ~4 s |
| United States · Referral (a single referring domain) | 12% | 0% | 0 s |
| Japan · Organic Search | 7% | 55% | ~1 min 50 s |
| China · Direct | 5% | 5% | ~3 s |
Singapore Direct, the single-domain US Referral, and China Direct add up to 44% of all sessions. All three have engagement rates of 0–5% and average times of a few seconds. Next to people arriving from search (Japan Organic Search, 55% engaged), these don't belong in the same unit called a "session."
Singapore Direct was already 59% of Direct users when we looked at the end of July (the cause of the mistake described next) — so it has slipped past GA4's automatic exclusion for at least three months. Meanwhile 45% of Japan Direct sessions were engaged, most likely people coming from bookmarks or links in documents. Treating "Direct" as bots wholesale throws those people out too.
What GA4 Removes on Its Own — and What It Doesn't
According to Analytics Help, GA4 automatically excludes traffic from known bots and spiders. "Known" is determined by a combination of Google's own research and the IAB's International Spiders and Bots List. You currently can't turn this off or see how much was excluded.
What follows is that unlisted automated traffic gets counted like a human visit as long as it runs the tag's JavaScript in a browser. The Singapore and China clusters above fit that exactly. What GA4 shows is the number after known bots are subtracted — not the number after bots are subtracted.
Your own options split in two. One is admin data filters, of which there are three kinds: internal traffic (by IP), developer traffic, and web hostname. None filters by country or user agent. Data filters apply only from the moment they're created, and Help says the effect is permanent — excluded data can't be used in GA4 or BigQuery. The other is filters, comparisons, and segments in explorations, which keep the raw data and exclude only at viewing time.
Many top-ranking explainers stop at steps: exclude it like this in explorations, block it like this in GTM. The steps are fine, but they all assume that excluding yields the right number. What actually hurt us wasn't how to exclude — it was making a decision with leftovers still in the data.
How We Got a Decision Wrong
In July 2026 we started a non-search channel: sending direct invitations to web agencies and the like. The week it started, Direct users in GA4 clearly rose. The reasoning was plausible — invitees open the URL directly, so they land in Direct — and we read the Direct numbers as the campaign's effect, estimating it at four times the effect of search.
But when we split that same Direct traffic by country, 59% of its users were non-engaged visits from Singapore — the Direct number was never in a state to be read as the campaign's effect. Matching the invitation list against tool-run records in our own database showed that 4.5% of recipients actually reached the tool. The campaign wasn't worthless — but "four times search" came from crediting a bot-laden number to the campaign.
The pattern: when a campaign launch happens to coincide with a bot surge, day-over-day differences can't tell you which caused what. Bot clusters arrive and leave without notice. A before/after comparison silently assumes the bot volume stayed constant across both periods.
Design: Split Exclusion into Three Layers
| Layer | Means | Reversible | Suited to |
|---|---|---|---|
| Drop at collection | Data filters (internal traffic by IP / developer traffic / web hostname), or not sending the hit from GTM | No | Only what is certainly yours: office IPs, test environments, your tag pasted on someone else's site |
| Exclude when viewing | Exploration filters, comparisons, segments (country, source, engaged or not) | Yes | Suspicious but unproven traffic — most bots belong here |
| Don't decide with it | For each decision, pick numbers whose conclusion doesn't change when bots get in | — | The last line of defense, assuming you can't exclude everything |
The dividing line is certainty. Office IPs and test environments are certain, so dropping them at collection is fine. Singapore Direct is almost certainly bots by its engagement numbers, but there's no proof that zero real visitors come from there. Dropping that kind of traffic in an irreversible layer means you can't get it back if the premise changes. We leave GA4's settings alone and exclude by country, source, and engagement each time we analyze.
The view-time layer has a weakness, though: you have to apply the same exclusions every time, and anyone who doesn't know them reads the dirty number straight off the screen. That's why the third layer is needed.
For Each Decision, Make a Bot-Resistant Number the Source of Truth
The third layer isn't about excluding at all; it's about choosing which number a decision rests on. List the decisions first, and for each, make the source of truth a number whose conclusion doesn't change when bots get in. This is the table we work from.
| Decision | Source of truth | Don't decide with |
|---|---|---|
| Is search acquisition growing? | Search Console impressions, clicks, position | Total GA4 sessions; changes in Direct |
| Did a campaign increase sign-ups or sales? | Your own database or payment records (per account) | Day-over-day GA4 differences; before/after the launch date |
| Are articles being read? | Engaged sessions from search | Total page views; average session duration |
| Is there demand abroad? | Search Console impressions by country | GA4 users by country |
Search Console impressions and clicks record what happened on Google's results page; automated traffic that hits your site directly never enters them. Sign-ups and sales are counted in units — accounts, payments — that are hard to create automatically. Both are counted somewhere bots have a harder time getting in than GA4 sessions; that's why we chose them.
