GA4 MCP
← All skills

Bot Traffic Detection

Identify and exclude bot, scraper, and spam sessions from GA4 data.

When to use

  • Traffic has unexplained spikes that don't correlate with any activity
  • Bounce rate is 0% or near-100% across many sessions
  • Sessions show 0 engagement time but high pageview counts
  • Referrers look suspicious (random domains, unrecognised TLDs)
  • You want to establish a clean baseline before any analysis

How to detect

Step 1 — Check engagement time distribution

Query sessions with very low or zero engagement:

dimensions: ["sessionDefaultChannelGroup", "sessionSource", "sessionMedium"]
metrics: ["sessions", "userEngagementDuration", "bounceRate", "screenPageViewsPerSession"]
date_range: last 7–14 days

Bot signals: userEngagementDuration near 0, screenPageViewsPerSession exactly 1, bounceRate at 1.0 (100%).

Step 2 — Inspect referrer sources

dimensions: ["sessionSource", "sessionMedium", "sessionDefaultChannelGroup"]
metrics: ["sessions", "userEngagementDuration", "newUsers"]
dimension_filter: sessionMedium = "referral"

Flag sources where userEngagementDuration / sessions < 2 seconds.

Step 3 — Check hostname

dimensions: ["hostname"]
metrics: ["sessions", "screenPageViews"]

Bot traffic often hits unexpected hostnames (staging domains, raw IPs, or hostnames you don't own). Filter to your known production hostnames.

Step 4 — Geographic anomalies

dimensions: ["country", "city", "sessionSource"]
metrics: ["sessions", "userEngagementDuration"]
dimension_filter: country = [countries with no expected traffic]

Clusters of sessions from unexpected countries with 0 engagement = bot signal.

Exclusion approach

GA4 does not have a native bot filter toggle beyond the automatic Google filter. To exclude suspected bot traffic from your analysis, add a dimension filter:

dimension_filter: {
  "filter": {
    "fieldName": "sessionDefaultChannelGroup",
    "stringFilter": {"matchType": "EXACT", "value": "Direct"}
  }
}

…combined with a metric filter on userEngagementDuration > 0.

Note: GA4 already filters known bots automatically. What remains are unknown/new bots and scrapers that mimic real browser behaviour.

What to report

  • Total suspicious sessions as % of all sessions
  • Top suspicious sources with their engagement metrics
  • Whether the pattern is new (spike) or chronic (baseline contamination)

Load it in a session with search_skills("bot-traffic-detection"), or read the MCP resource skill://bot-traffic-detection. Markdown twin: /skills/bot-traffic-detection/index.md · Source: skills/bot-traffic-detection/SKILL.md.