Ghost spam is fake traffic that appears in your analytics reports even though nobody visited your site. Spammers send made-up hits straight to the analytics servers using your site’s measurement ID, usually carrying a referrer, page title or event name that advertises their own website in the hope you will visit it.
How ghost spam works
Analytics tools collect data by receiving small requests from browsers. Anyone who knows where to send those requests, and which ID identifies your property, can send fake ones without ever loading your pages. That is the ghost: the session exists in your reports and nowhere else.
It was rife in the old Universal Analytics, whose tracking IDs followed a predictable pattern and whose server-to-server collection needed no secret. GA4’s Measurement Protocol requires an API secret, which has made ghost spam much less common. It has not disappeared, because the measurement ID is visible in every page’s source code and the browser collection route still accepts requests, so GA4 properties still see occasional waves of fake events and referrers.
It is worth separating three things that look alike. Ghost spam never touches your site. Crawler referral spam comes from bots that really do load your pages with a fake referrer. General bot traffic is automated visits of any kind, some harmless. The fixes differ, so identify which you have first.
The giveaways of ghost spam are fairly consistent:
- The hostname is not your domain, or is blank or (not set).
- Sessions show no engagement, a single event and zero time.
- A sudden spike from one referrer, one city or an unusual language setting.
- Page titles or event names containing website addresses or sales messages.
Why it matters
Spam distorts the figures you make decisions on. It inflates sessions, drags down engagement and conversion rates, and can make a referral channel look as though it is growing. For a small UK business with modest traffic, a single wave can swamp a month’s real referral data.
There is a security angle too. The domains in spam are often scams or malware. Do not visit them out of curiosity, and do not let colleagues follow them either.
Common mistakes
- Visiting the spam domain to find out what it is.
- Adding spam domains to GA4’s unwanted referrals list, a form of referral exclusion that changes how the source is attributed but does not remove the hits.
- Expecting anything you set up now to clean data already collected. GA4 changes apply from that point onwards.
- Chasing a growing list of spam domains one by one, when filtering on your own hostnames handles all of them at once.
- Mistaking a genuine spike, such as press coverage, for spam and filtering it out.
How to act on it
Confirm it first. Build a free-form exploration with hostname, session source and country as dimensions over the affected period. If the suspect traffic sits on hostnames that are not yours, it is ghost spam. For reporting, create a segment or comparison that includes only your real hostnames, and apply the same condition to any Looker Studio reports.
Keep the rest of your data clean at the same time: GA4 excludes known bots automatically, and an internal traffic filter removes your own team’s visits. There is no setting in GA4 that blocks hits by hostname at collection, so the hostname segment is your main defence; spam sent straight to Google’s servers never passes through your own site or tagging server, so nothing there can stop it. Clean data is the starting point for any performance marketing budget decision, so I check for spam whenever I take on an account.