Traffic Suddenly Spiked? Suspect Bots Before You Celebrate

You open GA4 and sessions have jumped to several times yesterday's level. Did a campaign land? Did you get picked up somewhere? When traffic suddenly rises, the first reaction is delight — "we grew." But then you check revenue and it's unchanged from usual. Plenty of people have felt this gap.

Here's the conclusion first. A spike in sessions isn't necessarily a rise in demand. The contents can be padding by bots (automated visits), and in that case no matter how much sessions grow, none of it reaches revenue. Worse, GA4 only auto-excludes "known bots" — unknown bots that hide their identity pass right through. In this article we'll walk through, with real data, the five signs that tell a real spike from a bot spike, how far GA4's exclusion actually reaches, and a way to sort out a spike and decide your next move.

TL;DR#

1. A session spike ≠ a rise in demand

   If the jumped sessions are made of bots, only the numbers swell while revenue stays put. Before celebrating, first sort out whether it's real or bot

2. There are five signs to tell them apart

   Which channel jumped / near-zero time on site / near-100% bounce / a single page only / zero purchases. Add an abnormal concentration by region or time of day. The more of these overlap, the stronger the suspicion of bots

3. GA4's known-bot exclusion has limits

   GA4 only auto-removes what's on the IAB known-bot list. Unknown bots that hide their identity pass through, and you can't even see "how much was excluded"

4. Sort it out first, then decide your next move

   Identify the channel, confirm real with time on site and purchases. If real, grow it; if bot, exclude it and restore your metrics. This judgment prevents wasted budget

1. Before celebrating a session spike, tell real from bot#

Bottom line: When traffic suddenly rises, before deciding demand grew, sort out whether the contents are real visitors or bots. The number called "sessions" stacks up the same as one whether it's a human or a bot. So a jumped number alone can't tell you whether it's a good spike or just padding.

A bot is an automated visit not operated by a person. Some are harmless crawlers, but many are meaningless to you — competitor scraping, impersonation, fraudulent crawling that targets ad spend. When these flood in at once, GA4's session count jumps cleanly. But bots don't buy products. That's why you get that gap: "sessions spiked, but revenue is flat."

The tricky part is mistaking this spike for a campaign that landed, and then steering more budget toward that source. Since the reality is bots, the extra spend only raises cost with no return. Sorting it out before celebrating is the first step. First, let's look at how the numbers behave differently for real versus bot traffic.

2. Five signs that tell a real spike from a bot spike#

Bottom line: A bot spike has traits that show up consistently. The more the following five signs overlap, the stronger the suspicion that the spike is bots. Just one could be coincidence, but once several line up, it's hard to see it as real.

The first is which channel jumped. If direct or referral alone swelled unnaturally, be careful. Visits that hide their source lose their destination and tend to pile up in direct, which is a breeding ground for bot traffic. The second is average time on site near zero seconds. People spend time reading a page, but bots leave in an instant. The third is a bounce rate near 100% — they arrive, do nothing, and leave right away. The fourth is viewing only a single page. If pages per session sticks at one, that's a classic automated visit with no browsing. The fifth is zero purchases, zero add-to-cart, zero conversions. Sessions rise while nothing reaches revenue at all.

As a further reinforcing sign, there's an abnormal concentration by region or time of day — a mechanical pattern like visits lining up at even intervals from a specific overseas region in the middle of the night. Human behavior doesn't align this neatly. Such skew is also a sign that bots are distorting the channel distribution itself (How bots distort channel distribution). The five signs are also continuous with the idea of viewing traffic quality in layers of time on site, browsing, and purchases (Viewing traffic quality in three layers).

3. How far GA4's "known-bot exclusion" actually protects you#

Bottom line: GA4 has a mechanism to auto-exclude known bots, but it only protects against "bots whose identity is known." Visits on the known-bot-and-spider list managed by the IAB (the digital advertising industry body) are removed automatically. But unknown bots that hide their identity aren't on this list, and they pass right through.

The other limit is that you can't see how much was excluded. GA4 silently removes known bots but doesn't report the breakdown of "which channel, how much was excluded." So you can't judge how clean the session count you're looking at is, or conversely how many bots it still contains. Known-bot exclusion is a basic setting you should keep on, but relying on it alone means you'll misread a spike from unknown bots as "we grew." More important than the fine details of the setup steps is grasping these two limits: it only stops the known, and the excluded amount is invisible.

