Filtering bot traffic in GA4 using server-side GTM and Stape’s Bot Detection

GA4 bot filtering is essential for keeping your analytics data clean, and recently, site owners have been increasingly faced with strange, unwanted traffic in Google Analytics 4 reports. The most common problem is referral spam with suspicious sources and geolocation "Poland". The source sites of such traffic are usually the same: news.grets.store, statis.seders.website, trast.mantero.online, ofer.bartikus.site. If you have already encountered them, you are not alone.

Google Analytics recommends adding these sites to the List of unwanted referrals. But in fact, this does not solve the problem; it only changes the traffic category to "Direct," leaving spam in your analytics. Another issue is that GA4 cannot filter traffic by referrals, only by IP addresses.

In this article, we will examine spam through the Measurement Protocol, the types of spam that occur most often - particularly referral and event spam - and, most importantly, how to stop bot traffic on the website and protect your data in the GA4. 

Google Analytics is the most popular web analytics tool millions of users use. Referral spammers hope that when you go to Google Analytics and see traffic from unknown websites, you will be curious to see what they are. It is one of the grey ways of getting traffic. There are multiple ways of monetization: redirecting to any affiliate offers or directing to a landing page offering to buy something, download software, promote a marketing agency, or any other service. 

Spammers need to know your Google Analytics ID to send fake hits to your GA account. But sometimes, they don't even bother themselves with finding real Google Analytics IDs. Spammers may generate fake IDs in large quantities and hope that some of them are real GA identifiers. An automated script sends false data to GA accounts using measurement protocol. 

Because of ghost spam, you cannot see the real data about your website visitors since fake traffic is mixed with organic. Ghost spam affects all GA metrics: number of visits, bounce rate, average session duration, etc. 

It can also lower your organic ranking since search engines can interpret spam traffic as attempts to increase your SEO positions by using grey technologies. 

GA4 bot filtering helps exclude automated, non-human traffic from your analytics reports. By default, GA4 filters out known bots and spiders based on the IAB/ABC International Spiders and Bots List. However, this built-in filtering is limited and doesn't cover all types of bot traffic, especially newer spam sources.

The main limitation is that GA4 can filter traffic only by IP address. As a result, GA4 bot traffic and referral spam can still slip through and continue to pollute your analytics data.

To solve this problem, you can turn on the Bot Detection power-up. It scores each request from 0 to 100. Requests between 50 and 75 are only flagged because some checked parameters do not fully confirm bot behavior. Requests above 75 are blocked if blocking is enabled, as all parameters show clear bot activity.

This power-up automatically checks whether each incoming request comes from a bot (e.g., referral spam, automated scripts). It can detect and block suspicious requests before they reach your server or analytics tools. When enabled, it adds two headers to every request: 

• X-Device-Bot (returns true or false)
• X-Device-Bot-Score (a score ranging from 1 to 100, with 100 indicating a high likelihood of bot traffic)

Next, by creating a Request Header variable for these headers in your sGTM container, you can leverage bot detection signals to filter out unwanted or suspicious traffic. For example, you can block GA4 or other tags from firing if the request is identified as bot traffic.

Benefits of Bot Detection power-up:

​​1. More accurate analytics data

2. Better security and protection from fraud

3. Easy to set up and manage

Once activated, with all requests to the server, you will receive two additional parameters, X-Device-Bot (true or false) and X-Device-Bot-Score (a score between 1 and 100 probability of a request from a bot) in the request headers with each request:

Then you can simply add this as an additional check to the triggers on the server container:

1. 1.
   On the server container, create a variable with the type 'Request Header' and specify 'X-Device-Bot' to receive the value of this header.
2. 2.
   Use this variable as an additional check in your GA4 trigger on the server and also in any other triggers where you want to limit the impact of bot traffic:

Now, if the request is determined to be from a bot - your tag will not trigger, and the data will not be sent.

You can also combine this setup with the Block Request by IP power-up.

It lets you block requests coming from up to 30 chosen IP addresses.

This way, you can filter out internal traffic from your team and block traffic if you notice bots coming from a specific IP address, keeping this data out of GA4 and other platforms.

If you use Cloudflare and, like everyone else, have a specific country from which spam traffic comes (most of it is from Poland), you can activate Bot Check for IP addresses from Poland. 

This is a good solution, but only if you have no real visitors from the location of the spam traffic. Otherwise, you will definitely affect the number of real visits from there.

Besides, Cloudflare also provides the following features to block bot traffic:

• Known bots - will exclude the traffic from the Cloudflare’s list of bots.
• Verified bot category - exclude bot traffic from the listed categories.

If the referral contains your spam domains, you can add an exception trigger for your GA4 tags. It is quite easy to do this:

• Make sure you have the referrer variable enabled in your built-in variables.

• Create a new Custom Event trigger that will work for any event (.* via regex will be responsible for this) and specify an additional condition for the trigger that the referrer matches regex your spam domains. In regex you can specify 'or' with | without spaces.

For example: news.grets.store|static.seders.website|another.domain

• Add this trigger as an exception to your GA4 tags and publish the changes on your container.

Thus, the exception trigger will prevent the tags from working if the referral contains one of your spam domains, and this data will not be included in GA4.

Referral and event spam in Google Analytics 4 is a serious problem that distorts statistics and can damage your SEO strategy and data-based solution. Unfortunately, the built-in GA4 mechanisms currently do not allow the filtering of such traffic by referral sources effectively.

Now, if the request is determined to be from a bot - your tag will not trigger, and the data will not be sent.

This matters most for tags that feed ad platforms directly. Left unfiltered, bot traffic doesn't just distort your GA4 reports – it gets forwarded to Google Ads and Meta as real conversions, training their bidding algorithms on traffic that will never buy. For a full setup that extends this filtering to ad bidding data specifically, see A practical guide to bot-proofing your ad bidding.

The most important thing is not to ignore GA4 bot traffic. The sooner you implement basic protection, the more accurate and useful your reports will be. And if you also switch to server GTM, you will get not only protection, but also additional advantages: cleaner data, better site speed and more control over analytics.

If you do not know where to start - try to test at least one of the solutions described in this article. You will see how your analytics will change in a few days.