Fix referral spam in GA4 without breaking attribution

Referral spam is back in the search trends because a lot of teams have opened GA4 and seen it: odd domains in Acquisition reports, sudden spikes in referral traffic, or conversions being attributed to a site you have never heard of.

The trap is that GA4 “referral spam” is not one thing. If you apply the wrong fix, you can permanently lose attribution detail, and you will still not know whether the spike is real interest from companies or junk data.

What counts as referral spam in GA4 now?

Universal Analytics had a long era of classic ghost spam, where spammers could inject fake hits into your reports without loading your site. GA4 is different, and Google also automatically excludes traffic from known bots and spiders.¹

In practice, most cases that look like referral spam in GA4 fall into three buckets:

1. Self referrals and “payment gateway” referrals: your own domains, a third-party checkout, or embedded tooling that breaks sessions and makes GA4 think the visitor arrived from that domain.
2. Junk referrers from real page loads: a bot or low-quality traffic source that genuinely hits your pages with a referrer header. These can still show up even though “old style” ghost spam is rarer.
3. Measurement Protocol spam: events sent directly to GA4 servers using the Measurement Protocol rather than your website tag, which can pollute reporting.²

Your job is to identify which bucket you have, then use the least destructive fix.

Is it really spam, or is it your attribution breaking?

Before you touch GA4 settings, answer one question: is this referrer stealing credit from real marketing work?

Here is a ten minute check that tends to outperform most blog advice.

1. In GA4, go to Reports, Acquisition, Traffic acquisition.
2. Set the primary dimension to Session source / medium.
3. Find the suspicious referrer domain.
4. Add a comparison or filter for that source and then check:

• Do you see conversions that you trust? If yes, treat it as an attribution problem first. You may be looking at your own checkout flow or a legitimate third party.
• Do sessions have real engagement? If it is all 0 seconds engagement, one page, no normal page paths, that is more likely junk.

What you do next depends on whether the referrer is part of your user journey.

If it is part of the journey, you want to stop GA4 treating it as a new referrer. You do not want to delete or block the events.

How do Unwanted referrals work in GA4, really?

GA4’s feature is called Unwanted referrals. It lives inside each web data stream, not at the property level.³

When you add a domain to the Unwanted referrals list, GA4 appends the parameter ignore_referrer=true to matching events.³ That matters because it explains both what it does and what it does not do:

• It does not block traffic.
• It does not remove sessions.
• It does not filter out bots.
• It does stop that domain being used as a referrer for attribution, which is exactly what you want for self referrals and payment domains.

This is also why Unwanted referrals is the right fix for things like:

• self referral domains you own (for example, separate app and marketing domains),
• third-party checkout domains,
• embedded booking or scheduling domains.

The exact GA4 path

Google’s current GA4 steps are:³

• Admin, Data collection and modification, Data streams
• Click your Web stream
• Scroll and open Configure tag settings
• Show all
• List unwanted referrals

Google documents a limit of 50 unwanted referrals per data stream.³

A practical warning for B2B teams

Adding domains here is easy. Overusing it is how teams quietly break marketing reporting.

If you add a domain that is genuinely a traffic source (for example, an industry directory that sends you leads), you will make that traffic look like something else, often (direct) / (none). GA4 explicitly uses (direct) when it cannot determine a clear source.⁴

So, only add domains that should never be credited as marketing sources.

If you want a sanity check, write down the business reason next to each domain you add. If you cannot justify it in one sentence, do not add it yet.

What if it is Measurement Protocol spam?

GA4 has a Measurement Protocol that allows systems to send events directly to Google Analytics servers via HTTP requests.² It is useful for server-side and offline measurement. It is also a spam vector.

Google’s own documentation is unusually blunt on the risk: exposing the api_secret allows unauthorised parties to send arbitrary or spam data to your GA4 property, corrupting reporting.⁵

If your “referral spam” looks like:

• lots of sessions with no real page path behaviour,
• lots of one-event sessions,
• odd conversions appearing with no plausible session source,
• many random referrers that change constantly,

then Unwanted referrals will not solve the root cause. Those events may not even have a meaningful referrer.

