How to Stop Referral Spam in Google Analytics GA4

Updated 5/5/2026 for GA4: This guide was originally written during the Universal Analytics era, when referral spam was a much bigger and more common reporting problem. Universal Analytics has been replaced by Google Analytics 4, so the old filter-based instructions are no longer the main way to deal with referral spam. This updated version explains what still applies, what no longer works, and how to handle unwanted referrals in GA4.

Can You Still Block Referral Spam in Google Analytics?

You can still clean up some referral problems in Google Analytics 4, but it works differently than it did in Universal Analytics. In GA4, you are usually not “blocking” traffic from reaching your website. Instead, you are telling Google Analytics not to treat certain domains as referral traffic sources.

This is an important difference. If a spammy referral source appears in your GA4 reports, adding it to the unwanted referrals list may help keep that domain from being counted as a referral source in future reporting. However, it does not stop bots, crawlers, fake visitors, or low-quality traffic from hitting your website.

For actual bot blocking, you may need server-level protection, a firewall, a security plugin, Cloudflare, hosting security tools, or other traffic filtering outside of Google Analytics.

What Is Referral Spam?

Referral spam is unwanted or fake-looking traffic that appears in your analytics reports as if it came from another website. In the old days of Universal Analytics, referral spam was a major headache because fake domains could show up in reports and make website owners think they were getting real visits from strange sites.

Some referral spam was harmless but annoying. Some was designed to get curious site owners to visit the spam domain. Some polluted analytics reports so badly that it became hard to understand where real visitors were coming from.

GA4 handles measurement differently than Universal Analytics, so the old referral spam problem is not exactly the same. Still, website owners may still see suspicious referral sources, self-referrals, payment processor referrals, checkout domains, login systems, or other domains they do not want counted as traffic sources.

What Counts as an Unwanted Referral in GA4?

An unwanted referral is a domain that you do not want Google Analytics to treat as a real traffic source. This does not always mean the domain is spam. Sometimes it is part of your own website or business process.

Common examples include:

Payment processors
Third-party checkout pages
Login or account systems
Password reset systems
Your own domain showing as a referral
Subdomains connected to your main website
Scheduling tools or booking platforms
Shopping cart systems
Suspicious domains that appear to send fake traffic

For example, if someone starts on your website, goes to a third-party checkout page, and then returns to your site, you may not want the checkout provider to get credit as the referral source. In that case, adding the checkout domain as an unwanted referral can help keep your reports cleaner.

How to Add Unwanted Referrals in GA4

Here is the basic process for adding unwanted referrals in Google Analytics 4:

Open your Google Analytics account.
Go to Admin.
Under Data collection and modification, click Data streams.
Choose your website’s Web data stream.
Click Configure tag settings.
Click Show all if you do not see all options.
Click List unwanted referrals.
Choose a match type, such as a domain that contains or exactly matches the referral source.
Enter the domain you want GA4 to stop counting as a referral source.
Click Save.

After you save the unwanted referral, GA4 can stop showing that domain as a referral source when the matching conditions apply. This is useful for cleaning up reports, especially when third-party tools or business-related domains are being credited as traffic sources.

Important: This Does Not Block the Visitor From Your Website

This is where a lot of people get confused. Adding a domain to the unwanted referrals list in GA4 does not block that domain from visiting your website. It only changes how Google Analytics handles the referral source in your reports.

If the problem is fake traffic, bots, crawlers, suspicious countries, server spam, or repeated junk visits, GA4 alone may not solve it. Analytics is a reporting tool. It can help you understand traffic, but it is not the same thing as a firewall.

If you need to actually reduce or block spam traffic, look at tools such as:

Your web hosting security settings
Cloudflare firewall rules
WordPress security plugins
Server logs
Bot protection settings
CAPTCHA on forms
Comment spam protection
Form spam filters

When Should You Use the GA4 Unwanted Referrals List?

The GA4 unwanted referrals list is best used when a domain is incorrectly getting credit as a traffic source. It is especially useful when the domain is part of your normal business or website process.

You may want to use it when:

Your own domain shows up as a referral source.
A payment processor is taking credit for sales or visits.
A third-party checkout page appears in your traffic reports.
A login or password reset system appears as a referral.
A connected subdomain appears as a new referral source.
A booking, scheduling, or customer portal domain is cluttering your reports.

The goal is to keep your reports from giving credit to domains that are not really new sources of traffic.

