How can you tell if GA4 traffic is bot traffic?

Look for sessions rising while engagement rate falls. In my audit the giveaways were a 12x jump in direct traffic in one month, thousands of sessions landing on the homepage and leaving within about 12 seconds, one country logging 187 sessions at 0% engagement, and Bing organic traffic at a 1.7% engagement rate. Real visitors do not behave that uniformly.

How do you filter bot traffic out of GA4?

GA4's built-in known-bot exclusion misses most junk traffic. What worked for me was a small piece of custom JavaScript that scores each session on headless browser flags, no user interaction after 10 seconds, missing browser language, and zero-size screens, then fires a bot_suspected event when the score hits 3. That event can be used to build a segment or comparison that excludes the junk from reports.

Why does GA4 only keep 2 months of data?

GA4 sets event data retention to 2 months by default. You can raise it to 14 months in Admin under Data Settings, which is the maximum on the free version. Most accounts I open have never had this changed, which means their own history is being deleted.

Can an AI run a GA4 audit for you?

Yes, with limits. My AI coworker Viktor pulled 12 months of GA4 and Search Console data, diagnosed the bot traffic, wrote and deployed the tracking code, and created the key events, all in one afternoon of Slack messages. What it could not do was click the settings Google requires a human to change, and it needed steering early on: its first instinct was to create a brand new property, which would have destroyed the site's history.

Viktor is an AI coworker that lives in Slack. It can analyze data, write and deploy code, build websites, run marketing analysis, and handle ongoing business tasks with access to your real tools. You can try it with $100 in free credits plus $50 off your first purchase at ref.viktor.com/roger-parent.

Back to blog July 31, 2026

My AI Coworker Audited My GA4 and Found Most of My Traffic Was Bots

AIAI CoworkerAnalyticsFirst-HandGA4Google AnalyticsViktor

I co-own an agency site that had a great looking spring. Search impressions were climbing fast off a stretch of work we had done: page speed fixes, new blog posts, new landing pages. Analytics said sessions had gone up about 6x.

None of it turned into clicks. So I asked my AI coworker to go look.

The Question I Actually Asked

My worry was narrow. If impressions are up and clicks are flat, either Google is answering the question inside AI Overviews and nobody needs my site, or something else is going on. I wanted the data, not a theory.

Slack message asking Viktor to check whether Google Analytics is even set up on the site

First answer back: there is no Google Analytics property. Only Search Console. Which meant we had been optimizing a site for months with zero visibility into what happened after someone landed.

The Tag Nobody Owned

Before creating a new property, I told it to check the site source and the Shopify setup. Good thing.

Viktor finding an existing GA4 tag installed on the site that was not in any of the connected accounts

There was a GA4 tag firing on every page. It just was not in any account I could see. It had been set up under someone else's Google login, which is how a lot of small teams end up with analytics they cannot open.

It also flagged two things I had not asked about: an old email platform pixel still firing on a site that had moved platforms, and no Meta pixel at all. That is the part I like. I asked one question and got the adjacent problems too.

Once I got admin access, it pulled the full history in a couple of minutes.

The 6x Was Fake

Viktor breaking down the traffic spike as bot traffic with a monthly sessions and engagement table

Sessions went from roughly 300 a month to roughly 2,600. Engagement rate went from about 53% to about 15%. Average session duration collapsed to seconds.

Chart showing sessions rising 6x while engagement rate falls from 53 percent to 15 percent

The evidence it built the case on:

Direct traffic jumped roughly 12x in one month. Real audiences do not discover you by typing your URL 2,000 times.
Thousands of those sessions hit the homepage and left in about 12 seconds. No second page, ever.
One country logged 187 sessions at exactly 0% engagement. Not low. Zero.
Bing organic showed a 1.7% engagement rate, which reads like scrapers tagged as search traffic.

Then the part that made the whole exercise worth it. Underneath the junk, the real traffic was fine. Google organic had grown from 100 to 182 sessions a month at about 60% engagement and three to six minute sessions. Directory referrals were converting attention at 82% engagement. The contact page sat at 95% engagement.

So the honest read was not "traffic tripled" and it was not "the SEO work failed." Real traffic grew roughly 80% and got buried under noise, and the dashboard I would have reported off was lying in both directions at once.

The Baseline Trap

If I had not looked, two bad things happen.

I report a 6x traffic win to my partner, and every month after that looks like a decline when the bots wander off. And every rate I care about, engagement, conversion rate, pages per session, gets divided by a fake denominator. The site looks like it converts terribly when it actually converts fine on the humans.

What It Fixed the Same Afternoon

I gave it three conversion actions I wanted tracked and told it to filter the junk.

Roger specifying three conversion actions and Viktor deploying tracking code and bot detection

It wrote the tracking JavaScript, uploaded it to the theme, wired it into every page, and deployed:

Booking detection that listens for the Calendly embed's event_scheduled message, firing a separate event per landing page so I can tell which offer produced the call.
A blog engagement event that counts active time only. It pauses when the tab is hidden, so a post left open in a background tab does not count as a reader.
Bot detection scoring headless browser flags, zero user interaction after 10 seconds, missing browser language, and zero-size screens. Anything scoring 3 or higher fires a bot_suspected event I can segment out.
Data retention bumped from 2 months to 14 months, which is the maximum Google allows and the default nobody ever changes.

Total elapsed time from my first question to live event tracking: a single afternoon of Slack messages. I approved three things and answered two questions.

Where It Needed Me

It wanted to create a brand new GA4 property in the first five minutes. If I had said yes, I would have thrown away the historical data and been running two tags on the same site. Telling it to check the source code first was the whole difference.

It also cannot click the buttons Google forces a human to click. Three settings inside the GA4 admin needed my hands, and it walked me through those step by step instead of pretending they were done.

If You Want to Check Your Own Analytics

Four things worth looking at this week, whether you have an AI doing it or you do it yourself:

Pull a 12 month view of sessions next to engagement rate. If they move in opposite directions, you have a traffic quality problem, not a growth story.
Sort direct traffic by landing page. Homepage-only, sub-15-second sessions in volume are bots.
Check your country report for any country with near-zero engagement.
Check your data retention setting. It defaults to 2 months and quietly deletes your own history.

Viktor is the AI coworker that did this. It lives in my Slack and it has access to the analytics, the ad accounts, and the site itself, which is why it could go from question to diagnosis to deployed fix without a handoff. It also rebuilt this website and set up the AI-readable version of it.

If you want to try it on your own account, you can get $100 in free credits plus $50 off your first purchase here.

More real examples, screenshots and all: my full Viktor review.

Written by

Roger Parent

Founder of Chief Marketing Dad · Fractional CMO

Roger has spent 15+ years helping ecommerce brands grow, these days as a fractional CMO working with a handful of brands at a time. He digs into the numbers most people skip and cares way more about what actually moves revenue than what looks good in a deck. When he is not buried in an ad account, he is usually with his wife and kids or on a pickleball court somewhere in Connecticut.

More about Roger →