Hot water being poured over coffee grounds in a white paper filter.

Measurement

Will GA4's new hostname filter stop the Singapore and China bot traffic polluting my ad data?

By The Tofu team ·

Probably not, though Google hasn't said. GA4's Include hostname filter, added on September 21, 2026, keeps only events from domains on your allowlist and blocks events with an empty hostname, which stops spam sent from other domains. Agencies that studied the Singapore and China traffic describe bots moving across your own site. Our inference is that those hits carry your hostname and pass the filter. Check hostname by country in an exploration before you rely on it. To clean up, use report filters or segments, and block the traffic at your firewall if you have no buyers there.

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

As of October 2026.

What did Google change in GA4 in September 2026?

On September 21, 2026, Google added Include data filters for hostnames: an allowlist of the domains allowed to send event data to your property. Since June 2026, hostname filters could only exclude domains, which Google says meant updating the list each time a new spam source appeared. Google notes two details. Include filters don't apply to events sent through the Measurement Protocol, and they block events with empty hostnames.

Why is it unlikely to stop the Singapore and China bots?

Because the bots appear to load your real website, so their hits would carry your own hostname; this is our inference, as neither Google nor the agencies report testing the Include filter against this traffic. The agency Delante says the bots "move chaotically across the site," often landing on URLs with filters and parameters, and KRM Digital, a GA4 consultancy, says many land on 404 pages: hits on your own URLs, not fake hits sent from elsewhere. Google defines Hostname as the subdomain and domain of the URL people visited on your website, so those events should pass your allowlist. KRM Digital also wrote in June 2026, about the older Exclude-only filter, that a hostname filter won't block this traffic.

How can I check whether the filter would help my property?

Look at the hostnames on the suspicious traffic. In Explore, build a Free form exploration with Hostname and Country as rows and Sessions or Event count as values, then look at the Singapore and China rows. If they show your own domains, an include filter won't remove them. If they show domains you don't own, or no hostname, it will.

How do I set up an include hostname filter?

You need the Editor role or above on the property. Google's steps:

  1. In Admin, under Data collection and modification, select Data filters.
  2. Select Create filter and choose Web hostname traffic filter.
  3. Name the filter (up to 40 characters, unique in the property).
  4. Under Filter operation, choose Include only.
  5. Pick a match type (exactly matches, begins with, ends with or contains) and enter the hostname. Use "exactly matches" where you can: "ends with example.com" also matches notexample.com.
  6. Set the filter state to Testing, then select Create and Done.

Wait 24 to 36 hours, check the "Test data filter name" dimension in a Free form exploration as Google describes, then set the state to Active and save. Google says an active filter starts filtering within 24 to 36 hours.

What can an include filter break?

Anything that runs your tag on a domain you forgot to list. An active filter is permanent: Google says filtered data is never processed and never shows up in GA4 or BigQuery. List every domain that legitimately sends events, such as your main site, product subdomain, help center and any booking or checkout domain; Google combines all active "Include only" filters, so you can add one per domain, up to 10 data filters per property. Test first in case any of your own tracking sends events with no hostname, since include filters block those.

Is the bot traffic getting into my Google Ads conversions and audiences?

Conversions are less at risk than audiences. Google says the Google click ID (GCLID) is crucial for attributing imported GA4 conversions back to Google Ads, and Google Ads dates each conversion by its ad click, so bot visits that arrive as Direct traffic, with no ad click, shouldn't be credited to your campaigns. Google also says it filters invalid clicks on your ads out of metrics and billing, with a credit "where appropriate and possible" if it finds them after billing. Audiences are different: if GA4 counts the bots as users, they can meet broad conditions such as "all site visitors." KRM Digital suggests adding a country condition to the audiences you build, noting that it isn't retroactive.

How do I remove the bot traffic from my GA4 reports?

Use report filters or exploration segments, not data filters. GA4 data filters work only on developer traffic, internal traffic (IP addresses) and web hostnames, so there is no data filter for a country. Google points to report filters when you want to hide data without deleting it. Delante suggests exploration segments that exclude the pattern, such as the country plus very short sessions, and notes that this cleans Explorations but not the standard reports.

Can I block the bots before they reach GA4?

Yes, at your CDN or firewall, if you have no business in those countries. Cloudflare's firewall (WAF) custom rules can block traffic by country using the ip.src.country field, and KRM Digital suggests the same kind of rule at your host or CDN. A country block stops everyone there, including real prospects and partners, so check your CRM for deals in Singapore or China first.

Doesn't GA4 already filter out bots?

Only known ones. Google says GA4 automatically excludes traffic from known bots and spiders, identified through Google's own research and the IAB's International Spiders and Bots List. You can't turn this off or see how much it removed. The Singapore and China traffic is getting past it, so you need the steps above.

Has Google explained this traffic?

Not on its help pages, as far as we could find. Delante wrote in December 2025 that Google had confirmed the traffic doesn't come from humans and that teams were working on a long-term solution, but it doesn't link a Google statement. KRM Digital wrote that Google is tackling the root cause and developing a long-term fix, with no timeline. We couldn't find either statement on an official Google page or in the Community thread Delante links.

Sources

Related answers

More on

Let an agent build your next campaign.

Tofu Ads Agent reads your CRM, plans the funnel, builds the audience and creative, and stages full campaigns across LinkedIn, Google and Meta for your approval.

Try it free Get a demo