When the Unwanted Referrals List May Not Be Enough

The unwanted referrals list is not a cure-all. If you are seeing strange traffic in GA4, you should first figure out what kind of problem you have.

If a domain is showing up because it is part of your checkout, login, or payment process, the unwanted referrals list may help. If the traffic is from bots or automated spam, you may need a different fix.

Here are some signs that you may be dealing with a bigger spam or bot issue:

Huge traffic spikes from countries you do not normally serve
Very low engagement from strange traffic sources
Referral domains that look random or suspicious
Traffic that never converts or behaves like a real visitor
Repeated junk form submissions
Suspicious server log activity

In those cases, do not rely only on GA4. Check your hosting logs, security tools, firewall settings, and WordPress spam protection.

What Happened to the Old Universal Analytics Referral Spam Fixes?

Many older tutorials about referral spam were written for Universal Analytics. Those guides often talked about views, filters, referral exclusions, campaign source filters, hostname filters, and other UA-specific settings.

Those older instructions are mostly historical now. Universal Analytics stopped processing new standard property data in 2023, and GA4 uses a different data model and admin layout.

If you find an old article telling you to create a Universal Analytics view filter, that advice probably does not apply to your current GA4 property.

Should You Delete Old Universal Analytics Filters?

Old Universal Analytics filters do not clean up your GA4 data. If you still have access to an old UA property, those settings are mainly useful for historical reference. They are not the active solution for your current GA4 reporting.

If your website now uses GA4, focus on your GA4 data stream settings, unwanted referrals, internal traffic filters, event tracking, and security tools outside of Analytics.

Simple GA4 Referral Spam Checklist

If you are trying to clean up strange referral traffic in GA4, use this simple checklist:

Check whether the referral source is actually part of your website, checkout, login, or payment process.
If it is a legitimate business-related domain, add it to the GA4 unwanted referrals list.
If it looks like bot traffic, check your hosting logs or security tools.
If it is form spam, add better form protection.
If it is comment spam, improve your WordPress comment settings or spam plugin.
If traffic is coming from suspicious sources repeatedly, consider using a firewall or Cloudflare rule.
Do not assume GA4 can block all bad traffic by itself.

My Practical Advice

If you run a normal small business website, blog, or WordPress site, do not obsess over every strange referral in GA4. A small amount of weird analytics data is common. The bigger question is whether the traffic is distorting your reports, wasting server resources, creating spam submissions, or affecting your ability to make decisions.

If the referral source is just a reporting annoyance, the GA4 unwanted referrals list may be enough. If the problem is real spam traffic hitting your website, you need to handle it outside of GA4 with security, firewall, or hosting tools.

The most important thing is to understand the difference between cleaning up analytics reports and actually blocking bad traffic. GA4 can help with reporting. Your website security setup is what helps with blocking.

Historical Archive: Referral Spam in Universal Analytics

The original version of this article was written for Universal Analytics, back when referral spam was a common issue for website owners. At that time, many site owners used filters and referral exclusion settings to clean up spammy traffic sources inside their Analytics reports.

That older advice was useful during the Universal Analytics era, but it is no longer the main solution for GA4. If you are researching how referral spam worked in the past, the old information may still be interesting. But if you are trying to fix your current Google Analytics setup, use the GA4 guidance above instead.

Final Takeaway

Referral spam is not the same problem it was during the Universal Analytics days, but unwanted referrals can still make GA4 reports messy. Use the GA4 unwanted referrals list for domains that should not receive referral credit, especially payment processors, login systems, checkout pages, and connected business tools.

Just remember that this setting does not block traffic from reaching your site. It only changes how Google Analytics treats the referral source. For real spam, bots, fake visitors, form spam, or server abuse, use website security tools in addition to GA4.

The content below is here for historical purposes if anyone is curious about the old days of referral spam in Analytics.

Now let’s remember the good ol’ days.

When I was first trying to block referral spam in Google Analytics, I was adding code to my .htaccess files on various websites. After a couple of days, it seemed to work. But then I would still notice some spam referrals showing from the domains.

TL;DR: CREATE AN ANALYTICS CODE FOR YOUR WEBSITE THAT ENDS WITH -3 OR MORE

I was using codes like the ones below. And I’m sure you recognize some of these classics such as Semalt, buttons-for-website, 7makemoneyonline, and Darodar. And of course, Ilovevitaly—not I love Italy. More on him in a sec.

