If you've ever opened a Google Analytics (GA) report and thought, There is no way that many people visited this page and left two seconds later, you're probably right.
It might be bot traffic.
And while GA does filter some bots automatically, it doesn't catch everything. Some bots can slip through claiming to be human, leaving you with a dataset that's meant to be full of visitors but really includes a whole lot of robots.
This post is specifically about website traffic after the click — what happens once someone (or something) lands on your website and shows up in Google Analytics. That could be traffic from an ad, a resume link, an email, or anywhere else.
In this post, I'll cover my personal experience with bot traffic in marketing reports, how to catch it, and ways to filter it out so you can get a fuller picture of your digital marketing efforts across your website.
Bot traffic is a term that gets thrown around in data and analytics meetings, and it can sound like it means malicious activity — like a cyberattack or a competitor campaign meant to sabotage your paid media efforts. Most of it isn't either. It's typically just automated infrastructure doing its job, not an attack.
You might wonder, Well, can we just filter it out?
Unfortunately, it's not that simple. Any bot traffic that makes it into GA4 has already slipped past Google's own bot-filtering system. Once it's in your data — and some of it will get in — there's no single switch to remove it.
What you can do as a marketer is learn to identify it, so you're reporting on numbers that actually reflect real users.
Let's start with the basics of bot traffic in marketing.
Bot traffic is any website activity generated by an automated script or program instead of a real person — a session or pageview that shows up in your analytics looking perfectly legitimate, even though no human was involved in that visit to your site.
When bot sessions get counted alongside real visitors, two things can happen:
A page or campaign suddenly appears to be performing really well because the number of sessions has skyrocketed. But the reality is, a bot visited it a few thousand times. At first glance, seeing thousands of website pageviews is highly encouraging but as you dig into the data, notice what bot traffic does to on-page engagement rates.
Your engagement metrics take a huge hit. Here is what happens: Bot traffic gets to the landing page, does absolutely nothing — triggers few or no events at all — and disappears immediately. That can pull down engagement rates and session duration significantly.
And those low engagement numbers can look like a UX problem.
Your team might start thinking the landing page sucks. Maybe the messaging isn't resonating. Maybe the campaign is attracting the wrong audience.
So now teams start redesigning pages, changing campaigns, questioning the entire strategy, and second-guessing perfectly reasonable marketing decisions to solve a problem that doesn't actually exist.
Yes. Google Analytics has an automatic bot filter that excludes known bot traffic so it doesn't make it into your standard GA4 reports. But it doesn't catch everything, and it's worth understanding what it's actually checking against.
GA4's filter works off the IAB/ABC International Spiders and Bots List — an industry-maintained list of known crawlers and automated agents. When traffic matches something on that list, GA4 excludes it before it ever becomes a session in your reports.
Self-declared bots: Think Googlebot, Bingbot, or SEO tools like Screaming Frog. These identify themselves plainly in their user agent, they're on the IAB list, and GA4 recognizes and excludes them.
AI crawlers are a different case entirely. Bots like GPTBot and ClaudeBot are a newer category that the IAB list hasn't caught up to — they're generally not on it. But more importantly, most AI crawlers don't execute JavaScript at all; they're pulling raw HTML. Since GA4 only counts a visit when its JavaScript tag fires, these crawlers usually never trigger a GA4 hit in the first place. They're absent from your reports, but not because GA4 caught and filtered them — there was typically nothing to filter to begin with.
Not-so-honest bots: These don't identify themselves as bots. Think link scanners, content scrapers, and security tools. They present as a normal browser, they're not on any exclusion list, and they do execute JavaScript — so they fire your GA4 tag exactly like a real visitor would. GA4 has no reason to exclude them.
So when you suspect bot traffic in GA4, it's almost always this last group you're dealing with — not the crawlers, and not the AI bots, but the traffic quietly pretending to be a person.
Which brings us to the next question: if Google didn't flag them, how do you?
My biggest suggestion is to look for patterns.
A few strange sessions don't necessarily mean anything suspicious is happening. A few thousand nearly identical sessions are definitely sus and deserve a closer look.
