Website Traffic Bot Free: What GA4 Filters Before You See It

Yes. Free tiers of hosted traffic services, bot software trials and freeware you run yourself all turn up for this search, and most deliver visits of some kind. We offer two of them, so here they are with their limits:

• Website Traffic, free NANO tier. 6,000 page views and 2,000 unique visitors a month, each visit capped at 30 seconds across up to three pages, and no card needed. It loads your pages in a real browser and waits, with no scrolling and no clicks. Our delivery policy says these visits come from data center IP addresses, and that free campaigns don't accept third-level domains, URL shorteners or domains already in our system. Everything else the free tier leaves out is in free traffic plans vs paid plans.
• Sparky Traffic Bot, 24-hour free trial. Full access for a day. It drives real Chrome windows through flows you script, and picks a new user agent and screen size for each session.

The catch applies to ours and to everyone else's. Between any bot and your reports sit five checks that can remove a visit before GA4 records it, and the most important one is run by Google, built partly on a list you'd have to pay to read, and impossible to switch off. So a free bot that shows nothing in GA4 isn't necessarily broken, and one that fills your reports isn't necessarily sending anything worth having.

A bot visit reaches a GA4 report only if it clears all five of these. The first two decide whether the GA4 tag can run at all, the third decides what the tag may send, and the last two happen inside Google Analytics.

Check 1 can end a free test before it starts. Cloudflare describes its free Bot Fight Mode as identifying "traffic matching patterns of known bots" and issuing "computationally expensive challenges", and its documentation says you "cannot bypass or skip Bot Fight Mode using WAF custom rules or Page Rules." There's no exception to carve out for one campaign. Our delivery policy is blunt about the same thing: we don't support bypassing Cloudflare's proxy and bot detection, and we ask customers to disable them so visits are counted accurately in Google Analytics. If switching protection off for your whole domain is a poor trade for your site, automated traffic isn't a fit, ours included.

Check 2 removes anything that isn't a browser. The GA4 tag is JavaScript, so a tool that fetches your HTML and moves on never runs it. Those visits exist in your server log and nowhere in GA4, and what they cost you there is covered in what a free traffic bot does to your logs, bills and reports.

Google's help page on known bot-traffic exclusion makes three statements, and each one matters if you're testing a free bot:

1. "Traffic from known bots and spiders is automatically excluded." There's no bots report, no dimension that flags them and no setting that brings them back.
2. "Known bot and spider traffic is identified using a combination of Google research and the International Spiders and Bots List, maintained by the Interactive Advertising Bureau." Half of that is a licensed list. The other half isn't published.
3. "At this time, you cannot disable known bot traffic exclusion or see how much known bot traffic was excluded." No off switch, and no count.

Older guides describe Universal Analytics, where bot filtering arrived in July 2014 as an opt-in setting in each reporting view. Standard Universal Analytics properties stopped processing hits on July 1, 2023, so a guide that tells you to tick a bot filtering box is describing a tool that no longer collects data.

The list behind half of GA4's filter is the IAB Tech Lab Spiders and Bots List. Its own page describes it this way:

• It "consists of two text files: one for valid browsers or user agents and one for known robots."
• It's meant for a two-step check: "identify valid transactions using the valid browser list and then filter/remove invalid transactions using the known robots list."
• It's updated monthly, with the Alliance for Audited Media handling evaluation and management.
• It's for spotting "search engine crawlers, monitoring tools, and other nonhuman traffic" that companies don't want in their analytics and billable counts, and it supports the MRC's General Invalid Traffic Detection and Filtration Standard.
• A subscription costs $5,000 a year for IAB US General Members and IAB Tech Lab Members, $7,500 for IAB Associate Members and $15,000 for non-members.

Two things follow for anyone shopping for a free bot.

Nobody can promise you in advance what GA4 will do with their visits. A free service would need a subscription costing up to $15,000 a year just to check its own user agents against the list, and even then it would only have checked half of the filter, because Google's research half isn't public. A free bot page that calls its traffic fully visible in GA4 is making a promise it can't check on your property. The only version worth anything is the one you verify yourself, which is why our delivery policy tells you to check Google Analytics after 24 hours and to email support@sparkcliks.com if the numbers don't match.

The list is aimed at bots that say what they are. Crawlers and monitoring tools identify themselves, which is what makes them listable. So the free bot visits most likely to vanish are the ones honest about being automated, and a bot that presents an ordinary browser is exactly what a user agent list can't pick out. Healthy GA4 numbers from a free bot tell you how it identifies itself, not who or what was behind the visit. How to spot bought traffic in analytics covers the audit for traffic that gets through.

If your site asks visitors for analytics consent, your consent setup is a bot filter as well. A bot that loads your page and waits never clicks Accept, and what happens next depends on your consent mode, as Google's consent mode documentation sets out:

• Basic mode prevents Google tags "from loading until a user interacts with a consent banner", and "transmits no data to Google prior to user interaction with the consent banner." A visit that never interacts sends GA4 nothing.
• Advanced mode loads the tags anyway, and "while consent is denied, the Google tags send measurements without cookies." Those measurements carry no persistent identifier, so, in the words of Google's behavioral modeling page, "Analytics can't observe and report whether that's 10 users or 1 user."

