Unusual direct traffic spikes in google analytics 4

How to spot unusual spikes and clean up your data

You might have seen a spike in your traffic once a month when reading your Google analytics 4 reports and wondered where it came from. Whenever you see a certain continuity in such spikes, there is usually some kind of systematic reason behind it. Don’t worry, that sounds more alarming than it is in most cases.

Certain sources are probably crawling your website at regular intervals. Many SEO tools such as SEMRUSH or Ahrefs, for example, offer automated crawls to regularly monitor the status of your website (you might just want to make sure that you actually want the tools to do so, otherwise there are also ways to prevent them from it, for example via your robots.txt). Or it is another service that crawls the page, such as the Cookiebot tool we selected for our example. As we naturally do not want any distortions in our traffic analysis, we will now show you how you can exclude such spikes from your analysis in Google Analytics 4.

Examplary Case: Cookiebot causing spikes

Cookiebot is a consent management platform allowing website owners to create cookie banners and cookie declarations. In a nutshell, it frames the website under GDPR compliance where visitors would have the chance to either accept or deny cookies that might be set. You can configure your cookiebot setup to provide you a monthly feedback report on all the cookies on your website and if they fall under GDPR compliance.

To do this, cookiebot scans your website once a month. When a website is being scanned, the Cookiebot scanner crawls it looking for all known types of cookies and tracking technology and checks the status of those cookies whether they are being fired before or after consent. It is done by simulating ‘ real’ direct traffic to your website.

How to identify the problem? 

Well, you would need to dive into your traffic acquisition report in your GA4 property to find the issue. Sometimes spikes in direct traffic don’t necessarily lead to cookiebot being the ‘issue’. It can happen from bot or spam traffic, you could have also had a very good day acquiring traffic directly. However, when you notice a pattern, there’s your warning sign. 

In this example, we have filtered for direct traffic only and we notice the very obvious pattern of spikes in traffic. Once a month, almost around the exact same time. After digging a bit more in the data you will find that this traffic is coming from the same exact location, Dublin Ireland.

If we zoom in from the picture above to the beginning of April, specifically 8th of April. We get the following data. Most of the traffic comes from Ireland with 0 engagement time per session.

A more granular look at that day would look something like this: 

When you select other time frames that have the spike, you will also realise that the traffic spike is coming from the exact same place every time. (Do take the time to have a look at different time frames where you see the spike to make sure that the spikes have the exact same source every time). 

To double check your assumption, also be wary of the date when you receive the Cookiebot feedback report by email, as it will be sent on the same day or the very next day after the scan is done. By comparing the dates of your feedback report provided by Cookiebot and the numbers you see in GA4 you will be able to draw the right conclusions.

How to fix it?

In their official documentation, Cookiebot provides you a list of IP addresses (static IP addresses) that they use for crawling and scanning websites. In other words the IPs that you should whitelist from your traffic.

You can do that in GA4 using the following steps:

1. Go to your GA4 property in the lower left corner click on the gear (admin) icon

2. Head to Data streams:

3. Inside Data streams head to Configure tag settings and then to Define internal traffic:

It doesn’t have to be ‘ internal traffic’ to define certain IPs you want to exclude. So Don’t worry about the naming here. When you click there it prompts you to create a rule so press on Create.

4. Follow the same convention as you see in the picture. We have added the IPs that are in the Cookiebot’s documentation (be careful, Cookiebot might always add or remove certain IPs from their list, refer to the previously added documentation to always be up to date): 

5. Go back to your admin section and head to Data Filters. (what we did in the previous step is to define a rule that would filter the traffic, now we want to actually activate the filter): 

When you go into Data filters, you’ll be prompted to create a filter, go ahead and press on Create:

6. If you followed the same naming conventions from step 4, proceed here with the convention you see in the picture below:

What is important here is to have the traffic_type parameter exactly match the ‘traffic_type_value’ parameter in step 4. 

And lastly, setting the filter state to Active. If you create it and keep it in testing status, it would be evaluated but not applied to your property.

Followed the steps above? Then you should be good to go

Keep an eye on the filter and check if you still see spikes in your traffic.
Remember not all spikes need to come from Cookiebot. As mentioned previously, please search for specific patterns in traffic and keep an eye on when you are receiving the cookiebot feedback reports.

If you still are having troubles with spikes or with any other issue regarding your tracking setup, do not hesitate to contact us! Our experts are happy to help you clean up your data and optimise your tracking setup.