Written by Ram Kr Shukla, SEO and growth consultant, Google Analytics certified

One Indian cosmetics store I audited had a blog that looked fine on the traffic chart. Over four weeks it logged 11,479 blog sessions. The average session lasted 11 seconds. When I split the blog landing pages by country, roughly 91% of those sessions behaved like nobody I’d want to sell to. They arrived, did nothing and left within about four seconds.

Spam referrers and ghost hits get most of the attention in bot guides. This is a different animal. It’s automated traffic that loads your real pages, runs your GA4 tag and sits in your reports as sessions. GA4’s own filter doesn’t catch it. And half the advice online sends you looking for a settings checkbox that GA4 doesn’t have.

Below you’ll get the profile that gives these visitors away, the GA4 views that separate them from your readers, an honest list of what GA4 can and can’t filter, the fixes that live outside GA4, and how to re-rank your content once you can see who’s reading. If you’d rather have it set up properly on your own property, that’s part of my GA4 conversion tracking service.

Two related posts cover the edges. My Shopify GA4 funnel audit treats bots as one step out of eight, inside a wider tracking check, and the free GA4 funnel checker runs its order test for you. And if your organic numbers are off for other reasons, like URL parameters overwriting the source, read why your organic traffic numbers are lying to you first. This one stays on the bots and goes much further.

What GA4 Already Removes, and What It Can’t

Google’s help page on known bot-traffic exclusion is short. GA4 automatically drops traffic from known bots and spiders. It decides what counts as known from Google’s own research plus the International Spiders and Bots List, which the Interactive Advertising Bureau maintains.

Two lines on that page matter more than the rest. You can’t disable the exclusion. And you can’t see how much traffic it removed.

So there’s no before and after. You’ll never know whether GA4 dropped 5% of incoming hits or half of them. All you get to work with is the residue: traffic that wasn’t on the list.

Why the bots left in GA4 are the convincing ones

Think about what it takes to appear in GA4 at all. The GA4 tag is JavaScript. A basic scraper that requests your HTML and parses it never runs that script, so it never creates a session. The automated traffic you do see came through something that executed your page the way a browser would. Headless browsers, preview and monitoring services, scrapers built on a browser engine.

That’s why it looks plausible at first glance. Each session has a device category, a browser and a country. It just never reads anything.

The checkbox that isn’t there

A lot of guides still tell you to tick a box called something like “Exclude all hits from known bots and spiders”. That was a view setting in Universal Analytics. GA4 has no views and no such box. The exclusion is permanently on. If an article sends you into Admin to switch it on, it’s describing the old product.

What a Bot-Heavy Blog Looks Like in GA4

Here’s the store’s blog landing page data for a window of just under two weeks, split by country. These are GA4’s own numbers with the store anonymised.

Blog landing page sessions, one D2C beauty brand on Shopify, under two weeks. Anonymised client data.

Read the table from the bottom up. The home market sent 871 sessions and a third of them engaged. People stayed about a minute and a half on average. Four of them bought something.

Now the United States. Almost seven times India’s sessions, for a store that sells to India. About one session in 59 engaged. The average visit lasted 3.9 seconds. Zero purchases.

The smaller rows are stranger still. Argentina averaged 0.04 seconds per session, which is 40 milliseconds. Romania’s 72 sessions didn’t produce a single engaged one. Singapore’s 538 averaged 1.4 seconds.

Add up all seven rows and you get 7,992 sessions. India is 871 of them, about a ninth. Yet India has 288 engaged sessions against the US’s 102. The market with a ninth of the traffic produced close to three times the attention.

That’s where the 91% figure comes from. It’s an estimate, and it’s a blunt one: it treats the home market as human and nearly everything else as automated. Some of those 102 US engaged sessions are probably real people. That doesn’t change a single decision you’d make from this table.

The Tell-Tale Profile: Four Numbers on One Row

Any one of these numbers on its own can be innocent. All four together, on the same country or source or landing page, is the profile.

Once a row matches, a few secondary checks help you confirm it. These are common patterns in general, not readings from this store:

• Session source / medium. Bot traffic often lands as (direct) / (none), or from a referrer you’ve never heard of.
• City. Swap Country for City and see whether the sessions pile into a handful of places. Big cloud and data centre hubs show up this way.
• Views per session. Stuck at almost exactly 1.0 across hundreds of sessions.
• Shape over time. Sessions arrive in blocks on a few old posts, hold for days, then vanish.

The thresholds are judgement. On your site, “under 4 seconds” might need to be “under 6”. What gives bots away is the size of the gap. India averaged 89 seconds and the US averaged 3.9. That’s a ratio of about 23 to 1. Real audiences in different countries don’t differ by that much.

How to Find the Real Readers in GA4, Step by Step

This works in any GA4 property. I’ll use a Shopify blog as the example because Shopify puts every article under /blogs/ in the URL, which makes blog landing pages easy to isolate.

