How to Filter Bot Traffic in Google Analytics

Get an immediate lift in your conversion rate without changing anything.

We can raise your conversion rate in about ten minutes.

You will not run a test. You will not change a headline, move a button, or ask a developer for anything.

Your conversion rate will go up, and the new number will be more honest than the old one.

Most of the internet is not people anymore.

The bot traffic problem we keep finding in client accounts

Automated traffic passed human traffic in 2024 and has kept climbing.

The 2026 Bad Bot Report puts automated traffic at more than 53% of all web traffic. Bad bots alone account for 40%.

The newer pressure comes from language models. Cloudflare handles something like 50 billion AI crawler requests a day, and some of that is aimed at you.

We see some version of it in most of our clients’ data.

It costs real money. Roughly $63 billion in global ad spend went to invalid traffic last year, and about one in twelve of your paid clicks is not a person.

It also quietly wrecks your tests. Bots have no preferences, so they land in both variants and convert at zero in both.

That drags the two arms toward each other. Enough of them and a real winner reads as a tie. Our guide to A/B testing statistics covers why.

So you get a slower answer, a wrong cost per acquisition, and a quarter of decisions that were slightly off in a direction nobody could see.

What sellable traffic means

Your conversion rate is a fraction. Conversions on top, sessions on the bottom.

Nearly every dollar you spend on optimization goes to the top of that fraction. Better copy, faster pages, cleaner forms.

Almost nobody audits the bottom.

Sellable traffic is the share of your sessions that could plausibly buy from you. Not sessions that did buy. Sessions that were capable of it.

A bot cannot buy from you.

Neither can your developer testing checkout. Or the job applicant reading your careers page. Or the customer logging in to track last week’s order. Or the student in a country you do not ship to.

They are all sitting in your denominator right now, making your conversion rate look worse than it is.

On one specialty ecommerce site we audited, ninety percent of the sessions in the denominator were machines.

The site reported a 0.28% conversion rate. The real rate was 2.6%, which is about where a site like that should be.

That number also fixes your test schedules. Hand a duration calculator gross sessions when a third of them are machines, and every test runs a third longer than your plan says.

The button in Google Analytics you have probably never pressed

There is an icon in the upper right of your GA4 interface that opens a chat window.

It is called Ask Advisor. Google folded its earlier Ads Advisor and Analytics Advisor tools into this one assistant, so you may still see the old names around.

Most marketers we talk to have not clicked it. A few clicked it, asked something vague, got something vague back, and never returned.

It is free. It is already in your account. No API key, no developer, no credit card.

What it needs is a real question.

One thing Google does not document is the size of the box. The input caps at 2019 characters.

I found that by pasting progressively longer prompts until it broke, which is a dull afternoon I am happy to have spent on your behalf.

The prompt below is 1,905 characters. It fits with room to spare, and the reason it reads so tersely is that ceiling.

Use Ask Advisor to audit your GA4 traffic

This is the prompt we use. It is yours.

Open GA4, click the Ask Advisor icon, and paste it in.

Act as a CRO analytics auditor. Define "sellable traffic" for this property: the share of sessions that could plausibly buy. Analysis only, change no settings.

1. State the business model, the conversion event that is the money action, and your assumptions.
2. Give total sessions and users for the last 90 days, with trend.
3. For each non-buyer segment, report sessions, the filter used, engagement rate, and conversion rate: bot/invalid traffic (direct spikes, data-center cities, 0-second sessions, and screen resolutions impossible for real hardware such as perfect squares; list the top resolutions first); internal traffic; logged-in pages (/login, /account, /dashboard) but only for SaaS and subscription sites, on ecommerce and lead-gen these show buyer intent so keep them; /blog/ and informational pages; /support, /careers, /legal; order tracking and returns; referral spam; and geos we cannot ship to or sell into by policy, not merely geos that convert poorly.
4. Do not exclude any segment that converts at a normal rate for this business. Mark those "keep but monitor" and say why. Flag any segment converting far above the site average as suspected form spam, not a top performer. Never exclude AI assistant referrals (ChatGPT, Perplexity, Gemini, Claude); they are real prospects.
5. Build a waterfall table: layer, segment removed, sessions removed, % of total, conversion rate of removed segment, running sellable total. Apply exclusions in a fixed order and note overlaps so nothing is subtracted twice.
6. Report final sellable sessions and % of gross. Give a before and after table: sessions, conversions, and conversion rate for gross vs sellable, with the change. Then channel, device and geo mix of sellable only.
7. Give the reusable segment definition as GA4 filter conditions, plus caveats.
8. Return the whole report in Markdown so the tables can be copied without breaking.

