By the Mayab Media Team
Here's the hard truth about GA4's new spam filter: the people most likely to hurt themselves with it are the ones who set it up fastest.
It's a great feature. It's also permanent. Data it throws away never comes back. So let's do this properly.
What changed
On September 21, 2026, Google added a line to What's new in Google Analytics: GA4 now supports Include data filters for hostnames. In plain words, you can give GA4 a list of approved domains, and any event that reports a different hostname gets filtered out.
This builds on a hostname filter Google shipped on June 11, 2026, which only let you exclude domains. Exclude lists are whack-a-mole. A spammer spins up a new fake domain and you're back to adding it by hand. An allowlist flips that. Only your domains get in.
A few details from Google and from PPC Land's write-up that matter:
- Measurement Protocol is exempt. Include filters don't apply to events sent through the Measurement Protocol. So spam sent that way still gets through.
- Empty hostnames are blocked automatically. Google says a missing hostname usually means spam or abnormal traffic.
- Three states: Testing, Active, Inactive. In Testing, matching events get labeled with a "Test data filter name" dimension instead of being dropped.
- It isn't retroactive, and it's permanent. Filters only work from the moment you switch them on. Filtered data never gets processed and doesn't land in your BigQuery export either.
- 10 filters per property, max. Hostname filters share that cap with your internal and developer traffic filters. You need the Editor role to create one.
Why it matters in money terms
Spam isn't only an annoyance. It messes with the numbers you use to make decisions. Fake sessions water down conversion rates, inflate "referral" traffic, and make it look like a channel is working when it isn't. If you report GA4 numbers to a boss or a client, spam makes you look bad.
But the bigger money risk is the opposite one. Plenty of businesses run part of the customer journey on a domain they don't own. Payment pages. Booking engines. Scheduling tools. A subdomain for the shop. A landing page on a campaign microsite.
If any of those hostnames are missing from your allowlist, every event from those steps is dropped. Forever. Your purchase or booking conversions fall, your Google Ads import of GA4 conversions falls with them, and bidding reacts to a drop that isn't real. That's how a "data cleanup" turns into a revenue problem.
The guidance from Relevant Audience, citing Google's guide, is that matching options are "Exactly matches" and "Contains." What isn't documented is just as important: how subdomains, www versus the bare domain, and wildcards behave. So don't assume. Test.
The safe setup, step by step
-
Pull your real hostnames. In GA4, build an Exploration with the Hostname dimension and Event count, last 90 days. Export it.
-
Sort the list into three buckets. Your domains (including www, shop., app., staging). Partner domains that host real steps of your funnel (payments, booking, chat widgets). And junk.
-
Pay extra attention to conversion events. Filter the same report to your key events (purchase, generate_lead, booking). Every hostname that shows a real conversion goes on the allowlist, no debate.
-
Look at "(not set)" hostnames before you activate. Include mode blocks empty hostnames. If you see meaningful conversion volume with no hostname, figure out why first. It could be a server-side or app setup you need to keep.
-
Create the filter in Include mode and leave it in Testing. Go to Admin, Data collection and modification, Data filters. Add every legitimate hostname explicitly. Don't count on "Contains" to catch subdomains you haven't verified.
-
Let it test for a full week. Google's guide suggests 24 to 36 hours, but a full weekly cycle catches weekend-only traffic and payment flows that don't happen every day. Then build an Exploration with Test data filter name, Event name, Event count and Hostname. Anything legitimate showing as "would be filtered" means your list needs fixing.
-
Activate and write the date down. Add an annotation and note it in your tracking log. When someone asks in March why referral traffic dropped, you'll have the answer.
-
Re-check whenever you add a domain. New microsite, new booking tool, new country domain? Update the allowlist before launch, not after.
Our opinion
Every GA4 property that's had spam problems should use this. But "set it and forget it" is exactly the wrong mindset. An allowlist is a living document tied to your funnel. If marketing launches something on a new domain and nobody tells the analytics person, you lose that data permanently.
Assign one owner. Make adding a hostname part of your launch checklist. Done.
Takeaway: Use GA4's hostname allowlist to kill spam, but test it for a week first, because whatever it filters is gone for good.
Want us to check how this affects your tracking? Book a free audit.
