How to Detect Bot Traffic on Your Website and in GA4

Detecting bot traffic means finding the visits no real customer would make, such as zero-engagement sessions, sudden Direct spikes and paid clicks that never buy, and confirming them in your server logs or with a tool that scores every visit.

Every site gets some. The useful questions are how much, where it comes from and whether you pay for it. Bots that click your ads are billed. Bots that run your tracking code land in your reports as sessions that never buy, so your conversion rate looks lower and your CPA higher than they really are.

This guide starts with a five-minute check in Google Analytics 4, moves on to a deeper exploration and your server logs, explains why GA4's built-in bot filter misses most of it, and ends with how bot detection works and what to do once you've found bots.

What Is Bot Traffic Detection?

Bot traffic detection is telling automated visitors apart from real people, using patterns in your analytics, your server logs or a score per visit.

A bot is software that visits your site on its own. Some are useful, like the crawlers that put your pages in search results. Others click your ads, fill your forms with junk or inflate your sessions. For the full picture, see our guide to bot traffic.

Detection isn't the same as blocking. Detecting means knowing a visit was automated. Blocking means refusing to serve it, which is the job of a firewall or your hosting provider. Filtering means removing it from your reports afterwards. Most sites need all three.

Bots also differ widely in effort, and each kind leaves different traces.

The first two rows are easy to find. The last three are the ones that cost advertisers money, because they run your tags and click your ads. Our guides to the main types of bots, bot farms and click farming go deeper on each.

How much of your traffic is bots? Every widely quoted figure comes from a company that sells bot protection, so treat those numbers as marketing. Your own share depends on your traffic sources and ad channels, and the checks below measure it on your site.

How Do You Know If Your Website Has Bot Traffic?

The usual signs are sessions with zero engagement, spikes in Direct traffic, visits from places you don't sell to and paid clicks that never convert.

None of these proves bots on its own. Real people misclick, leave fast and travel. What gives bots away is a pattern: many sessions sharing the same oddity, often starting on the same day.

• Sessions that last zero seconds and view one page, in large numbers, from one source.
• A Direct spike with no cause. No email, press mention or campaign explains it.
• Countries or cities you never target climbing your location report.
• Paid sources with far lower engagement than organic. Same landing pages, very different behavior.
• Traffic that stays flat day and night, or bursts at 3 AM that stop on the hour.
• Form fills with junk data: fake names, throwaway email addresses, the same message repeated.
• Sessions rising while sales stay flat, especially from one campaign or placement.

If you see two or three of these at once, it's worth the deeper checks below.

How Do You Find Bot Traffic in GA4?

Compare engagement by source in Traffic acquisition, then stack country, device and source in an exploration to find combinations no customer makes.

The Five-Minute Check

Open Reports, then Acquisition, then Traffic acquisition. Set the table to Session source / medium and sort by engagement rate. Look for:

• A source with average engagement time near zero seconds.
• A source sending real volume with an engagement rate far below the others.
• Sources you don't recognize sending hundreds of sessions.

GA4 counts a session as engaged only if it lasts longer than 10 seconds, has a key event or has two or more page views. A one-page, zero-second bot visit fails all three. So a source full of bots shows an engagement rate near 0% and a bounce rate near 100%.

The Thirty-Minute Check in Explorations

Standard reports show one dimension at a time. Bots give themselves away in combinations, so build an exploration.

1. Create a free form exploration. Go to Explore and start a blank free form. Add the dimensions Country, Device category, Operating system, Browser, Screen resolution, Session source / medium and Hour. Add the metrics Sessions, Engagement rate, Average engagement time per session and Key events.
2. Stack the rows. Drag Country into Rows, then Device category, then Operating system. You're looking for groups such as "500 sessions from one city, all desktop, all one operating system, all Direct, 0% engagement". No single dimension is proof. The combination is.
3. Compare paid with organic. Filter on Session source / medium and set your paid sources against organic search. If your paid search visitors engage far less than organic visitors on the same landing pages, something other than people may be clicking those ads.
4. Check locations. Filter to countries you don't market to. Heavy, zero-engagement traffic from a country you never target is a classic sign. Watch cloud server hubs too: a visit placed in Ashburn, Virginia, home to one of the largest concentrations of cloud servers in the US, may be a server rather than a person.
5. Check the hours. Put Hour in the rows. Real audiences follow a daily rhythm. Bot traffic often runs flat around the clock, or arrives in bursts at fixed intervals.
6. Check the key events. For each suspicious group, look at purchases and other key events. Sessions that keep rising while key events stay at zero rule out a new audience.