If a large group of sessions has a duration hovering around zero with a single pageview, that's worth investigating.
Real people are inconsistent. Some read for ten seconds. Some stay for twenty minutes. Some wander around your site like they're paying rent.
Bots tend to be much more predictable.
If your site typically sees 40–60% engagement rates across most channel sources, but your direct traffic looks closer to 5–15%, don't immediately assume your website is terrible.
Look at where that traffic came from first.
Direct traffic can be a huge hint. It generally means someone — or something — went directly to your URL rather than arriving through Google search, social media, a referral, or another identifiable source.
And remember: a high amount of direct traffic isn't automatically bad. There are plenty of legitimate reasons someone might type in your URL, use a bookmark, or click an untagged link.
It's the combination of direct traffic + unusually low engagement + strange patterns that starts to raise a few eyebrows.
A few visits from a country you don't normally serve aren't particularly interesting.
Several thousand sessions from a region where you have no customers, no marketing activity, and no obvious reason to attract traffic — particularly when those sessions have almost no engagement — is a much stronger signal.
Humans are messy and inconsistent. We click different things, visit different pages, and take different amounts of time.
When the same event counts, pageviews, or session patterns repeat over and over with suspicious consistency, you're probably looking at bots rather than a sudden influx of extremely predictable humans.
UTM-tagged traffic can be particularly useful here.
If you've shared a tracked link in a document, email campaign, outreach message, or another specific channel and suddenly see a cluster of sessions arrive with almost no engagement, don't automatically celebrate the traffic spike.
A link scanner may have opened the link without a human ever looking at it.
Bot traffic can come from a few different places. Some of it is completely harmless. Other types can be a little more concerning.
Security tools, corporate email gateways, ATS platforms, and other systems that automatically inspect links before a person interacts with them.
For example, if you send a marketing email to a prospect who uses Outlook, Outlook's security system may automatically open the links in that email to check them. It can land on your website, trigger a pageview or other events, and then exit or check another page. That activity gets captured by GA4 — and it didn't involve a single human actually visiting your site.
Automated systems that crawl websites, monitor pages, check uptime, or collect information. Ever run across an aggregated website that pulls company information, news, or blog content from other websites and puts it on its own? Those sites often have systems that send bots to other websites, scrape their information, and then pull that information back to be analyzed or used however they want. Sometimes these scraper tools are perfectly harmless and do no real damage. Other times, particularly when the aggregator is a spammy or low-quality site, the activity can contribute to a profile of toxic backlinks, in addition to messing with your GA4 numbers.
Googlebot, Bingbot, and similar crawlers. These identify themselves and are generally handled by GA4's automatic filtering, so they're typically not something you as a marketer need to worry about seeing in your GA4 reports.
These are just a few examples of the types of bot traffic that can land on your site.
Knowing that this traffic exists is important because it helps you separate the noise from the data that actually tells you something about real humans.
Once I've identified a region or traffic segment that consistently behaves like bot traffic, the obvious move is to exclude it directly in GA4.
Except, I don't.
I prefer to filter it downstream.
Permanently filtering data at the source can make it difficult or impossible to recover later if your assumption turns out to be wrong.
Instead, I use Data (Looker) Studio as the filter.
My reports generally have two pieces:
- The primary report excludes the regions or traffic sources I've identified as consistent bot activity.
- A separate page shows the excluded traffic.
That second part is important because I don't want to decide once that this traffic is definitely bots and then never look at it again. The separate view lets me keep an eye on the traffic I'm excluding and make sure the pattern still holds.
Using the Data Studio Filter method, GA4 keeps the underlying data intact.
Data Studio is simply giving me a different lens through which to view it.
If I'm wrong, I can change the filter.
Bot traffic doesn't always announce itself. And while GA4 does a decent job of filtering known bots, it can't identify automation that looks like a normal browser session.
That's why the most useful approach isn't simply asking, "Did Google Analytics filter the bots?"
It's asking:
"Does this traffic behave like humans?"
Look at engagement. Look at duration. Look at geography. Look for strange bursts and suspiciously repetitive behavior. Then compare those patterns against what you know about your actual audience.
