The GA4 hostname filter can now work as an allowlist. On September 21, Google added Include data filters for hostnames to Google Analytics, according to its What's new in Google Analytics release notes. You list the domains that are allowed to send data to your property, and everything else gets dropped. It is a real fix for spam. It is also a way to permanently delete your own purchase data if you set it up carelessly, and for accounts where GA4 conversions feed Google Ads bidding, that is an ad account problem, not just a reporting one.
What Google actually changed
Hostname filters first arrived in GA4 on June 11, 2026, but only as Exclude filters. You had to name each spam domain before it could be blocked, which meant chasing new ones every time they appeared. Google's September 21 release note says that approach "required ongoing manual updates," and the new Include mode flips it: define your approved hostnames once and events from any other hostname are filtered out.
The same note spells out two exceptions, and both matter:
- Measurement Protocol events are exempt. Include filters are not applied to events sent through the Measurement Protocol, so server-sent data keeps flowing.
- Empty hostnames are blocked automatically. Google says events with no hostname are dropped by Include filters, because a missing hostname "typically indicates spam or abnormal traffic."
That is the full confirmed scope. Google has not published matching rules. As PPC Land pointed out in its write-up, the release does not say whether listing a domain also admits its subdomains, whether www and the bare domain are treated as one, whether wildcards work, or how events sent through Google's newer Data Manager API are handled. We are not going to guess at any of those. Treat them as unknown until Google documents them.
Why this is an ad account issue
Data filters in GA4 are unforgiving. Google's data filter documentation is explicit: once a filter is active, the effect is permanent. Excluded data is never processed and never shows up in Analytics or in the BigQuery export. Filters only work going forward, so they do not clean up past spam either. You get up to 10 data filters per property.
With an Exclude filter, a mistake lets some spam through. Annoying, but you can segment it out later. With an Include filter, a mistake deletes real traffic and real conversions, and there is no undo.
Now think about where your conversions actually happen. For a lot of the brands we work with, the purchase, booking or lead does not complete on the main domain. A hosted checkout, a booking platform on its own subdomain, a separate landing page domain for a campaign, a regional store. If any of those hostnames is missing from the list, every event recorded there is gone. If you import those GA4 key events into Google Ads, Smart Bidding suddenly sees fewer conversions, assumes performance dropped, and starts pulling back spend on campaigns that are working fine. Nothing in Google Ads will tell you why.
There is one more wrinkle. PPC Land reports that since July 2026, Shopify purchase events have been reaching GA4 server to server through the Data Manager API for stores using the Google & YouTube app. Google exempted the Measurement Protocol by name. It said nothing about the Data Manager API. Until that is clarified, a Shopify store should assume an Include filter could touch those purchase events and test before trusting it.
Who should bother
If your GA4 reports are clean and you see little or no traffic from hostnames you do not recognise, there is no rush. Doing nothing costs you nothing here.
If you do see junk hostnames, spam referrals or (not set) hostnames inflating sessions, or if your GA4 conversion counts do not line up with your store or CRM, an Include filter is worth setting up. Just do it in the right order.
What to do this week
1. Pull your real hostname list first. In GA4, open an Exploration, add the Hostname dimension, and break down sessions and key events for the last 90 days. Every hostname with real conversions on it needs to be on your allowlist. Expect to find more than one. Check checkout, booking, payment and landing page domains specifically.
2. Talk to whoever manages your site and tag setup. Ask what domains and subdomains your GA4 tag runs on today and which ones are planned. A new microsite launched next month without being added to the list is a silent data loss.
3. Create the filter in Testing, never straight to Active. Per Google's documentation, a filter in the Testing state does not change your data. Matching events get labelled with the Test data filter name dimension so you can see exactly what would be removed. Creating filters requires the Editor role on the property.
4. Let it run, then read it properly. Give it at least a few days of normal traffic, ideally a full week so you catch weekend patterns and any low-volume domains. Then check in Explore: is anything with purchases, leads or add-to-carts being flagged? If yes, fix the list before going further.
5. Reconcile against your source of truth. Compare GA4 key events with the filter's test flags excluded against your actual orders or CRM leads for the same days. If the numbers get closer, good. If real conversions disappear, stop.
6. Only then switch it to Active, and write down the date. Note the activation date wherever your team tracks account changes, so a dip or jump in sessions later has an explanation rather than a panic.
7. Remember what it does not fix. Because Measurement Protocol traffic is exempt, spam sent that way will still get through. A hostname filter is one layer. It does not replace server-side validation or cleaning up what you send to your ad platforms. We covered the bigger picture of tracking you can trust in why your Meta pixel is lying to you.
The honest summary
This is a useful change that finally lets GA4 do what most people assumed the June version already did. For clean properties, it is optional. For properties with spam problems, it is worth doing, carefully. The risk is not the feature. The risk is switching it on before anyone has checked which domains your money actually comes through.
Whether your GA4 conversions match what is really landing in your bank account is one of the first things we check in our free 15-point Profit Audit: tracking accuracy, what Smart Bidding is actually being fed, and where your reported numbers drift from reality. Thirty minutes, and you keep the findings either way.