Then size it. Compare your total sessions with and without the suspicious groups over the last 90 days. If the share is large, every rate that divides by sessions has been distorted for that long.

What Bot Traffic Looks Like in GA4

Linux deserves a word. Few shoppers browse on a Linux desktop, but it's the standard system on cloud servers. A paid source where Linux desktops suddenly show up in volume is worth a close look.

A recent example of these patterns at scale is the wave of visits placed in Lanzhou, China and in Singapore since late 2025, covered in our guide to bot traffic from China and Singapore. Store owners can also check GA4 against their store's own reports with our guide to Shopify bot traffic.

Want a directional read on how much of your GA4 traffic is real? Run the free GA4 check. Read-only, no signup required.

Why Doesn't GA4 Filter Out All Bot Traffic?

GA4 removes only known bots on Google's and the IAB's list. Bots posing as normal browsers aren't on it, and you can't see what the filter removed.

GA4 excludes known bot and spider traffic automatically, identified through Google's research and the International Spiders and Bots List kept by the IAB. You can't switch that filter off, and you can't see how much traffic it removed.

The key word is known. The list covers bots that announce themselves, like search engine crawlers and monitoring services. A bot built to look like a person never announces itself, so GA4 counts it as a user. The bots that cost advertisers money are exactly the ones a list of known bots can't catch.

Even dedicated tools struggle with hidden bots. In an independent 2025 test by Adalytics, 77% of hidden bots passed as human with a leading ad verification tool.

Two more limits are worth knowing.

Data filters can't do it. GA4's data filters cover developer traffic, internal traffic by IP address and unwanted hostnames. None of them works by country, source or behavior. They also apply only from the day you create them, so past data stays as it was.

Some bot hits never touch your site. Your GA4 measurement ID sits in plain view in your page code. Anyone who copies it can send hits straight to Google's collection servers, so sessions appear in your reports for visits your server never received. If those fake hits carry a hostname that isn't yours, the web hostname filter can drop them from then on.

So the cleanup happens in the reports you read. Add a comparison or report filter to your standard reports, build a segment in Explorations that excludes the patterns you found, and filter the same way in Looker Studio or BigQuery so every dashboard is clean. Note the date the bot traffic started, so year-over-year comparisons account for it. These filters change what you see, not what reaches your site.

How Do You Check Server Logs for Bots?

Server logs record every request, including bots that never run your tracking code. Look for request floods, admin page probes and missing files.

GA4 only sees visitors that run its tag. Your server or CDN sees every request, so its logs catch the simple scripts GA4 never records. Most hosting platforms and CDNs show requests by country, network and browser name in their dashboards, and raw logs from Apache or Nginx hold the same detail line by line.

What to Look For

• Request rate. One IP address sending hundreds of requests a minute is automated. People don't browse that fast. Sort by IP address and count requests per minute.
• Probes of pages no visitor would find. Thousands of requests to /wp-login.php, /xmlrpc.php, /.env or /admin are automated scans looking for weak software.
• Missing page files. A real browser that loads a page also requests its stylesheets, scripts, images and fonts. A visitor that asks only for the page itself isn't using a real browser.
• Browser names. Every request carries a name for the browser that sent it. Search engine crawlers name themselves honestly. An empty name, or a bare generic one, is a script. Our web crawler list covers the legitimate crawlers you'll see.

Compare One Day of GA4 With Your Logs

This tells you which kind of bot you have.

