In this guide
- Bot Detection in Header mode adds
X-Bot-Detection: trueorfalseto every request. - Read the header in the server container and add a trigger exception, so GA4 tags do not fire for bots.
- It catches self-identified bots. For other spam, combine it with GA4 data filters and IP blocking.
Spam and bot traffic distort your reports: odd spikes, fake referrals, sessions with zero engagement, countries you do not sell to. You can clean some of this up in GA4, but data that never enters the property is cleaner than data you hide afterwards. With a server container you have a place to stop it. This page shows how to use the Open Tracked Bot Detection power-up to mark bots and keep them out of GA4. For the full explanation of the modes and the risks of Block mode, read bot filtering blocking.
What Bot Detection recognises
Bot Detection recognises requests from software by the browser name they announce: search engines, crawlers, scripts and uptime monitors. It is a good filter for the large amount of automated traffic that is honest about what it is. It cannot recognise a bot that pretends to be a normal browser. It is on every plan, including Free.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Set it up
Turn on Bot Detection in Header mode
Press Save. The rule is applied within a few seconds.
Create a request header variable
In the server container, add a variable that reads the header X-Bot-Detection.
Add a trigger exception
On your GA4 tags, add an exception that stops them from firing when the variable equals true.
Test
Send a request with a bot user agent and a normal one in Preview. The bot request should not fire the GA4 tag.
Publish
Publish the server container.
Check the effect in GA4
After a week, compare sessions, engagement rate and the share of traffic from unexpected countries with the week before. A drop in sessions with near-zero engagement is the sign that it worked. Do not worry if total sessions fall: you removed visits that were never real. Keep a note of the date so you can explain the change in your reports.
Connected in minutes
Add your domain, install the pixel, connect your ad platforms and watch the first events land.
What else to do about spam
| Problem | Tool |
|---|---|
| Self-identified bots | Bot Detection in Header mode, with a trigger exception |
| Fake referral hostnames | A GA4 data filter or a trigger condition on the hostname |
| A known bad IP address | Block Request by IP (Business plan) |
| Your own team's visits | A GA4 internal traffic filter |
| Fake events sent straight to your server | Check the path and the measurement ID, and require a known hostname |
Common problems
A worked example
A store notices that GA4 shows 4,000 sessions a month from a country it does not ship to, with an engagement time of zero seconds. It turns on Bot Detection in Header mode, adds a header variable and a trigger exception to its GA4 tags, and publishes. A week later those sessions have dropped to a few dozen, overall sessions are down by about a tenth, and the conversion rate has risen, because the denominator now contains only real visitors. Nothing about real traffic changed. The reports simply stopped counting visits that were never people.
Treat the cleaner numbers as the new baseline and make a note of the change date in your reporting. When someone compares this quarter with last year, you will want to explain why sessions fell and conversion rate rose at the same time. A short note saves a lot of confusion.
Terms you will see
- Trigger exception
- A condition that stops a tag from firing when it matches.
- Request header variable
- A server-container variable that reads a header from the incoming request.
- Engagement rate
- The share of sessions GA4 counts as engaged.
- Data filter
- A GA4 setting that includes or excludes certain traffic from reports.
- Referral spam
- Fake visits that show a made-up website as the source.
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
Frequently asked questions
How do I filter bots from GA4 with a server container?
Use Bot Detection in Header mode, read the header in a variable and add a trigger exception so GA4 tags do not fire for bots.
Does Bot Detection catch all bots?
No. It catches bots that identify themselves. Others need hostname filters or IP blocks.
Will it lower my traffic numbers?
Yes, by the number of bot visits it removes. Those visits were not real.
Is Bot Detection free?
Yes. It is on every Open Tracked plan.
Should I use Block mode?
Not to start with. Block answers bots with a 403 and can cut off crawlers you need.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 6 min read