On step 1: if your tags were fixed recently, read why GA4 comparisons show fake growth after a tracking fix before you compare any two periods. On step 2: Google’s GA4 dimensions and metrics reference defines engaged sessions and engagement rate exactly, if anyone in the room argues about what they mean.

A practical limit on step 2. Explorations only reach back as far as your data retention setting allows. Standard properties can keep event data for 2 or 14 months, so if yours is still on 2 months, you can’t explore last spring’s bot wave at all. Standard reports aren’t affected.

Building the Home Market View Without Losing Real Readers

A home market filter is blunt. It works because most of a D2C store’s buyers live where it ships. It also hides real readers abroad: people living overseas, people researching before a trip, customers of stores that do ship internationally.

So keep two numbers side by side.

• Primary: home market sessions and engaged sessions. This is what you report and plan against.
• Secondary: engaged sessions across all countries. Engaged sessions already drop most bot visits, because a four-second, one-page visit with no key event doesn’t qualify. The US’s 102 engaged sessions may include real readers, and this number keeps them.

If the secondary number climbs while the home market stays flat, look closer. Some bots scroll, wait and request a second page. Engaged sessions catch most bots, but some get through.

Comparison or segment?

Comparisons sit on top of the standard reports and follow you from report to report. They don’t change any data, and you can save up to 200 of them per property. Country is one of the dimensions you can build them on, so “Country exactly matches India” next to “All users” takes about a minute.

Segments live in Explore. Use one when you need landing page by country breakdowns, more rows, or several conditions at once. Pick session scope, so you get the sessions that match rather than every session a matching user ever had. Saved at property level, everyone on the account can apply it.

My habit: the comparison for weekly reporting, the segment for any analysis that feeds a content decision.

What You Can and Can’t Filter in GA4

This is where most guides overpromise. Here’s every tool GA4 gives you that touches unwanted traffic, and what each one really does.

Sources: Google Analytics Help pages linked in the text below.

Google lists three data filter types: developer traffic, internal traffic and web hostname traffic. There’s no fourth type for bots, and no way to write your own. Per the internal traffic guide, you get at most 10 data filters per property and each one takes 24 to 36 hours to apply.

Two more rules. Data filters only work from the moment you create them, so your history keeps every bot it already has. And their effect is permanent: excluded events are never processed, in GA4 or in BigQuery. Each filter has a Testing state that tags matching events with a Test data filter name dimension, so you can check what it would remove in an exploration before you switch it to Active. Use it.

Can you use the internal traffic rule to block bots?

People try. The internal traffic rule matches on IP address, so in theory you could list a data centre’s ranges as “internal” and exclude them. Three problems with that.

1. GA4 doesn’t show you visitor IP addresses, so you’d be guessing the ranges from somewhere else.
2. Cloud IP ranges shift, and real people browse through VPNs and office networks that exit through those same ranges.
3. The exclusion is permanent. Every wrong range deletes real sessions for good.

Web hostname filters and unwanted referrals

The web hostname filter is the newest of the three. It’s useful for one kind of junk: events that hit your measurement ID from domains that aren’t yours. It does nothing about a bot loading your real pages on your real domain, because that hostname is correct.

Unwanted referrals tells GA4 to ignore a domain as a traffic source. It’s for payment gateways and similar hops that would otherwise steal credit. It doesn’t remove a single session.

The engaged session timer

One more setting people reach for. You can change the 10 second timer for engaged sessions in your web stream’s tag settings. Raising it doesn’t separate bots from people. It moves the bar for everyone, and your engagement rate stops lining up with earlier periods. Leave it alone unless you have a reason that has nothing to do with bots.

Fixes Outside GA4: Server, CDN and Platform

If bots cost you something real, such as server load, scraped content or form spam, the fix sits in front of your site. It has to act before the GA4 tag ever runs.

CDN bot management

Most CDNs sell some form of bot management. Cloudflare is a common example, and its bot products come in three tiers: Bot Fight Mode on the free plan, Super Bot Fight Mode on Pro and Business plans, and Bot Management for Enterprise customers, which adds per-request bot scores and custom rules.

Read the caveats before you switch anything on. Cloudflare’s own Bot Fight Mode docs say it may challenge API or mobile app traffic, and you can’t skip it with WAF custom rules. If your store talks to apps or feeds through that domain, test first.

Verify before you block anything that claims to be Google

Some bad bots pretend to be Googlebot. Google’s guide to verifying Googlebot gives you two ways to check: a reverse DNS lookup on the IP that should resolve to googlebot.com, google.com or googleusercontent.com, followed by a forward lookup that should return the same IP. Or match the IP against the crawler ranges Google publishes as JSON files. Block the impostors and leave verified Googlebot alone.

robots.txt won’t do it

It’s tempting to disallow the noisy bots in robots.txt. Google’s robots.txt introduction is clear that obeying the file is up to each crawler. Googlebot and other reputable crawlers follow it. The bots running up your GA4 sessions mostly won’t.

