Is your GA4 traffic spike bots?
A sudden jump in GA4 users, often Direct traffic from places you don't serve, is frequently automated.
The short answer
Often, yes. Since early 2026, many sites have seen sudden jumps in GA4 users, frequently showing as Direct traffic from cities like Lanzhou, China, or from Singapore. Most of these visits aren't people. GA4 removes some known bots automatically, but plenty still get counted as real visitors.
Signs it's automated
- Users jump with no campaign, launch or press coverage to explain it.
- The new traffic is mostly Direct or "(not set)."
- It comes from a country or city your business doesn't serve.
- Engagement time is close to zero and most sessions see one page.
- Your engagement rate and conversion rate drop because the visits don't do anything.
- One browser version or screen resolution suddenly dominates.
A 10-minute check
In GA4, open Explore and build a free-form report for the period before and during the spike:
- Break sessions down by country and city. Look for a location that appeared or jumped.
- Add the session default channel group. See whether the jump is Direct or "(not set)."
- Add average engagement time and engagement rate. Real visitors spend time; most bots don't.
- Check browser and screen resolution for one value taking over.
If the jump lines up with one location, one channel and almost no engagement, you're very likely looking at automated traffic.
What GA4 does and doesn't filter
GA4 automatically excludes traffic from known bots and spiders. You can't turn that off, and you can't see how much it removed. It doesn't catch bots that look like ordinary browsers, which is most of what's causing today's spikes. GA4's data filters only cover internal and developer traffic, so you can't filter out a country going forward from GA4's settings, and you can't remove data that's already been collected.
What you can do
- Separate it in reporting. Use comparisons, segments or dashboard filters to show results with and without the suspicious traffic, and note the spike beside the chart so nobody mistakes it for growth.
- Stop it earlier. Your website's firewall or hosting provider can often block or challenge automated traffic before tracking loads. That's usually a job for your developer or IT team.
- Protect your conversions. Bots that only inflate sessions are a reporting problem. Bots that trigger conversions affect your ad spend.
- Flag it in your tracking. I'm testing custom tagging that marks visits that look automated as they arrive, so reports can set them aside. It's showing progress, and I can add it to your site as part of the work.
No method removes every bot. The goal is numbers your team can explain.
