Practical review · GA4 · 16 Oct 2026
Direct traffic rose 1,206%: people or bots? Six questions that separate real growth from automated traffic in GA4
Direct rose 1,206% while engagement sat at 6 seconds. That is a reason to audit the report, not to celebrate. Here are the signs of automated traffic and a six-question check.
- Direct, Q3 2025calculated from the reported +1206%≈7.7
- Direct, Q3 2026engagement 6 s101
- Organic, Q3 202510.9
- Organic, Q3 202626.8
Internal data from working projects, audit of 12 Oct 2026 (GA4 and Search Console). Figures were not re-checked inside GA4.
In short
- Direct rose 1,206% with 6 seconds of engagement. That is a reason to check the report, not to show growth to a client.
- One number is not enough for a verdict: look for several signs together. Until the check is done, do not use this period as a KPI baseline.
- Search Console does not react to such spikes: its clicks count visits from Google Search, not GA4 hits. The 77.5% click growth remains a separate, independent fact.
What automated Direct looks like
Direct in GA4 means sessions with no source data. It contains real people (bookmarks, messengers, links without UTM, visits from AI assistants) and automated traffic. Three metrics for the spike window help tell them apart.
| Signal | Suspicious threshold | Where to look in GA4 |
|---|---|---|
| Average engagement time per active user | under 15 seconds | Reports → Engagement → Overview |
| Share of returning users | under 5% | Explore → Retention, or a “returning” segment |
| Direct share of sessions | over 80% | Acquisition → Traffic acquisition, default channel group |
The thresholds are one author’s rule of thumb (Alejandro Rioja), not a Google standard. He also writes that a single flag is weak evidence: a reason to investigate, not a bot measurement.
Indirect signs from the same source:
- hundreds of sessions on the same few URLs;
- the same device model;
- countries with many data centres where the business has no audience;
- sessions with no trace in server logs or ad spend;
- an unrecognized hostname in the report: a site sending data to your stream ID, or a forgotten test environment.
Example: internal data from one project, Q3 2026
Figures from the 12 Oct 2026 audit (GA4 and Search Console, Q3 2026 vs Q3 2025):
| Metric | Q3 2025 | Q3 2026 | Change |
|---|---|---|---|
| Direct, sessions (GA4) | about 7.7k (calculated) | 101k | +1206% |
| Organic, sessions (GA4) | 10,928 | 26,846 | +145.7% |
| Google clicks (Search Console) | 9,240 | 16,400 | +77.5% |
What raised a flag. Direct is roughly four times organic, and average engagement is 6 seconds, well below the 15-second warning threshold above. For a shop with a local audience this structure is unusual.
What we do not know. Whether Direct is tied to a few pages, devices and countries, whether there is a hostname you do not control, and whether the growth matches server logs and orders. None of this was checked, so “bots” is still a hypothesis.
People or bots: a six-question check
Answer “yes”, “no” or “don’t know” for the spike window. Question 1 is a possible explanation for growth and is not scored; “yes” on questions 2–6 are signs of automated traffic.
- Was there a reason: a newsletter, ads without UTM, press mention, an offline promotion?Not counted as a sign
- Is average engagement time under 15 seconds?Reports → Engagement
- Are returning users under 5%?Explore → Retention
- Are sessions concentrated on one or two pages, one device model, or a country with no audience?Pages, devices, countries
- Does the hostname report show hosts you do not control?Unrecognized hostname
- Is there no trace of this growth in server logs, orders, calls and leads?Cross-check with independent sources
This guide’s own working scale, not an industry standard. “Don’t know” is a gap in the check: close it before concluding.
How to read reports while the noise is not filtered
- Do not use the contaminated period as a comparison baseline, for budgets or for client reports.
- Show Direct on its own line and base conclusions on Search Console and conversions.
- In GA4, open Admin → Data collection and modification → Data filters. Test a hostname filter first; activate it only after validation. An active filter affects new data only and does not change data already collected.
- For data already collected, compare the spike by pages, devices, countries and hostname in GA4 Explorations. GA4 does not support a session-scoped custom dimension for low engagement; use these breakdowns for analysis, not as a bot filter.
- If the traffic does not stop, add a rule at site or CDN level (rate limiting, bot protection).
- Do not discard Direct entirely: it contains visits from AI assistants and links without UTM.
FAQ
What does a GA4 hostname filter change?
It applies to new data and does not change data already collected. Test it first. You can inspect or restrict an existing period in analysis.
How long until a spike can be trusted?
The source advises waiting two to three weeks and checking whether returning users appear.
What should a client see?
Search Console clicks and impressions, conversions and leads. Direct goes on a separate line, flagged as under review.
Does such traffic affect rankings?
Not checked: we have no confirming data either way. For reporting the rule stays the same: rely on a source you can trust.
Sources and method
- Alejandro Rioja: How to Tell If Your GA4 Traffic Spike Is Bots — thresholds and order of checks (third party)
- Google Analytics Help: engagement time — how GA4 collects engagement time
- Google Analytics Help: data filters — where to configure and test a hostname filter, and its limits
- Search Console Help: impressions, position and clicks — how clicks are counted
- Internal data from working projects (audit of 12 Oct 2026, GA4 and Search Console)
Method: figures come from internal data of a working project and were not re-checked in GA4 itself. The “about 7.7k” Direct value for Q3 2025 is calculated from the reported +1206%. Thresholds and the scale are practical rules, not Google norms. Data as of 16 Oct 2026.