What to do if you suspect Measurement Protocol spam

1. Check whether you use Measurement Protocol at all. If you do not, any Measurement Protocol traffic is suspicious.
2. In GA4 Admin, review who has access to the property and data streams. Treat it like production infrastructure.
3. Rotate the API secret used for Measurement Protocol calls. (This is usually done in the GA4 data stream settings where the secret is created and managed.) Google’s warning is about exposed secrets, and rotation is the cleanest response.⁵

If you do legitimately use Measurement Protocol, you should also audit where the secret is stored. It should never be in front-end code.

Why UK B2B teams should care

Even if you are not running ecommerce, many B2B teams send server-side conversion events from:

• form back ends,
• CRM middleware,
• product trials,
• authentication or account creation systems.

Those are exactly the systems that end up with credentials copied across environments. A secret that leaks once can pollute your reporting for weeks.

The safe order of operations in GA4 (so you do not wreck your data)

There are two broad ways teams try to “fix” spam:

• attribution controls (Unwanted referrals),
• exclusion filters (data filters).

They are not equivalent.

Google’s help documentation warns that if you apply an exclude data filter, the excluded data is never processed and will never be available in Analytics or BigQuery.⁶ That permanence is why you should treat filters as a last resort.

A sensible order:

1. Diagnose: is it misattribution, junk visits, or Measurement Protocol spam?
2. Fix attribution first using Unwanted referrals where appropriate.³
3. Only then consider filters for internal traffic and developer traffic, which are what GA4’s data filters are primarily built for.⁷

If you want to tighten up reporting for your own team traffic while you are in here, use Google’s internal traffic approach, which is also implemented through Admin and data filters.⁶

Related reading: how Scout's confidence score works and the UK guide to website visitor identification.

Where Scout fits when GA4 gets noisy

GA4 is necessary, but it is not designed to answer the question UK B2B teams care about when referral spam or misattribution hits: which companies were actually showing buying intent this week?

Scout identifies the company behind a visit, not the person. It gives a 1 to 99 confidence score with a band and a one line reason for every match, and it flags ISP, residential, mobile, VPN and data-centre traffic in the low band. If you are trying to separate real B2B interest from noise, start by understanding how the confidence score works.

Scout can also connect your GA4 and Google Search Console data so you can see session depth, pages read, and the search queries associated with each identified company. That helps when GA4 acquisition reporting is temporarily messy because attribution got hijacked.

If you want to see what this looks like on your own traffic, start a free trial and review one week of identified companies alongside your GA4 acquisition report.

Frequently asked questions

Does GA4 Unwanted referrals block spam traffic?

No. GA4’s Unwanted referrals setting does not block or delete traffic. It sets ignore_referrer=true for matching events so that the domain is not used as a referrer for attribution. Use it for self referrals and third-party domains that should not get credit.

Why am I seeing self referrals in GA4?

Self referrals usually happen when sessions break across domains or subdomains, or when a third-party flow sends users back without preserving attribution. Add your own domains and legitimate journey domains to the Unwanted referrals list, and review cross-domain setup separately.

How do I know if it is Measurement Protocol spam in GA4?

If you see lots of random sources, sessions with no normal page behaviour, or conversion-only sessions that do not match real user journeys, suspect Measurement Protocol spam. Google warns that exposing an api_secret can let unauthorised parties send spam data. Rotation of the secret and an access audit are the practical first steps.

Is bot traffic already filtered in GA4?

GA4 properties automatically exclude traffic from known bots and spiders using Google research and the IAB International Spiders and Bots List. That does not mean all junk traffic disappears, but it does mean a spike is often misattribution or server-side spam rather than the classic UA-era bot referral spam.

Sources

1. Google Analytics Help: Known bot-traffic exclusion support.google.com
2. Google for Developers: Measurement Protocol (GA4) developers.google.com
3. Google Analytics Help: Identify unwanted referrals support.google.com
4. Google Analytics Help: [GA4] Understand (direct) / (none) traffic support.google.com
5. Google for Developers: Send Measurement Protocol events to Google Analytics (security risk) developers.google.com
6. Google Analytics Help: Filter out internal traffic (data filters are permanent when active) support.google.com
7. Google Analytics Help: [UA→GA4] Migration reference (data filters and unwanted referrals) support.google.com