Seth
Is This Real Traffic?
How We Diagnose Bot and Spam Activity in GA4
One of the more unsettling things a marketing team can find in Google Analytics is a traffic spike that makes no sense.
- Sessions suddenly increase.
- Engagement collapses.
- An unusual browser version appears.
- Thousands of visits come from one location.
- A strange screen resolution dominates the report.
- Form spam starts arriving at the same time.
The immediate conclusion is often:
“We are being attacked by bots.”
Sometimes that is correct. Sometimes it is not.
Suspicious traffic needs evidence.
The Challenge:
Strange Traffic Is Not Automatically Bot Traffic
Google Analytics 4 automatically excludes traffic from many known bots and spiders.
That does not mean every form of automated, unwanted, manipulated, or low quality traffic is guaranteed to disappear from your reports.
It also does not mean every unusual pattern is malicious.
Traffic can look strange for many reasons:
- automated systems
- browser privacy technology
- testing tools
- website monitoring
- internal activity
- development environments
- malformed campaign traffic
- referral spam
- legitimate users behind corporate networks
- data collection problems
The goal is not to label unusual traffic as quickly as possible.
The goal is to determine which explanation best fits the evidence.
The Goal:
Build a Pattern, Not a Hunch
No single dimension proves that traffic is automated.
- A suspicious screen resolution alone is not enough.
- An old browser version alone is not enough.
- A low engagement rate alone is not enough.
The confidence increases when several unusual characteristics appear together.
For example:
- Unusual Screen Resolution
- Unexpected Browser Version
- Extremely Low Engagement
- Thousands of Sessions
- Single Geographic Concentration
- Repeated Landing Page Behavior
is much more suspicious than any one of those characteristics independently.
That is how we approach the investigation.
Step 1:
Identify the Anomaly
We start by finding what changed.
That may be:
- sessions
- users
- engagement rate
- form submissions
- conversion rate
- country or region
- browser
- device
- landing page
- source and medium
- referral traffic
We compare the suspicious period against normal historical behavior.
The question is not only:
“What is high?”
It is:
“What changed from the site’s normal pattern?”
Step 2:
Break Traffic Into Smaller Dimensions
Aggregated traffic can hide useful clues.
We begin segmenting the suspicious sessions by dimensions such as:
- screen resolution
- browser
- browser version
- operating system
- device category
- country
- region
- hostname
- landing page
- source
- medium
- referral source
We are looking for concentration. Human website traffic is usually somewhat messy.
Visitors use different devices, browsers, locations, screen sizes, and navigation paths.
Automated traffic often produces unusually repetitive characteristics.
Step 3:
Look at Engagement
Engagement is one of the strongest contextual signals.
A large volume of sessions with almost no engagement deserves investigation.
We may compare:
- engagement rate
- engaged sessions
- average engagement time
- events per session
- pages viewed
- important interaction events
A pattern where thousands of sessions arrive and almost immediately disappear can indicate low quality or automated activity.
It is still not proof. It is one more piece of evidence.
Step 4:
Compare Browser and Device Characteristics
Automated traffic sometimes presents unusual technical characteristics.
That can include:
- repetitive screen resolutions
- old browser versions
- inconsistent browser and operating system combinations
- identical device characteristics across a large volume of traffic
- unexpected device categories
Again, we avoid treating any individual technical characteristic as definitive.
The important question is whether the pattern makes sense for the client’s normal audience.
Step 5:
Investigate Geography
Large traffic concentrations from a single state, region, or country can be useful clues.
We compare geography with:
- client target markets
- historical traffic
- campaign targeting
- employee locations
- hosting infrastructure
- known vendors
- form spam patterns
Unexpected geography combined with other suspicious signals strengthens the case for automated or unwanted activity.
Step 6:
Review Acquisition
Traffic source can dramatically change the interpretation.
We inspect:
- source
- medium
- campaign
- referral domain
- direct traffic
- paid traffic
- organic traffic
A sudden spike attributed to a strange referral source creates a different investigation than a spike attributed to direct traffic.