No email gate, no download form, no upsell.

Two things make the next five minutes go better.

Ask Advisor has no copy or save button, and copying the report destroys the formatting. That is why step 8 asks for Markdown. If you forget, a second message saying “display the report as Markdown” converts what it already wrote.

The 2019 cap applies to each message, not the whole conversation. So spend a second message on your business.

Ours would say: our office is in Austin, our staging site is staging.example.com, and we cannot ship outside North America.

The report gets noticeably better for it.

The segments, and how you know

The report walks your traffic layer by layer. Here is how to find bot traffic in Google Analytics, and how to tell the report got it right.

How to identify bot traffic in Google Analytics

Most bots never reach GA4, because they do not run JavaScript. The ones that do are the ones worth finding.

The prompt asks for daily spikes far above your median arriving as Direct with no landing page. It asks for data center cities, which is why Ashburn, Council Bluffs, Boardman, Columbus and Dublin are in there.

Not many people live in a data center.

Then it asks for your top screen resolutions, which is the tell that rarely gets checked.

On that specialty ecommerce site, 11.8 million sessions arrived at 1600×1600. Zero purchases, 3.8 seconds each, 0.33 pages per session.

On Google’s own demo store, 129,929 sessions arrived at 1024×1024.

Screens are not square.

No monitor, laptop, tablet or phone ships with a 1:1 aspect ratio. A large block of sessions sharing one perfectly square resolution is a machine running a default that came out of the box.

We found that by asking one follow-up question: what are the most common screen resolutions of the bots you detected? 99.7% of a 130,000 session block shared a single impossible resolution.

That one number is a far more durable filter than the parameter that first exposed them.

How to exclude internal traffic from GA4

Your own team is in your analytics. Office cities, staging hostnames, localhost, QA paths, self referrals, and the person who has visited your pricing page four hundred times.

Our favorite example is not from a client. It is from Google.

Their public demo property flags direct traffic from Mountain View converting at 32%, roughly ten times the site average, and identifies it as internal Google employee traffic.

One of the most scrutinized GA4 properties in the world has its own staff in the numbers. Yours probably does too.

The other five

Logged-in pages are the tricky one. On a subscription product, /login and /account are existing customers and belong out. On ecommerce sites, they are part of the buying funnel. That same audit showed /checkout/Review converting at 72.1%, so a rule that stripped account pages would have deleted the best traffic on the site.

Blog and informational traffic are interested in the articles, not necessarily your offering.

Support, careers, press and legal are small until a hiring push or a news mention.

Order tracking and returns look like normal traffic in every report you already run.

Post-conversion traffic is the one to check by hand. If your conversion event fires on the thank-you page, removing those sessions pulls them out of the denominator but leaves their conversions in the numerator. That inflates your rate twice.

The check: when you remove a segment, your conversion count may fall a little. If the numerator never moves, look at your event configuration.

The guardrail, which runs in both directions

Never remove a segment that converts at a normal rate. If your blog brings in real leads, the blog stays in the calculation.

On one lead generation audit, blog traffic ran about 6,000 sessions and 90 genuine leads at a 1.5% conversion rate. Ask Advisor flagged it, checked it, and kept it. That is the right answer.

A segment can also convert too well.

On that same audit, a referral from ahrefs.com produced 17 leads from 19 sessions. Traffic from South Korea produced 224 leads from 272 sessions.

Those are machines filling out your forms.

Segments converting at normal rate are kept. If the conversion rate is essentially zero, look closer. Segments converting impossibly well also warrant a closer look.

You can tell Ask Advisor which to keep and which to exclude from reports, segments, audiences, and comparisons. Once you build these, the decisions are locked in. See “How to exclude bot traffic from Google Analytics for good” below.