This doesn't mean abandoning GA4. It's still the best tool for the shape of behavior — where people enter and where they leave. When we look at behavior, we narrow to low-bot entry points such as sessions from search. What we avoid are uses like totals and before/after comparisons, where changes in bot volume flow straight into the conclusion.
Where This Design Breaks
Automation that mimics engagement
A GA4 engaged session is one that lasts 10 seconds or more, includes a key event, or includes two or more page views. Our clusters left within seconds, so they stood out — but automation that waits 10 seconds and opens a second page meets the definition. Isolating by engagement rate weakens as bots get more sophisticated.
AI agents acting on someone's behalf
AI agents that drive a browser to research or sign up on a person's behalf have arrived. Everything above assumes bots are noise to keep out of decisions — but if an agent completes a sign-up for its user, that sign-up is a real result. The question then is not "human or machine" but "on whose behalf," and GA4 has no field for it. Counting sign-ups and purchases in your own records pays off here too: the account side at least records whose sign-up it was.
The source of truth needs exclusions too
Making your own database the source of truth isn't the end of it. In the same 28 days, 89% of our tool runs came from accounts that aren't self-serve users — staff, partners, and the like. What GA4's internal-traffic filter hides is still in the database. The source of truth needs its own list of accounts not to count. We keep that list in one place and use the same one every time we tally.
One more: on small sites, a single cluster moves the shares a lot. The US Referral here was one domain and 12% of all sessions. The smaller the site, the more you should check which cluster moved before interpreting any change in share.
Next Step: Build the Decision Table Before Touching Settings
When GA4 numbers look wrong, the urge is to open the settings first. We'd suggest the opposite: write down what you'll decide with the number. Once you know the decision, you know whether bots must be removed or whether another number can simply be the source of truth. In client reports, too, you can talk results in source-of-truth numbers instead of totals that swing with bot volume.
How to read search numbers alongside GA4 is in improving SEO with GA4, and how to verify a change's effect in Search Console is in verifying SEO changes with Search Console.
Related Tools
Sources (checked November 4, 2026)
FAQ
Does GA4 have a setting to exclude bots?▾
Direct traffic from Singapore or China suddenly spiked. Should I exclude it with a data filter?▾
Is engagement rate a reliable way to identify bots?▾
Why is measuring a campaign with a GA4 before/after comparison risky?▾
Should AI agent visits be treated as bots in GA4?▾
If my own database is the source of truth, can I stop worrying about bots and internal use?▾
Before Reading the Numbers, Check the Page's Foundations
Enter a URL to check 45 items — titles, structured data, things that block indexing — and see whether the page is communicated correctly to search. It's the foundation for the search numbers you'll treat as the source of truth.
Open the SEO Score Check
Written by
今井政和SEO Director / Frontend Developer
SEO Director with 20+ years of web industry experience. Creator of Direbase and the official WordPress plugin "ORECTIC SEO CHECK." Author of a book on web strategy inspired by Edo-era merchant principles.
@imai_directorRelated Articles
What Is google.com/goto? What the Search Redirect Changes and What It Does Not
A read on the passthrough URL Google now inserts into result links: nothing to change on your site, no ranking impact, but real effects on rank tracking and GA4 — and how to verify them in your own data.
How to Verify SEO Results in Search Console | Practical Improvement Cycle Guide
Learn how to read impressions, clicks, CTR, and position in Google Search Console to properly verify your SEO improvements. A practical guide to the improve → verify → discover cycle.
How to Find SEO Improvements with GA4 | Analytics × SEO Audit Guide
Discover SEO issues through GA4 landing page reports and engagement rates, then pinpoint causes with an SEO audit tool.
Re-picking the Articles in llms.txt Every Month from GA4 AI Referrals | A Four-Month Log
Four months of rebuilding the "most-referenced by AI" list in llms.txt from GA4 AI referrals. Over half the list turned over each month, and picking by count alone let in off-topic pages. What GA4 AI referrals do and don't count, and why we can't claim an effect.