What GA4 already removes
GA4 excludes traffic from known bots and spiders automatically. Google identifies them with its own research and the International Spiders and Bots List maintained by the IAB, and you can't turn the exclusion off or see how much it removed.
That handles crawlers that say who they are. It does nothing about the rest.
Why bots still get counted
GA4 records a user when its tag runs in a browser. Modern scrapers, monitoring services, AI agents and click fraud often drive a real browser, such as headless Chrome under Playwright or Puppeteer. The page loads, the tag runs, and GA4 records a user. If the bot doesn't announce itself, no list can catch it.
GA4's own data filters only cover two cases: internal traffic, by IP address, and developer traffic, from debug mode. There is no filter for unknown automation.
Signs your numbers include bots
- Spikes with no cause: a jump in users on a day with no campaign, post or mention.
- One page, no depth: many sessions that view a single page, with almost no engagement time and no scrolling.
- Data centre locations: a surge from a city where a large cloud provider has a region, with no business reason.
- Odd technology: unusual screen sizes, outdated browser versions or a language that doesn't match the country.
- No conversions: a source with large user counts and no sign-ups at all.
You can exclude a pattern you've found from an exploration or a segment. That cleans one report, not the data, and only for bots you already know about.
Count people instead
The more reliable approach is to stop assuming that a page load is a person:
- Require real input. A person scrolls, taps, clicks or types. Browsers mark genuine input as trusted, and scripts can't easily fake it. Count a visitor as a person only after that happens.
- Check for automation. Browsers driven by automation set
navigator.webdriver, and headless Chrome names itself in its client hints. - Check the network. Visits from cloud providers' address ranges with no input are almost never people.
- Keep the rest, labelled. Rather than delete automated traffic, keep it with the reason, so you can see how much of your raw traffic it was.
LogZuno's web analytics does all four: People is the headline, unconfirmed and automated visitors sit beside it, and the inflation figure shows how many page loads you get for each real person. Automated pageviews never count toward your plan. Run it next to GA4 for a week and compare.