Google Analytics adds a real allow list for hostname filtering

Google Analytics can now keep a property clean by naming the domains it trusts, instead of chasing every new source of spam as it appears. The update, added to GA4 on September 21, 2026, introduces an Include mode for hostname data filters, an allowlist that quietly changes how most properties should think about data hygiene.

What changed

Hostname filtering in GA4 previously worked one way only: Exclude. A property could block a known spam domain, but only after spotting it, which meant every new ghost domain required a manual update. Analysts were stuck in a permanent game of catch-up, adding rogue hostnames to a growing block list while new ones slipped in behind them.

The new Include mode flips that model. Instead of naming what to block, a property names what to keep. Any event carrying a hostname outside that approved list gets filtered out automatically, and the property never has to chase a new spam source again to stay clean.

One detail worth flagging directly: events with an empty hostname are blocked automatically under Include mode, and Google states a missing hostname often signals spam or abnormal traffic. Some traffic sent through gtag.js can fall into this category too, so this is not a filter to activate without checking what it will remove first.

Why this matters

Spam and bot traffic have always distorted GA4 reporting in ways that ripple into decisions well beyond the analytics dashboard. Inflated sessions skew conversion rate calculations, pollute audience data feeding into paid campaigns, and quietly undermine the confidence a team places in its own numbers.

The allowlist approach solves the maintenance problem. A property with multiple domains, subdomains, or partner integrations (payment processors, booking widgets, chat tools) can define its trusted set once and stop the ongoing manual cleanup that exclude-only filtering demanded.

The part advertisers should not skip

Data filters in GA4 act on incoming data only, and Google’s own documentation is explicit that a filter change does not touch historical data. Once an Include filter goes Active, matching events are dropped permanently and never reach GA4 or BigQuery. There is no recovery path.

Google’s guidance is to run any new hostname filter in Testing mode for 24 to 36 hours before activating it. Testing tags matching events instead of removing them, which gives a team the chance to confirm the allowlist is accurate before the change becomes irreversible.

A practical setup sequence:

• Pull a Hostname report across the last 90 days inside GA4
• Record every hostname carrying genuine traffic, including partner domains and Google-owned properties like translated or cached versions of the site
• Build the Include list from that data
• Run the filter in Testing mode and review which events would be removed
• Check the “(not set)” hostname rows before activating, since a large share of legitimate conversions carrying an empty hostname will be dropped the moment Include goes live
• Switch to Active only once the list is confirmed, and log the change date so any later trend break has a clear explanation

One exception worth noting for anyone relying on server-side tracking: Measurement Protocol events are exempt from hostname Include filters, so spam sent through that route still gets through. The allowlist closes one door. It does not close every door.