What the Hell is This?

Also—if you’re reading this article—I’m sure at some point you’ve seen this gem in your organic search section of Analytics:

vitaly rules google ☆*:.｡.゚゚･*ヽ(^ᴗ^)丿*･゚゚.｡.:*☆ ¯\_(ツ)_/¯(•ิ_•ิ)(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(゚д゚)ノʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^. .^=)oo

$vitaly rules google ☆*:.｡.゚゚･*ヽ(^ᴗ^)丿*･゚゚.｡.:*☆ ¯\_(ツ)_/¯(•ิ_•ิ)(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(゚д゚)ノʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^. .^=)oo$

Personally, I think that one is kind of funny. Because it’s true. And Google has done nothing to stop this junk.

New Spam

However, new spam sites and fake organic searches kept popping up—and still keep popping up—so using this method, I would have to update my .htaccess files pretty much every week. No thanks.

But Who is This Vitaly Referrer?

Vitaly Popov is the man behind most of the referral spam you see in your Analytics account. Others are copycats or are paying him to use his spam referral service.

If you’re really interested in learning about him, here he is back in 2003 on a trip through Siberia. And this old Geocities page of his is somehow still up.

And currently, domains like floating-share-buttons and event-tracking are dominating referral spam in Analytics. Also, porn.

Then a couple months ago, I created a brand new dummy Google Analytics account to test the spam. I never actually put the Analytics code on a website.

It was just a new Google Analytics account in a generic Gmail account. I created two more codes within the same account. So I have an Analytics account with codes like:

xxxxxxxx-1

xxxxxxxx-2

xxxxxxxx-3

These accounts were never put in the header tag of a website. There is no way for a bot to hit a website to create a visit for these accounts.

Check Out the Results

Click the image above for a larger view.

The xxxxxxxx-1 Analytics codes have over 1,200 referral spam traffic visits after about a month and a half. And the xxxxxxxx-3 account has none.

What is the Best Solution to Stop the Spam Referrer Traffic?

Well, the easy answer is, ditch your Google Analytics

code that ends in -1. And instead, use a code that ends in -3 or higher. The spam is currently mostly targeting Analytics codes that end in -1.

And I feel like this is proof the software being used is only exploiting Google Analytics and not actually visiting your website. (I’ve done a few tests like this, and each one is the same).

So blocking them in .htaccess seems like a good idea, but the spam can still get through to your Analytics. The best solution to kill all the spam is using a non -1 code if possible.

It may be scary to stop tracking your original -1 code because of all the history it has built up. However—lets be honest—your Analytics data hasn’t been accurate since late 2014. So why not switch?

Does the Fake Traffic and Bounce Rate Hurt SEO?

I know many webmasters and SEOs out there are worried this spam is hitting their websites and possibly hurting ranking because they create such a high bounce rate. But it isn’t true.

None of the spam actually visits your site. Therefore, how can it hurt SEO?

Also, since the same spam bullshit is hitting millions of Analytics accounts, then everyone should be on an even playing field. Right?

Google Analytics Filters to Block Spam

You can also constantly update filters within Analytics to not show the current spam sites and the new ones. But it just seems easier to me to create a new Analytics code and upload it to your website.

So How Do I Create the New Analytics Code to Combat Spam?

Here’s how:

Obviously, log in to your Google Analytics account. Then click the Admin tab.

Then hit the drop down menu and click Create new account…

Enter your info into the fields:

Do that a couple times until you get your -3 or higher Analytics code.

And boom goes the dynamite.

You can now combat spam referral visits to your website with this new code.

Will the Spammers Find Out about This Trick?

If this post gets popular enough, they probably will. And then they will have to include -2 and -3 and -4 and -5 and more codes in their spam system. But that might be a lot of work on their end.

Their current system most likely creates randomly generated numbers to hit codes that only have -1 on the end. Then they hit your Google Analytics.

Blocking Russia

For the record, I am blocking Vitaly’s main IP address in Russia. So hopefully he won’t have access to or find this post, to then decide to start targeting non -1 Analytics accounts.

Let me know if this helps. Please comment below.

UPDATE

His latest gem…

i came up with a method and 1,5 years forcing all-seeing eye of google to distribute my advertisements to millions best paying google clients for free! ha ha! vitaly popov

How to Stop Referral Spam in GA4: Unwanted Referrals, Filters, and What Still Works