Bothered by spikes in direct and referral traffic (something about url umbrellas?) in your Google Analytics reports? Here’s how to prevent that junk from messing up your reports in the future.
I wrote an article in December 2014(!) “Removing Referral Spam from Google Analytics” which evolved over the years to become the “Definitive Guide to Removing All Google Analytics Spam“. In it, I coined the term ‘ghost referral‘, which was the result of spammers using the Google Analytics Measurement Protocol API to inject spam traffic directly into the Google Analytics tracking system. There was no way to prevent it beause it never actually hit your website. Fast forward to 2025, and introduce Google Analytics 4 with all-new system to prevent those kinds of attacks, and…it’s back.
Now they are using the GA4 version of the Measurement Protocol API to do the same thing. There is nothing you can do to your website or tag management system settings that will affect this fake traffic — it is injected directly into Google’s data in an API call. If you have a low traffic site, it makes many of the standard reports useless as the spike overwhelms the reports.
One thing about the new Measurement Protocol, though — it doesn’t allow you to create session ID’s for the events it creates. This is the key that lets us eliminate the garbage from our reports. There are 2 things you need to do:
- start tracking session IDs
- filter out traffic that doesn’t have a session ID
In Google Analytics, go to Admin > Custom Definitions > Create custom definition. Add a new dimension to capture the already existing ‘ga_session_id’ event parameter — you will have to type that in since Google does not expose it by default.
That will start collecting data once it is created (sorry, it is not retroactive). Now the next time there is an unexplained traffic spike, create a new comparison at the top. Enter a condition where the new session id dimension contains a ‘1’ — session IDs seem to be timestamp-based and will for the forseeable future start with ‘1’.
That’s it. The next time there is an unexplained spike in traffic, show both comparison segments — you can clearly see the traffic that has no Session ID:
And if you unselect the All users segment, you get the report you wanted without the noise:
There are other benefits to having the Session ID available in your reports, especially if you add a Page Count field as well.
Hope this helps you after the next wave of unexplained traffic spikes. If they come from the Measurement Protocol and you didn’t do it, it is not real traffic.