How to calculate your real conversion rate, and why you should read the report

We ran this exact prompt against Google’s public demo property so you can reproduce it.

It went from 330,798 gross sessions to 134,961 sellable. Only 40.8% of their traffic was sellable. That takes the conversion rate from 1.04% to 2.50%.

Nearly sixty percent of Google’s own demo data cannot buy anything.

The report got one thing wrong, and it is worth checking for in yours.

It removed 46,560 sessions using the filter “countries with conversion rate under 0.5%,” then reported that conversion had improved.

That is circular. It cut the worst-converting traffic and took credit for the lift. We put those sessions back.

A country comes out because you cannot ship there, not because it converts poorly.

So read the filters, not just the totals. The report is a first draft, and you are still the analyst.

How to exclude bot traffic from Google Analytics for good

Once the report exists, you have an assistant that already knows what your junk traffic looks like.

Send this second prompt to turn the analysis into something you can reuse.

Turn the sellable traffic definition above into reusable GA4 setups for this property, using the exact paths, countries and values from the audit above.

Give me step-by-step instructions for all three:
1. A comparison in a standard report, for a quick look today.
2. A saved audience, for tracking sellable traffic going forward.
3. An exploration segment, for building funnels on sellable traffic only.

For each, name the menu to open, the dimension and match type to choose, and exactly what to type. Flag anything that will not apply retroactively.

The comparison is the fastest. The audience is the one your team will still be using next quarter. The exploration segment is where the funnel work happens.

From there it will also write your internal traffic exclusion, the IP filter and traffic_type parameter and why the change is not retroactive, a data filter that keeps staging out of production, and the developer brief for whatever instrumentation problem it found.

Excluding traffic from a report is not the same as blocking it at your firewall. For reports, the friendly bots come out too. Googlebot cannot buy anything, so out it goes. For filtering, friendly bots go back in. Block Googlebot and you leave the index.

Going deeper

Everything above is free and complete.

Ask Advisor has limits. It cannot remember, so next month you paste the prompt again. It cannot reach Tag Manager to fix what it finds. It cannot be scheduled. It caps at 2019 characters, and it sees one property.

A Google Analytics MCP server gets past all of that and connects your analytics to Claude, ChatGPT or Gemini for free. Setup took me 45 minutes of OAuth and credentials, and I am a computer science major. Give yourself more time.

The other option is EverOpt, which is what we use.

I have an affiliate relationship with EverOpt. I recommend it because it changed how we do analytics, and I would tell you about it either way.

It talks to the Google APIs directly instead of through an MCP server, so the model writes queries rather than reading tables, which means fewer hallucinations. It remembers your exclusions, supports Tag Manager, and emails you a weekly brief.

The long form version of this prompt is on the Pocket Conversion Scientist page with the rest of them.

When the number is bad and somebody has to act on it

Sometimes you run this and the news is good. Your rate was better than you thought, and your denominator was lying.

Sometimes your sellable conversion rate is genuinely low, on genuinely qualified traffic, and now you know it.

That is our work. Our conversion rate optimization audit starts where this article ends, and a Conversion Scientist runs the tests that move the number that matters.

Either way, go press the button. It is free, it is already in your account, and it takes ten minutes.

Your conversion rate is about to go up, and this time you will be able to defend it.

Much of this post was generated by an LLM from our presentation Using AI to Chat with your Online Business. It was edited by a human.

Sources

Author
Recent Posts

Brian Massey

Conversion Scientist™ at Conversion Sciences

Brian Massey is the Founder and Conversion Scientist™ at Conversion Sciences, a sought-after international speaker, and author of Your Customer Creation Equation. He is passionate about transforming websites through a steady diet of visitor profiling, purposeful content, analytics, and AB testing.

Expertise: conversion rate optimization, AB testing, marketing strategy, digital marketing, analytics, landing page design, computer programming, entrepreneurship

Speaking: IBM, Inbound, LeadsCon, Content Marketing World, Affiliate Summit, and more

Books and Training: Your Conversion Creation Equation, Video CRO, Marketing Videos that Convert, CRO Best Practices

As Seen On: ClickZ, Search Engine Land, Marketing Land, Conversion Sciences Blog, Intended Consequences podcast

Education: Texas A&M University, BS Computer Science and Management