Hosted platforms like Shopify

On Shopify you don’t run your own CDN or server, so most of the above isn’t yours to configure. Shopify’s own bot protection feature is about checkout. It targets auto-checkout bots during scarce product drops, you request it through Shopify Plus Support, and each protection event runs for 60 minutes at most. It won’t touch blog sessions.

On a hosted store, the practical answer is the GA4 segment from the steps above. That’s what I recommended for the store in this post.

Server-side tagging

If you run server-side tagging, you can drop requests that look automated before they reach GA4. It’s a real option for bigger stores, and it comes with a server to maintain. Run any bot scoring in a test mode first and compare the output with your segment, because a false positive deletes a real customer’s session.

Don’t block the bots you want

Search engines and AI assistants fetch your pages too, and some of them send visitors back. If you’re tracking ChatGPT and Perplexity referrals in GA4, blocking their crawlers is a business decision. Make it on purpose, separately from your bot clean-up.

Re-Rank Your Content on Engaged Sessions

Bot traffic does its real damage in the content plan. A report with inflated sessions is annoying. A content calendar built on them wastes months.

The store’s busiest blog post in that window, a post about makeup for one skin concern, had 1,261 sessions. Thirteen were engaged, at 4.6 seconds on average. A skin type explainer had 233 sessions. Ninety-two of them were engaged, at 57 seconds.

Sort the blog by sessions and Post A goes to the top of every refresh list, every internal linking plan and every “do more of what works” meeting. Its engagement rate was about 1%. Post B’s was about 39.5%. Visit for visit, a session on the explainer was roughly 38 times more likely to involve someone reading.

Over a full four weeks the pattern held, and it got stranger. These are all-country numbers, so they still carry bot noise, which is exactly the point:

All countries, one D2C beauty brand on Shopify. Anonymised client data.

The first, third and fourth posts converted nothing. Two of them averaged zero seconds. Meanwhile the little explainer at the bottom held people for 42 seconds and almost nobody found it.

Effectively there were two blogs on one domain. One pulled traffic and had no readers. The other had readers and almost no traffic. The posts people read properly were the ones search was barely sending anyone to, which makes it a ranking and topic problem. Nothing about conversion rate optimisation fixes that.

A ranking method that holds up

1. Filter to your home market, or apply your segment.
2. Sort by engaged sessions. It rewards posts that get both volume and attention, which neither sessions nor time does alone.
3. Break ties with average engagement time, and ignore it on posts with fewer than about 30 sessions. One long visit can swing a small post’s average. The 28-session post at 42 seconds is promising, and it needs more sessions before you bet a month on it.
4. Add commercial signals: add to carts, purchases and key events. Same-session purchases undercount a blog badly, so read how to measure blog assisted conversions in GA4 before you judge a post on orders.
5. Pull in Search Console. Add non-brand impressions, clicks and position per post. Search Console counts clicks from Google results, so automated page loads don’t inflate it the way they inflate GA4 sessions. The split matters, as I explain in branded vs non-branded search traffic.

Then sort each post into one of four buckets:

That second check is the quickest sanity test I know. If GA4 says a post had 1,300 sessions and Search Console shows a few dozen clicks for the same page and window, the extra traffic didn’t come from search. Don’t refresh that post for SEO.

What Bots Do to the Numbers You Report

Ranking is one casualty. The numbers you put in front of a founder or a client are the others.

• Blog conversion rate. India’s 4 purchases over India’s 871 sessions is 0.46%, a normal blog number. Put the same 4 purchases over all 7,992 sessions in the table and it’s 0.05%. Nine times worse, purely from the denominator.
• Engagement rate. Thousands of four-second sessions drag the site average down, so a real improvement in reader engagement can disappear inside it.
• Growth. A bot wave looks exactly like a traffic win on a sessions chart. Somebody will want to know what you did right.
• Market mix. The country report quietly suggests the US is your second market. It isn’t.

The habit that protects you: state the denominator every time you quote a rate. I go further into reporting traps in vanity metrics vs revenue in e-commerce SEO reports, and the budget question of blog against category pages is in blog traffic vs category traffic.

When Low Engagement Isn’t Bots

Before you write off a segment, rule out the boring explanations.

• Your tag is broken. If your home market looks as bad as everyone else, suspect the tracking before the traffic. Bots don’t usually spare one country.
• The page answers fast. A page that gives a one-line answer can satisfy people in under 10 seconds. It’ll usually have Search Console clicks to match its GA4 sessions, which bot magnets don’t.
• A real overseas audience. Real readers abroad look like your home market with smaller numbers: similar time, similar engagement rate. Bots look nothing like it.
• Accidental ad taps. Paid social clicks that land on a blog post by mistake bounce in a couple of seconds. Check the channel before you call it automated.

If you’d like a second pair of eyes, my behaviour analytics work covers exactly this kind of read on real visitor behaviour.