Google Analytics added Include filters for hostnames on September 21, according to the “What’s new in Google Analytics” entry dated that day, letting a property allowlist the domains permitted to send it event data. The entry frames the release as protection for “the integrity of your analytics data” against “new sources of spam.” Two sentences later, under “Details to note,” the same entry says Include filters “will not be applied to events sent from the Measurement Protocol, ensuring this data remains unblocked.” Measurement Protocol accepts events sent directly to Google’s endpoint without a tag on the site. The allowlist locks the door that requires a tag; the door that doesn’t stays open, by Google’s own description.
What does a GA4 hostname Include filter block?
A GA4 hostname Include filter blocks event data from any domain not on the property’s approved list, and it automatically blocks events that arrive with an empty hostname, which Google’s help page treats as a likely sign of spam or abnormal traffic and illustrates with gtag.js traffic. It does not block events sent through the Measurement Protocol: Google states plainly that Include filters “will not be applied” to that channel, so anything posted straight to the endpoint passes through regardless of what’s on the domain list.
The Same Outcome, Described Twice in Three Months
The same “What’s new” page carries two entries about hostname filtering, three months apart, and they describe the same outcome two different ways. The June 11 entry introduced an exclude-mode hostname filter and said it “enables you to make sure any data that does not come from an approved domain is not collected.” The September 21 entry says that before this release, “filtering was limited to Exclude filters, which required ongoing manual updates to keep up with new sources of spam.” Both statements sit on the same URL. Read side by side, Google’s own release notes describe the approved-domain outcome as delivered in June and as newly arriving in September.
Permanent, Not Retroactive
Google’s separate data filters documentation adds a second detail worth reading before you create a filter. Analytics “evaluates data filters from the point of creation forward,” and filters “do not affect historical data,” so an allowlist created today does nothing about spam already sitting in the property. The reverse carries more weight: “once you apply a data filter, the effect on the data is permanent,” and excluded data “is never processed and will never be available in Google Analytics or BigQuery.” That’s a different failure mode from the one GA4 users saw earlier this month, when standard reports sat at zero for September 1 while Realtime kept counting. There, collection looked intact and processing did not. Data dropped by an Include filter never reaches processing at all, and Google’s wording leaves no room for it to arrive later. Google’s own fix for anything reversible is a different tool: “If you want to hide data from certain reports without permanently filtering out the data, use report filters instead.”
A Deployment Filter, Not a Spam Filter
None of this makes the Include filter useless, it just narrows what it’s for. It’s well suited to catching staging, dev, and scraped copies of a site that fire the same tag into the production property. What it isn’t documented to catch is anything arriving through the Measurement Protocol, spam or otherwise, and Google hasn’t published how the matching itself behaves: Search Engine Journal reported that Google “has not explained how Include matching works for subdomains or properties receiving data from multiple hostnames, nor has it provided complete rollout details.” The shape is familiar from this month’s other GA4 release, when Dashboards arrived with a 15-card ceiling, no API, no segments, and no card-level comparisons. The capability is documented, and so is the edge it stops at. Here the edge is a route that never needed a hostname to begin with.