This limit resembles how "invalid clicks" are handled in the advertising world. The platform auto-blocks only a portion; the rest you have to spot yourself (The difference between invalid clicks and bot exclusion).

4. How to sort out a spike, step by step#

Bottom line: When you find a spike, don't judge by feel — sort it out in order. First identify the channel, then check engagement, and if real grow it, if bot exclude it. These three steps let you decide your next move without being jerked around by padding.

First, identify which channel jumped. The total session count alone won't reveal the culprit, so break it down by channel and narrow in on where it swelled unnaturally. Next, check that channel's engagement — average time on site, bounce rate, pages per session, conversions. If near-zero time on site, near-100% bounce, and zero purchases all line up, the bot suspicion is strong; conversely, if time on site and browsing are as usual and purchases follow, it's a real spike. If real, grow that source; if bot, exclude that share from your metrics to recover the raw numbers. Leave it unexcluded and you'll steer budget toward the padded source while ad spend quietly keeps leaking (When ad spend leaks through bot traffic).

The problem here is the GA4 limit we saw in the previous chapter. Because the excluded amount by channel is invisible, the GA4 screen alone can't sort out in numbers "how much of this channel's sessions are real." This is where you supplement with behavior.

RevenueScope solution

Bottom line: RevenueScope judges bots from behavior — time on site, browsing, purchases — and excludes them from your human metrics. On top of that, it discloses the count of "how many bots were excluded" by channel, and places the clean sessions after exclusion and RPS (revenue per session) on one screen. So you can judge on the spot whether a spike is real or padding, and decide your budget move.

GA4 only protects up to known bots, and once unknown bots mix in, the true nature of a spike becomes structurally invisible. RevenueScope sees this not by a list but by behavior. Here are the actual numbers from measuring our own site over 90 days.

Measured on RevenueScope's own site (90 days)

Direct had 258 humans against 588 bots — about 70% of the inflow was bots. Without excluding this, direct's sessions inflate more than threefold and look exactly like a "spike." YouTube, too, was near-zero time on site and mostly bots. Organic search, on the other hand, was 781 against just 53 bots — high-quality traffic clearly separates out. GA4's known-bot filter lets these behavior-based bots pass right through. Precisely because the excluded count is visible by channel, you can judge which spikes to trust and which to doubt.

Here we draw an honest line. What RevenueScope can do is exclude bots based on behavior, disclose the excluded count by channel, and show the clean metrics after exclusion. It can't spot every last bot without misses (no one can judge bots perfectly), and the chance of mistaking a real user via VPN or cloud for a bot isn't zero. This is also an analytical exclusion, not a security feature that blocks the bot access itself. Its role is to get you to a state where you can judge the nature of a spike by connecting it to revenue. That's the focus.

5. FAQ#

Q. If I turn on GA4's "exclude known bot traffic," am I safe now? A. You should turn it on as a basic setting, but that alone isn't safe. Only bots on the IAB known list are excluded; unknown bots pass through. And because the excluded amount is invisible, you can't judge how clean your current numbers are. Pairing it with a behavior-based check is the realistic move.

Q. Only direct sessions jumped. Can I call it bots? A. Don't jump to conclusions — confirm with engagement. Visits that hide their source tend to pile up in direct and are a breeding ground for bots. But real visits via email or an app can also land in direct. The way to tell: if near-zero time on site, near-100% bounce, and zero purchases all line up, the bot suspicion is strong.

Q. Traffic went up but revenue didn't move. What should I suspect? A. First suspect padding by bots. Next, a measurement gap (a mismatch between GA4's revenue and your ecommerce platform's revenue) is a candidate. The two have different causes and fixes, so you need to sort them apart (When GA4 and your ecommerce revenue don't match).

Wrap-up: sort the spike before you celebrate#

A traffic spike isn't always happy news. If the contents are bots, only sessions swell while revenue stays put, and steering budget toward that source adds waste. Sort it out before celebrating. Which channel jumped, is time on site near zero, is bounce near 100%, is it a single page, are purchases zero — the more of these five signs overlap, the stronger the bot suspicion. GA4's known-bot exclusion is basic, but unknown bots pass through and the excluded amount is invisible. So view it by behavior, hold the excluded count by channel, and judge by the clean numbers after exclusion. Only by connecting the nature of a spike to revenue can you finally decide your next move.

References#

• Google Analytics Help "Exclude known bot traffic" 2026