GA4 hostname filters: how to block junk traffic
A GA4 hostname filter decides which events your property processes based on the domain they come from. Since September 2026 you can build an allowlist of approved domains (Include only) instead of excluding spam sources by hand. Try it in Testing mode first: once active, its effect is permanent.
Key points
- Since 21 September 2026, Google Analytics supports Include hostname filters: an allowlist of authorised domains.
- An active data filter is permanent: excluded data is never processed and won't be available in GA4 or BigQuery.
- Include filters don't apply to events sent via the Measurement Protocol.
- Include filters block events with an empty hostname.
- Always validate the filter in Testing state before activating it.
What is a GA4 hostname filter?
A hostname filter (web hostname traffic filter) is a type of Google Analytics 4 data filter that decides which events are processed based on the domain or hostname they are sent from. It keeps your reports limited to traffic from your own sites rather than from third-party domains using your measurement ID.
GA4 offers three types of data filter: developer traffic, internal traffic and web hostname traffic. You'll find them under Admin → Data collection and modification → Data filters.
What changed in September 2026?
Since 21 September 2026, Google Analytics has supported Include hostname filters: you can define a list of approved domains and discard everything else. Before that, the hostname filter (available since 11 June 2026) could only exclude domains, which, as Google puts it, required ongoing manual updates to keep up with new sources of spam.
Google Analytics now lets you build an allowed list of trusted domains, automatically filtering out unauthorized traffic from your reports
Exclude or Include only: which should you choose?
Choose Include only if you know exactly which domains your GA4 tag runs on; choose Exclude if you don't have that inventory or if there are legitimate domains you don't control.
| Exclude | Include only | |
|---|---|---|
| What it does | Drops events from the hosts you list | Processes only events from the hosts you list |
| Maintenance | Add every new spam domain | Add every new domain of your own (subdomain, landing page, environment) |
| Main risk | New spam slips through | Losing data from a legitimate domain you forgot to include |
| Events with no hostname | Not covered in the documentation | Blocked automatically |
| Measurement Protocol | Not covered in the documentation | Not applied: those events still come in |
Google also notes that all active Include only filters are combined and applied first as a group, followed one by one by any active Exclude filters.
What are the risks of activating the filter?
The main risk is that an active filter's effect is permanent: according to Google Analytics Help, excluded data is never processed and won't be available in Google Analytics or BigQuery. Filters don't affect historical data; they only apply from the moment they're created.
Three things to check first:
- Events with no hostname. An Include filter automatically blocks events with an empty hostname, because, according to Google, a missing hostname usually indicates spam or abnormal traffic. If you send legitimate events without a hostname, confirm in Testing mode that you won't lose them.
- Measurement Protocol. Include filters don't apply to events sent via the Measurement Protocol, so spam arriving that way won't be stopped by this filter.
- Match type. There are four: exactly matches, begins with, ends with and contains. We recommend exact matches for your own domains. Contains or ends with are convenient but can let through third-party domains that contain or end with the same string (for example, "ends with example.com" also matches "anotherexample.com").
If you only want to hide data from some reports without deleting it, Google recommends report filters instead of data filters.
How do I know the filter works before activating it?
Leave it in Testing state and wait 24–36 hours, as Google advises. In that state GA4 tags matching events with the Test data filter name dimension without discarding them. A free-form exploration then shows which hostnames are affected (see the steps). If unexpected hosts appear, adjust the conditions before activating it.
Step by step
List your legitimate hostnames
Note every domain and subdomain where your GA4 tag is installed: main site, with and without www, subdomains, landing pages and any other environment you want to measure.
Create the filter
In Admin → Data collection and modification → Data filters, select Create filter and choose Web hostname traffic filter. You need Editor access or above on the property. Give it a unique name of up to 40 characters (letters, numbers, underscores and spaces, starting with a letter).
Set the operation and match type
Choose Include only (an allowlist) or Exclude. Pick the match type (ideally exactly matches for your own domains) and enter the hostname.
Save it in Testing state
Select Testing as the filter state, then Create and Done. Wait 24–36 hours.
Validate the filter with an exploration
In Explore, start a Free form exploration. Add the Test data filter name and Event name dimensions and the Event count metric; drag the dimensions to Rows and the metric to Values. Add a filter where Test data filter name contains your filter's exact name, then review which hostnames appear.
Fix and validate again
If the filter affects hosts you didn't expect, adjust the conditions and repeat the validation. Don't move on while in doubt: an active filter is permanent.
Activate it
In Data filters, open the filter, set Filter state to Active and save. It will start filtering data within 24–36 hours.
Review your list whenever your site changes
If you launch a subdomain or a landing page on another domain, add it to the filter before it starts sending data; with Include only, anything not on the list is lost.
Trust and evidence
- Primary sources: Google Analytics' What's new page (entries dated 11 June and 21 September 2026), the official hostname filter setup guide and the data filters glossary entry in Google Analytics Help. All checked on 26 October 2026.
- Original testing: we haven't run our own test for this article (we don't yet have a production GA4 property to test it on). We'll update the article with screenshots and results when we do.
- Method and limitations: every statement was checked against Google's English documentation. The match-type recommendation is our editorial judgement, not Google's. The documentation doesn't say how Exclude filters handle events with no hostname or Measurement Protocol events, so we don't make claims about it.
Sources
- What's new in Google Analytics (entradas «Hostname filter», 11/06/2026, y «Hostname filters», 21/09/2026). Google Analytics Help (21 September 2026).
- Filter web hostname traffic in Google Analytics. Google Analytics Help, accessed 26 October 2026.
- Data filters — glosario de la ayuda de Google Analytics. Google Analytics Help, accessed 26 October 2026.