1. In GA4, note the sessions from a suspicious source or country for one day.
2. In your hosting dashboard, CDN analytics or server logs, find requests from the same source on the same day.
3. If the logs show the visits, the bots load your pages, and a firewall rule can stop them.
4. If GA4 shows sessions your logs don't have, the hits went straight to Google Analytics, and only a reporting filter or the hostname filter will remove them.

Where Logs Fall Short

Logs catch the basic bots. The expensive ones use a real browser that loads every file, and they rotate through home and mobile connections, so each log line looks ordinary. Logs are also after the fact.

How Do Bots Show Up in Your Google Ads and Meta Data?

A bot that clicks your ad is billed and lands in your paid channel. It never buys, so it lowers your conversion rate and can feed early-step goals.

A bot that clicks a Google ad carries its click ID, the GCLID, so GA4 files it under Paid Search, not Direct. A Meta click counts as paid in GA4 only through your UTM tags, because GA4 doesn't read Meta's fbclid. That's why paid traffic is the first place to look if you advertise. Here is what bots do and don't do in your ad data.

The split that matters is your campaign's goal. If you optimize for purchases, bots cost you the clicks and distort your reports, but they can't teach the bidding anything. If you optimize for landing page views, add to carts or leads, bots can feed the goal itself, and the platform hunts for more of them. Lead generation teams see the form spam version of this, which we cover in what invalid traffic is.

Google filters out the invalid clicks it catches and doesn't charge for them, and credits you if it finds some after billing. The ones it misses are billed like any other.

Checks in Your Ad Accounts

• Clicks against sessions. If Google Ads reports far more clicks than GA4 shows paid sessions, some clicks never loaded your tag. Bots that don't run scripts are one cause; people who leave before the page loads, and visitors who decline tracking, are others.
• Locations. In Google Ads, open the locations report and compare where clicks came from against where you target. Check that your location option is set to Presence, which reaches people in your locations rather than people who've shown interest in them.
• Placements. On Display, Performance Max and Meta's Audience Network, review the sites and apps that send clicks with no sales.
• Breakdowns in Meta. Break results down by country, placement and device, and look for groups with clicks and no purchases.

Our guides to Google Ads click fraud, Facebook and Meta ad fraud and click bots walk through each platform in detail.

How Does Bot Detection Work?

Bot detection checks each visit's browser, behavior and connection for details that don't add up, ideally while the visit is still happening.

Bot detection of this kind runs a small script on every page and looks at each visit from several angles at once.

The browser. Every browser describes itself: device, screen, system and the features it supports. Detection checks whether that description adds up. Think of checking an ID at the door. If the photo shows a 25-year-old and the birth date says 1950, something is off, even if the card looks real.

Behavior. People scroll at uneven speeds, pause, hesitate and correct themselves. Scripts often move with mechanical precision, or don't move at all. This isn't about tracking who someone is. It's about spotting movement no person makes.

The connection. Most shoppers browse from home or mobile networks. A visit from a cloud server is more likely to be automated. A VPN alone proves nothing, since plenty of real people use one, but combined with other odd details it adds weight.

Consistency. This is the part that catches the clever bots. A bot can fake its device, its screen size or its location one at a time. Keeping every detail consistent with every other detail, all at once, is much harder. It's like lying under questioning: one invented detail is easy, but every extra question raises the odds the story stops adding up. Good detection doesn't need to catch a bot on any single check. It needs one contradiction in the full picture.

During the Visit or Afterwards

Detection after the visit analyzes logs hours or days later. By then the fake lead is in your CRM and the bot's events are in your reports.

Detection during the visit scores the session while it happens, so your tag manager can act on the verdict before the bot's next page view, add to cart or form fill reaches your goals. The click is billed either way. What changes is that the bot stops counting as a result, and you see by source and campaign which ads attract bots.

How the Methods Compare

For a closer look at the challenge row, see CAPTCHA vs bot detection.

Do You Need a Bot Detection Tool?

You need one when free checks stop explaining the gap between clicks and sales, or when ad spend is high enough that unknown bot clicks matter.

