A spike in GA4 sessions feels like good news until you look closer. Engagement drops to nothing, every session lasts a second, and most of the traffic comes from a single country you don’t market to. That’s usually not an audience. It’s a crawler running a real browser.
This kind of traffic does real damage beyond a messy chart. It drags down engagement rate, distorts landing page reports, inflates the denominator in every conversion rate, and can push a small site over its hosting plan’s visit limits. Here is how we find it, confirm it and keep it out.
Why GA4 doesn’t filter it
GA4 excludes known bots automatically, but only the ones on industry lists. You can’t see what was excluded, and you can’t turn the filter off or extend it. Modern scrapers and AI crawlers often run headless Chrome, execute JavaScript and fire your tags like any visitor. To GA4, they are visitors.
GA4’s own filtering tools are also limited. Data filters only handle internal and developer traffic, based on IP rules or a traffic type parameter. They aren’t retroactive, and an active filter permanently drops data. That makes them a poor fit for bots that rotate through large IP ranges. Most of the real work happens outside GA4.
Signs you’re looking at bots
- A single country or city with a sudden jump in sessions.
- Engagement rate near zero and average engagement time of a second or two.
- Landing pages you’d never expect anyone to visit directly, like old calendar dates or filtered archive URLs.
- Traffic that arrives in bursts at regular times.
- Almost all of it reported as Direct, with no referrer.
- One browser version, one screen resolution or one operating system accounting for nearly every session from that source.
- No downstream activity at all: no form views, no scroll events, no conversions.
How to look for it in GA4
Start in Reports > Acquisition > Traffic acquisition and add a comparison for the suspect country. If its engagement rate is wildly different from everyone else’s, keep going.
Then build a free-form exploration in Explore. Use Country, City, Landing page + query string, Browser and Screen resolution as dimensions, with Sessions, Engaged sessions and Average engagement time as metrics. Set the date range to include a few weeks before the spike. Real traffic spreads out across these dimensions. Bot traffic clusters, and you’ll usually see it within a few minutes.
Look at the hour of day too. Real visitors follow local time patterns. Crawlers often don’t.
Where they come from
Some of the worst offenders are sites with huge URL spaces. An events calendar that links to every past and future month, a store with stackable filters, or a search page indexed by mistake can produce millions of unique URLs. Crawlers follow them all.
On WordPress, the usual suspects are:
- Event calendar plugins with month, week, day and list views, each with previous and next links that never stop.
- WooCommerce layered navigation, where every combination of color, size and price filter is its own URL.
- Internal search results pages that got linked or indexed somewhere.
- Tag and date archives nobody has looked at in years.
- Query string parameters such as sort orders or view modes that duplicate the same content.
Not all of this traffic is malicious. Some is AI training crawlers, some is price scrapers, some is SEO tools. The intent matters less than the effect on your reports and your server.
What to do about it
- Confirm it in server logs. Your host’s access logs show user agents and IP ranges, which GA4 doesn’t. Most managed WordPress hosts let you download logs from their dashboard. Look for the same URL patterns your GA4 landing page report flagged, then note the IP ranges and user agents hitting them. If the IPs belong to cloud and data center providers rather than consumer internet providers, that’s strong evidence.
- Block at the edge. A firewall rule at your host or CDN stops the traffic before it costs you server resources. Blocking by ASN or known bot signatures works better than blocking a whole country. In Cloudflare, for example, a custom WAF rule can match on the AS number and the URL path together, and apply a managed challenge instead of a hard block. A challenge lets the odd real visitor through and stops most automated traffic.
- Close the crawl trap. Add
noindexandnofollowwhere it belongs, and stop linking to infinite URL spaces. Disallow the parameter patterns inrobots.txtfor crawlers that respect it. - Clean your reports. Build a GA4 comparison or segment that excludes the affected country and landing pages, so historical data is still usable.
A few tradeoffs to know
noindex doesn’t stop crawling. A crawler has to fetch the page to see the tag. It helps with search engines over time but does nothing for bad actors.
robots.txt is a request, not a rule. Well-behaved crawlers follow it. The ones causing your GA4 spike often don’t.
Country blocks are tempting and usually wrong. You may have real customers or partners in that country, and the bot will often just move to infrastructure somewhere else.
Firewall rules need maintenance. Bot operators change providers. Plan to review the rules every few months, or whenever the pattern returns.
A common pattern
Sessions jump sharply over a few weeks, with almost all of the increase coming from one country outside your market. Engagement time on that traffic is close to zero, and nearly every landing page is an event calendar view for a date years in the past or future.
Server logs typically show a handful of cloud hosting networks requesting calendar URLs around the clock. The fix combines firewall rules for those networks on the calendar paths, removing the calendar’s links to empty months, disallowing the date parameters in robots.txt, and a saved exploration or Looker Studio report that excludes the affected traffic for the period before the fix. That stops the new traffic and keeps the old data usable.
Expect a couple of rounds. The first rules usually catch most of it, and a second wave from different networks often shows up a few weeks later.
What it usually takes
Diagnosis is often a few hours: pulling logs, building the exploration, matching the two. Blocking and closing the crawl trap is usually similar, depending on your hosting setup and whether the URL space comes from a plugin you can configure or code that needs changing. Ongoing monitoring is small but real. Someone should glance at country and landing page reports monthly.
The goal isn’t perfect numbers. It’s numbers your team can make decisions with.
When to bring us in
If your GA4 numbers have jumped and you can’t explain why, or you’ve confirmed bot traffic but can’t get it to stop, we can help trace it from the report to the server and close it off. We do this as part of our analytics and ad tracking work, often alongside the hosting team. Or send us a note with what you’re seeing.