The three-signal fingerprint
Real traffic is messy. It arrives on a spread of pages, from a spread of places, and some of it hangs around. Automated traffic is tidy, and the tidiness is the tell.
Open the spike day in GA4 and check three dimensions. You are looking for concentration in all three at once — any one of them alone can happen legitimately.
- One page, or two. Real growth spreads across a template. A bot hits a single URL, or hits the homepage and one deep page it found in a sitemap. If 90% of the spike sits on one landing page that wasn't promoted, that's signal one.
- One country, one city, sometimes one hour. A geographic cluster with no campaign behind it — and often a city that has never appeared in your reports — is signal two. Watch for the whole spike landing inside a two-hour window overnight.
- Engagement time at or near zero. GA4 measures engagement as time with your page in focus, which automated traffic almost never accumulates. Average engagement time collapsing on the spike day while sessions triple is signal three, and it is the most reliable of the three.
The cross-check that settles it in two minutes
This is the fastest diagnosis in analytics and almost nobody runs it. GA4 counts sessions where your tag fired in a browser. Search Console counts clicks on Google results. Bot traffic that never came from a Google result can inflate the first without touching the second.
Pull the same date range in both, then read the pair rather than either number alone.
The two tools disagree by 10–30% as a matter of course even when everything is healthy, so read the direction and the shape, never the gap itself. We've written the full reconciliation in GA4 versus Search Console.
| GA4 sessions | Search Console clicks | What it means |
|---|---|---|
| Up sharply | Flat | It didn't come from Google search. Bots, a referral, an email blast or a tracking change. Check the source dimension next. |
| Up sharply | Up, similar shape | Real organic growth. Now go and find out which query moved, and whether it's a query anyone buys from. |
| Flat | Up sharply | A measurement problem, not a traffic problem. Consent banner, ad blockers, a broken tag on a template, or clicks landing on a redirect. |
| Up sharply on one page | Up on a query you don't recognise | Usually real, usually worthless. An article picked up an off-target query. Check whether it converts before anyone rewrites the strategy. |
What GA4 already removes, and what it never will
Before you build anything, know what's already happening. GA4 automatically excludes traffic from known bots and spiders using a combination of Google research and the International Spiders and Bots List maintained by the IAB. You cannot disable it, and — the part that frustrates people — you cannot see how much it removed.
That covers the well-behaved crawlers that identify themselves. It does not cover the interesting cases.
GA4's Measurement Protocol needs an API secret, which killed most of the classic ghost-referral spam that made Universal Analytics reports unreadable. What's left is mostly real: a headless browser executing your JavaScript, a scraper rendering pages, a competitor's monitoring tool, a security scanner, an SEO tool crawling your site on someone else's schedule. Those load your tag exactly like a person does, and no list will catch them.
Filters that hold, and filters that only hide the problem
GA4 gives you three data filters and a handful of adjacent settings. They do genuinely different jobs, and one of them does much less than people assume.
| Control | What it does | Honest verdict |
|---|---|---|
| Internal traffic filter | Tags events from IP ranges you define with a traffic_type parameter, then a data filter excludes them. | Works, and it's the highest-return setting in most accounts. Two steps — defining the traffic does nothing until you also create the filter. |
| Developer traffic filter | Excludes events sent in debug mode. | Worth switching on. Small volume, but it's the traffic your tag manager generates while someone tests. |
| Web hostname filter | Excludes events whose hostname isn't one of yours. | The one people skip. Catches your tag firing on staging, on a cached copy, or on someone else's page. |
| Unwanted referrals | Appends ignore_referrer=true so a domain stops being attributed as a referral source. | Relabels, doesn't remove. The sessions stay in your counts. Right tool for a payment gateway, wrong tool for a bot. |
| Report filters and comparisons | Hide rows in a specific report view. | Hides, doesn't filter. Useful for looking at a clean number without destroying data — which is often exactly what you want. |
What an agency should do when its own report has a spike it can't explain
This is where the mechanics turn into a client relationship, and it's the part most agencies handle badly. A month with an unexplained 40% traffic rise is a very comfortable month to report on. The temptation is to put it in the summary, call it momentum, and hope nobody opens the source table.
Our position, and we'd hold any agency to it: an unexplained spike is the agency's problem to solve, not the client's problem to interpret. Sending a report with a number you can't account for and letting the client discover it is a failure of the report, not of the client's attention.
So the sequence is fixed. Flag it in the summary on the first page, not in a footnote. Restate the headline number both ways — with and without the suspect segment — so the underlying trend is visible. Say which of the three signals it matched, and say what you're doing about it. If you genuinely can't explain it within a working day, write that sentence down and give a date.
The reason this matters beyond good manners: a client who has been shown one inflated number they later worked out for themselves stops trusting every number after it. Which is roughly how to read an SEO report in reverse — the checks a client runs exist because agencies didn't run them first. If you'd rather not have this argument every quarter, the fix is usually an analytics setup that separates humans from everything else before the reporting starts, not a better explanation afterwards.