Free checks have a ceiling. You've probably hit it if:

• You spend thousands of dollars a month on ads and there's a gap between clicks and conversions you can't explain.
• Paid sessions look clean on the surface, with reasonable time on site and a few page views, yet never convert. That's the signature of better click bots and click farms.
• You've added IP and location exclusions, and the problem keeps coming back from new addresses.
• Your Google remarketing lists built from page views grow much faster than your customer base.

Questions to Ask Any Vendor

1. Does it score visits during the visit, or analyze logs afterwards?
2. Does it show why a visit was flagged, with a score, or only a bot or human label?
3. Does it show bot share by source, medium and campaign, so you know which sources to cut?
4. How does it treat VPN users, privacy-focused browsers and budget phones without flagging real customers?
5. What does setup take: one script on your pages, or changes to your server code?
6. Does the verdict reach your tag manager, so your own setup can act on it?

A vendor that can't answer these clearly is telling you something. For a side-by-side look at the tools built for paid media, see our roundup of click fraud software.

How Do You Stop Bot Traffic Once You Find It?

Stack fixes: firewall rules for the sources, ad platform exclusions, goals bots can't fake, and a verdict on every visit that your tags can act on.

Bots are built to slip past any single defense, so combine several, on top of the report filters from your GA4 checks.

Stop It at Your Site

Your hosting or CDN firewall can refuse traffic before your page loads. Add rules for the networks and countries the bots come from if you don't sell there, limit how many requests one address can make per minute, and put a challenge on forms that attract spam. These rules stop the bots that load your pages. They don't stop hits sent straight to GA4, and they don't catch bots that use home connections in your own market.

Tighten Your Ad Accounts

• Google Ads. Set your location option to Presence. Exclude IP addresses that keep coming back: you can exclude up to 500 per campaign. Treat that as a patch, because bots rotate addresses. Exclude placements that send clicks but no sales.
• Meta. Review results by placement, and turn off Audience Network if it sends clicks with no purchases.
• Every platform. Cut the sources and placements that keep failing your checks, and move that budget to the ones that sell.

Optimize on What Bots Can't Fake

Bots can fire a page view, a view content event and sometimes an add to cart. They can't complete a purchase. Optimizing on purchases or qualified leads, rather than early steps, keeps the bidding from counting bots as results. You still pay for every bot click, but the platform stops chasing more of them.

Let Your Tags Act on a Verdict

If a detection tool scores each visit while it happens, your tag manager can use that score. Your own setup can keep flagged visits out of page-view, add-to-cart and form-fill goals, while purchases need no rule because bots never make them.

Keep the Evidence

Google Ads and Microsoft Advertising accept invalid-click investigation requests for clicks within about 60 days. A record of which paid clicks were bots, by source and campaign, supports a claim. The platform decides any credit. Our guide to ad fraud prevention covers the wider set of defenses.

Check Every Month

Operators move to new networks and new campaigns get hit. Compare paid engagement with organic every month and track the gap between clicks and conversions.

What Should You Do First?

Run the five-minute GA4 check, build the exploration, compare GA4 with your logs, then check your ad accounts before you change any budget.

1. In Traffic acquisition, compare engagement for your paid sources against organic over the last 90 days.
2. Build the free form exploration with country, device, operating system, source and hour, and note every group with zero engagement.
3. Size the suspicious share of sessions, and add a segment that leaves it out of the reports you share.
4. Compare one day of GA4 sessions with your server or CDN logs to see whether the bots load your pages.
5. Check your Google Ads locations and placements, and your Meta breakdowns by country and placement.
6. Add firewall rules and ad platform exclusions for the sources you've confirmed.
7. Recalculate your conversion rate without the bot sessions before you cut a campaign or change creative because of it.

Step 7 is the one most often skipped. A conversion rate that dropped overnight looks like a failing campaign. Check what you're dividing by first. For how the industry classifies all of this, see what ad fraud is and what click fraud is.

Cut the sources that send bots and put that budget into campaigns that really sell. Hyperguard scores every visit while it happens, shows bot share by source and campaign, and hands the verdict to your tag manager, so your setup can keep bots out of your goals. Run the free GA4 check first, then see how Hyperguard works.