Modeling can fill that gap, but only for properties with at least 1,000 events a day from visitors who denied analytics storage, for at least 7 days, and at least 1,000 daily users who granted it on at least 7 of the previous 28 days. Without it, Google says, "Analytics will be missing data for users who decline consent." If your property is below those thresholds, unconsented bot visits are missing from your reports in either mode.

Consent is regional, too. Google's tag lets a site set a default consent state per region using ISO 3166-2 codes, with a separate default for everyone else. So the same free bot can be counted from one country and vanish from another. Our free tier has no country setting (geo-targeting starts on paid plans), so on a site with a regional banner, some free visits may land on the consent side of it. If a bot's numbers collapse after a change of country, check the banner's regional rules before blaming the bot. And don't loosen your consent setup to make a test look better. That's a compliance decision, and a traffic test is a bad reason to make it.

GA4 also lets you add exclusions of your own, under Admin, then Data collection and modification, then Data filters. There are three types: developer traffic, internal traffic and web hostname traffic. The hostname type arrived on June 11, 2026, and Google's release notes describe it as a way to "filter out (exclude) events based on their hostname." A property can have up to 10 data filters.

Two rules from Google's data filters page shape how you use them around a bot test. Filters only work forward: "Data filters do not affect historical data." And an Active exclude filter is final: "the excluded data is never processed and will never be available in Google Analytics or BigQuery." Every filter also has a state. In Testing, "Analytics identifies matching data with the 'Test data filter name' dimension" and removes nothing. Active applies the filter. Inactive stops evaluating it (filter states).

What that means for a free bot:

• Freeware on your own computer can erase its own visits. If your home or office IP is defined as internal traffic and that filter is Active, a bot running on the same machine sends visits from the same address, and GA4 discards every one of them for good.
• The hostname filter is for events your site never sent. It matches with "Exactly matches" or "Contains" and only excludes, so you name the hostnames to drop, not the ones to keep. Run it in Testing and read the Test data filter name dimension before you activate it.
• Don't use an Active filter to tidy up after a test. You can't get the data back. A comparison or an exploration filter hides the rows instead and deletes nothing.

One setting looks like a filter and isn't. "List unwanted referrals", in your web stream's tag settings, adds ignore_referrer=true to matching events so that the referring domain isn't credited as the traffic source. The visits stay in your reports under another source. It changes attribution, not counts.

Here's every way GA4 can lose, hide or move bot traffic, side by side:

GA4 won't report what it removed, and it doesn't show the raw user agent either: its reporting dimensions stop at browser, operating system and device. So the evidence for why a visit vanished sits in your server log, and the test works by subtraction. It fits any free bot, ours included. Every number below is illustrative, not a measurement from a real site.

Some free traffic never visits your site at all. GA4's Measurement Protocol lets a server send events straight into a property, and it requires an api_secret, created under Admin, then Data collection and modification, then Data streams, then your stream, then Measurement Protocol API secrets. Google's sending events guide says the secret "is used to authenticate your requests" and that "it is crucial to keep this secret confidential." Its overview describes the protocol's purpose as augmenting normal tag collection, "not to replace it."

So a free traffic service that asks for your API secret isn't sending visitors. It's writing events into your data. Nothing touches your server, nothing will ever match your logs, and whoever holds the secret can keep writing until you revoke it. If you've already shared one, delete that secret from the data stream.

A free bot whose visits reach your reports has cleared five checks. That's all it has done. It hasn't proven any of these:

• That a person visited. Clearing the known bot check only shows the visit didn't announce itself as automated.
• That the visits are undetectable. Your server log recorded every request, and CDNs, hosts and ad networks all run checks of their own. Our own delivery policy says Website Traffic arrives from data center IP addresses, which any IP lookup will show. Treat "undetectable" on a free bot's page as a reason to leave.
• That anything changed in search. Search Console counts a click when someone clicks your listing on a results page, so a visit that loads your page directly adds nothing there. And Google's John Mueller has said plainly, "We don't use Google Analytics in Search." Nothing GA4 keeps or drops has a published link to rankings, and no bot, free or paid, can promise positions.
• That you have an audience. GA4 counting a visit doesn't make it a reader or a buyer. Put bot sessions into a site sale listing or a sponsor pitch and you're misleading whoever reads it. On pages with ads, automated traffic counted as ad impressions is invalid traffic under every major ad network's rules, and the penalty lands on your account, not the bot's.

What our Website Traffic commits to is narrower than any of those: delivered visits show up in your own reporting, checkable after 24 hours. The free NANO tier of Website Traffic needs no card, and the Sparky Traffic Bot trial runs for a full day. Point either one at a page nobody else visits, read your server log against GA4 after 48 hours, and you'll know which checks it clears on your own setup.