Google added Include filters for hostnames to GA4 on 21 September 2026. Until then you could only exclude a hostname, one at a time, after the junk had arrived. Now you list the domains allowed to send data and everything else is dropped before it's processed.
It's a good change with two sharp edges. Here's what to check before switching it on.
What Google added.
A data filter for web hostname traffic has existed for a while, but only as an Exclude filter: name a hostname and its events are dropped. Keeping up with spam meant adding a new exclusion each time someone pointed a fresh domain at your measurement ID.
The Include filter turns that round. You list the approved hostnames, and only events from those are processed. Google notes two details. Events sent through the Measurement Protocol aren't filtered, so server-side feeds such as refunds and offline conversions keep flowing. And events with an empty hostname are blocked automatically, because a missing hostname usually means spam or something abnormal.
Two things haven't changed. Data filters act from the moment they're created, so historical data stays as it is. And the effect is permanent: an event the filter drops never reaches reports or BigQuery. If you only want to hide data from reports, Google's advice is to use a report filter instead.
Why it matters.
Any site can send events to your property. All it needs is your measurement ID, which sits in your page source for anyone to copy. Spam that uses it shows up under hostnames you don't own.
So does a developer's local copy of the site, an agency's staging environment, a site that copied your tag by mistake, and the old domain you forgot was still tagged.
Each one dilutes the figures. Conversion rate falls because the sessions are real and the conversions aren't, landing page reports fill with pages that don't exist on your site, and someone spends an afternoon chasing a traffic spike from a server in a country you don't sell to.
The hostname report is one of the first places Marc looks in an audit, and it's rarely clean.
What to check before you switch it on.
- List every hostname you actually use. Open an exploration with Hostname as the dimension over the last twelve months, or the Tech details report with the dimension switched to Hostname. Include the bare domain and www, every subdomain that carries the tag, country or language domains, and anything a third party hosts for you: a checkout, a booking tool on its own subdomain, a careers site, a help centre.
- Cross-domain journeys. If a checkout or booking step runs on a partner's domain and you've set up cross-domain tracking, that hostname has to be on the list. Leave it off and the purchase event is dropped, permanently, while the sessions that led to it stay.
- Server-side tagging. The hostname GA4 sees is the page's, not the tagging server's, so a tagging server on a subdomain doesn't need listing. Anything you send through the Measurement Protocol isn't filtered anyway.
- Use the Testing state first. A new data filter can be saved as Testing rather than Active. Events it would drop are tagged with the Test data filter name dimension instead of being removed, so you can see what would go. Leave it there for a couple of weeks, check that list, then activate.
- The app domain. If logged-in customers use an app on its own subdomain and you don't want their activity in the marketing numbers, leaving it off the list is one way to do that. Think it through first: if the trial signup or the purchase happens on the app domain, you've just filtered out your conversions.
What it doesn't fix.
Bots on your real domain carry your real hostname, so they pass. Your own team's visits are the internal traffic filter's job, which works on IP address. Payment providers and other unwanted referral sources are referral exclusions, a different setting.
And a duplicate tag on your own pages passes too, because double counting is a tag problem, not a hostname problem.
Where to do it.
Admin, then Data collection and modification, then Data filters. Create a filter, choose web hostname traffic, choose Include only, add the hostnames and save it in Testing.
Put a note in your monitoring to review it before activating, and another to revisit the list whenever a new domain or subdomain goes live. A hostname that launches without being added is the one way this filter can hurt you.