Campaign tagging errors can also make legitimate traffic appear suspicious.
Step 7:
Examine Landing Page Behavior
Automated traffic often behaves differently after arrival.
We may look for:
- one landing page receiving nearly all suspicious sessions
- repeated requests to forms or login pages
- paths unrelated to normal user journeys
- extremely shallow sessions
- unusual URL parameters
- repeated visits to technical endpoints
This helps determine whether the traffic appears to be browsing the website or simply interacting with a specific resource.
Step 8:
Compare Traffic With Form Spam
When suspicious browsing and spam form submissions happen during the same period, we compare the characteristics.
For example:
Traffic Spike
↓
Same Geography
↓
Same Time Window
↓
Same Landing Page
↓
Increase in Spam Forms
That relationship can strengthen the hypothesis that the activities are connected.
It still needs validation.
Correlation is useful evidence, not automatic proof.
Step 9:
Look Outside GA4 When Possible
GA4 is an analytics platform.
It is not a cybersecurity investigation platform.
When the issue is significant, other systems may provide stronger evidence.
Depending on available technology, that can include:
- web server logs
- CDN logs
- firewall data
- form logs
- CAPTCHA results
- CRM records
- security platforms
- hosting analytics
Those systems may reveal request frequency, IP patterns, user agents, rejected requests, or other technical details not available in standard GA4 reporting.
The Outcome:
Separate Suspicious Traffic From Usable Marketing Data
The objective is not simply to label traffic.
It is to determine what should happen next.
Potential outcomes may include:
- continue monitoring
- exclude development traffic
- correct campaign tagging
- strengthen form spam protection
- update referral configuration
- create reporting segments
- investigate infrastructure logs
- adjust security controls
- document the anomaly for reporting
We should avoid creating aggressive analytics filters simply because traffic looks strange.
Permanent filtering can create its own data quality problems.
Why This Matters for Marketing Teams
Bad traffic does more than inflate sessions.
It can distort:
- engagement rates
- conversion rates
- geographic reporting
- channel performance
- landing page reporting
- campaign analysis
- trend lines
- lead quality metrics
A dashboard can calculate these metrics perfectly and still tell the wrong story if the underlying traffic is poor quality.
That is why traffic quality is part of analytics quality.
What We Learned
One strange dimension is not proof.
Look for combinations of signals.
Compare against normal behavior.
An anomaly only makes sense relative to the website’s historical patterns.
GA4 is one piece of the investigation.
Server, form, security, and CRM data may provide additional evidence.
Do not filter first and investigate later.
Understand the traffic before permanently changing data collection.
Bot traffic and form spam may be related, but prove the connection.
Timing and shared characteristics can strengthen the case.
Analytics quality includes traffic quality.
Reliable measurement depends on understanding what generated the data in the first place.
GA4 Bot Traffic FAQs
Does GA4 automatically filter bots?
GA4 automatically excludes traffic from known bots and spiders identified through Google’s systems and recognized bot lists.
That does not mean every type of automated or unwanted traffic will necessarily be absent from reporting.
How can you identify bot traffic in GA4?
Look for combinations of unusual traffic characteristics, including abnormal engagement, repetitive devices, browser versions, geography, landing pages, sources, and sudden volume changes.
Does a low engagement rate mean traffic is a bot?
No.
Low engagement may be suspicious in context, but it is not proof by itself.
Should suspicious traffic be filtered from GA4?
Not immediately.
Investigate the cause first. Permanent filters can remove legitimate data if the assumptions behind them are wrong.
Can bots submit website forms?
Automated systems can submit forms.
If form spam increases during suspicious traffic periods, compare the timing and available technical characteristics across both datasets.
Good Analytics Requires Healthy Data
Analytics teams naturally focus on implementation.
Sometimes the tracking works perfectly and the real problem is the activity being tracked.
The Agency Co-Op helps organizations investigate analytics anomalies, measurement contamination, spam activity, and data quality issues so marketing teams can distinguish genuine performance changes from noise.
Before asking what the traffic did, sometimes we need to ask a more basic question.
Was it real traffic in the first place?