Google Analytics released a sharp upgrade for data quality on September 21, 2026: hostname filters now support an Include mode. That converts what was an exclude-only blocklist into an allowlist of approved domains. If a hostname isn’t on your list, GA4 refuses the event before it reaches your reports.
The timing is notable: it arrived 102 days after the original exclude-only hostname filter shipped on June 11, 2026. Google framed the change as a fix for the old workflow, saying it “required ongoing manual updates to keep up with new sources of spam.”
What changed
A hostname is the domain from which an event reaches a GA4 property—not the traffic source. Spammers commonly copy a site’s measurement ID and fire fabricated events without visiting the real site. This ghost or referral spam rarely carries the genuine hostname, which makes an allowlist a more efficient defense than adding each new spam domain manually.
Under Exclude mode, marketers had to chase rotating spam domains. Under Include mode, the job shifts to maintaining an accurate list of your own legitimate hostnames.
Two exceptions to know
- Measurement Protocol events are exempt. Google says hostname Include filters will not be applied to Measurement Protocol traffic, so server-originated events keep flowing. That’s significant because some practitioners describe ghost spam as arriving through the Measurement Protocol.
- Empty hostnames are blocked automatically. Events with no hostname, often shown as (not set), are treated as spam or abnormal traffic.
The release doesn’t detail how Include filters interact with the newer Data Manager API, app streams, or side-by-side Exclude filters. Google also hasn’t specified matching rules for subdomains or comparable domains. That’s worth watching because GA4 is steering more collection server-to-server.
Why this matters for performance marketers
GA4 isn’t just a reporting tool. Events feed Google Ads conversion windows and bidding, so polluted event streams can distort both analysis and automated media buying. A hostname allowlist can stop ghost spam at the collection point, before it contaminates audiences or conversion counts.
But this control is permanent. Once active, excluded data is not processed and isn’t available later in Analytics or BigQuery. Properties can hold at most 10 data filters, and you need Editor access to create them. A filter in Testing state lets you preview what would be removed before switching it to Active.
Before you switch it on
Run the filter in Testing mode first. Use the built-in “Test data filter name” dimension to inspect what would be removed before activation. Filters only act from the moment they are switched on, so historical data remains untouched.
Then audit every hostname that legitimately sends data. Cross-domain setups, subdomains, regional microsites, translated or cached pages, and checkout domains all need to be on the list. If a new campaign landing domain launches after activation and isn’t listed, that data is lost permanently.
Treat the allowlist as a deployment artifact: review it before every launch, and add legitimate hostnames before traffic starts. The tool answers the spam question, but the marketer now owns the completeness of the list.
Source: PPC Land
