Google Analytics gained a new way to police hostnames on Sept. 21: an allowlist that admits only approved domains, rather than a blocklist an admin has to keep expanding every time a fake referrer shows up. The change lands as a data filter option inside GA4 property settings, not as a new product. It matters because hostname spoofing has been one of the more persistent ways junk traffic contaminates conversion and audience reporting, and until now Analytics only let teams fight it in reverse.
The filter type itself is not new. Google added hostname-based filtering on June 11, but that version could only Exclude hostnames, meaning a property owner had to notice each new spam or spoofed domain and add it to a growing list. Google logged the Include option on Sept. 21 in its running changelog for the product: define the production domains a property should trust, and any event arriving from a hostname not on that list gets filtered out by default.
That inversion is the real story. An exclude list only ever protects against sources someone already spotted. An allowlist protects against everything not already approved, including spoofed hostnames nobody has seen yet. Analytics teams tracking a fresh wave of Singapore-based bot traffic hitting GA4 properties now have a configuration option that does not depend on catching each new source as it appears.
Two carve-outs shape how the filter actually behaves. Events sent through the Measurement Protocol skip the filter entirely, so server-side or offline event imports keep flowing regardless of hostname. Events that arrive with no hostname at all, the example Google gives is gtag.js traffic sending no hostname value, get blocked outright rather than passed through, since Google’s documentation treats a missing hostname as a marker of spam or abnormal traffic.
The activation mechanics carry real risk. A data filter only applies going forward, starting the moment it is created, so nothing retroactive changes when a filter goes live. Once a filter reaches the Active state, though, its impact cannot be undone: matching events get dropped and are gone for good, absent from both Analytics and BigQuery. Google’s own setup guidance recommends running a filter in Testing first, where matching events get tagged with a test dimension instead of being dropped, before flipping it to Active. Google’s documentation puts the activation lag at roughly a day to a day and a half, so a property will not see the effect immediately.
The release note does not say how Include matching handles subdomains, and it gives no indication of how broadly the option has rolled out. As of Sept. 22, a day after the release note went live, Google had not updated either of the two support pages that document this feature, both of which still described hostname filtering as exclude-only. That gap between what shipped and what the documentation says is worth noting on its own: a property admin checking the help center today would not learn the Include option exists.
Any team running GA4 with data-quality problems traced to hostname spoofing should treat the Testing state as mandatory, not optional, before activating an Include filter, and should confirm which server-side or Measurement Protocol integrations feed the property so they are not caught off guard by data that keeps arriving unfiltered.
Matt G. Southern reported this for Search Engine Journal on Sept. 22, 2026.
