GA4 Hostname Include Filters: What Changed
Since September 21, 2026, GA4 can allowlist hostnames so spam domains are dropped. Here is what the filter does, what it skips and how to test it safely.
Google Analytics 4 now lets you create an Include filter for hostnames, which works as an allowlist. According to Google's "What's new in Google Analytics" page, the change is dated September 21, 2026. Before it, you could only exclude hostnames one by one.
For anyone fighting fake traffic from domains they have never heard of, this is the more useful tool. But it also deletes data for good, so read the details first.
What does the new filter do?
A hostname is the domain part of the page address, such as www.yourshop.com. With an Include filter you list the hostnames you own. Events arriving from any hostname not on the list are dropped.
Trade coverage adds that events with an empty hostname are blocked under Include as well. Test it on your property before relying on it.
What does it skip?
Google's release note says Hostname Include filters are not applied to events sent through the Measurement Protocol. That is the API many teams use to send server-side events, such as a subscription renewal or a refund.
So if spam arrives through that route, the new filter will not catch it. Check those sending paths separately.
What is Google not saying?
The note does not spell out matching rules. Several writers have pointed out open questions: exact match or pattern, whether subdomains count when you list a parent domain, and whether www and the bare domain are treated as one. Until Google documents it, assume nothing and list every hostname you use.
How should you roll it out?
- List your real hostnames first. Include the main site, the app subdomain, checkout and any payment page that runs your tag.
- Create the filter in testing mode first. Reports recommend running it in Testing for roughly 24 to 36 hours and comparing against the unfiltered view.
- Switch it on only after the numbers match. Filtered data is dropped permanently and will not appear in GA4 or BigQuery, so a missing hostname is a real loss.
- Re-check after any site change. A new landing page domain or a third-party checkout will silently vanish from reports if it is not on the list.
Should you bother?
If your reports show clean hostnames only, skip it for now. If you see referral spam or stray domains in the hostname report, it is worth twenty minutes. For where this fits in a wider setup, see our Analytics & Data hub and the GA4 retention and BigQuery guide.
Your move: open the hostname report in GA4, list what you own, and check what is left over.
