GA4 Can Now Block Unknown Domains. Could It Block Your Sales?

Google Analytics now lets you allow only approved hostnames. Done wrong, it deletes real sales data for good. Here is how to set it up safely.

Spam traffic has long polluted Google Analytics reports. Fake referrals, scraped copies of your site and random bots can inflate sessions and muddy your conversion rate. On 21 September 2026, Google added a new way to fight it: hostname Include filters, an allowlist of the domains that are allowed to send data to your property.

It sounds like a tidy fix. It is also the first Google Analytics filter that can quietly delete your real revenue data if your list is incomplete. Here is what changed and how to use it without regrets.

What Google actually changed

Hostname filters first arrived on 11 June 2026 as an Exclude option only: you named the bad domains and Google dropped their events. The September update flips that. With an Include filter you list the hostnames you trust, and events from any other hostname are filtered out.

Google's own release note describes the old approach as needing constant manual updates to keep up with new spam sources. An allowlist needs far less upkeep, because new junk domains are blocked by default.

Three details from the release coverage matter most:

• Events with an empty hostname are blocked automatically. Google says a missing hostname typically points to spam or abnormal traffic.
• Measurement Protocol events are exempt. Include filters do not apply to data sent that way.
• Filters can take 24 to 36 hours to take effect, and they only apply to data from the moment they are switched on. Your history is not cleaned.

Why this can hurt more than it helps

Once a filter is active, blocked events are never processed. They do not appear in Google Analytics or in the BigQuery export. There is no way to get them back later.

Now think about where your tracking actually fires. Most businesses do not run on one domain. A typical setup might include:

• Your main site and a separate checkout or booking domain
• A subdomain for a blog, help centre or customer portal
• A payment page, form tool or scheduling widget hosted by a third party
• A campaign microsite built for one launch
• A staging site that your team uses for testing

Leave one of these off the list and its pageviews, form submissions or purchases simply vanish. One analytics practitioner who covered the update in the Two Octobers roundup put the risk plainly: filters stop traffic reaching Google Analytics at all, so you don't know what you don't know. They plan to keep using the Exclude filter for now.

Gaps Google has not explained yet

Coverage of the release points to a few open questions. The release note does not describe the matching rules, so it is unclear how subdomains or www versions are handled. It also does not say how Include and Exclude filters combine. And as of 22 September, Google's setup and overview pages still described hostname filters as exclude-only, so availability may vary by property.

Until those are clear, treat your first Include filter as an experiment, not a switch to flip on a Friday afternoon.

How to set it up safely

1. Check you have it. Open Admin, then Data filters, and see whether an Include option appears. Creating a filter needs the Editor role at property level.
2. Inventory every hostname. Pull the Hostname dimension from a report covering at least 90 days. Mark each one as legitimate, spam or unknown, and ask your developer about the unknowns.
3. Include the awkward ones. Checkout domains, booking tools, subdomains and any cross-domain setups belong on the list if they run your tag.
4. Start in Testing mode. Filters can be Testing, Active or Inactive. In Testing, matching events are labelled with a "Test data filter name" dimension instead of being dropped, so you can see what would be removed.
5. Wait out the delay. Give it a full 24 to 36 hours, then compare the flagged events against your known revenue and lead numbers.
6. Activate, then monitor. After going live, watch conversions daily for the first week. A sudden drop on a key event is your cue to switch the filter off and recheck the list.

Remember that a property can hold at most 10 data filters, and hostname Include filters share those slots with your internal and developer traffic filters.

Do you even need an Include filter?

Not every site does. If your reports are clean and your hostname list shows one or two domains, the benefit is small and the risk is not zero. The filter earns its place when you can see a steady stream of junk hostnames or empty-hostname traffic skewing engagement and conversion numbers.

If your numbers feel off but you cannot tell why, the problem may sit elsewhere: duplicated tags, missing events or cross-domain breaks. A proper web analytics setup audit finds these before you filter anything.

Other recent Google Analytics changes worth a look

Two other updates landed around the same time, according to Google's release notes:

• 29 September: App conversions now appear in conversion reports for Google Ads customers, including attribution analysis and attribution models. Cross-channel budgeting still supports only web conversions.
• 9 September: Dashboards arrived for viewing KPIs in one report, with drag-and-drop editing and new visualization types.

If you run paid campaigns, the app conversion change affects how you read channel attribution, so check your numbers before the next budget review.

What to do next

• List every domain and subdomain that runs your Google Analytics tag.
• Run any new Include filter in Testing mode for at least 24 to 36 hours.
• Compare test-flagged events with your CRM or store orders before activating.
• Keep one person responsible for updating the list whenever you launch a new domain.
• Set an alert for sudden drops in key events, so a bad filter is caught within a day.

Clean data is worth the effort, because every decision on budget, content and conversion rate optimisation rests on it. If you want a second pair of eyes on your tracking before you change anything, you can get a free quote and we will take a look.

Sources

• Google Analytics filter blocks data from domains not on an approved list (PPC Land)
• Google Analytics include hostname filters (Search Engine Journal)
• Analytics Roundup, October 2026 (Two Octobers)
• What's new in Google Analytics (Analytics Help)