How to set up a GA4 hostname include filter step by step

Short answer: A GA4 hostname include filter is a data filter that keeps only the events sent from domains you list, such as your shop and your checkout subdomain. Everything else is dropped, including spam, copied tags and events with an empty hostname. You create it under Admin > Data filters, leave it in Testing for 24-36 hours, then switch it to Active.

What changed in GA4 data filters?

Google Analytics 4 (GA4) now supports Include data filters for hostnames. In plain words, you can build an allowlist of approved domains, and only those domains are allowed to send event data to your property.

The official details are in the Google Analytics help article on data filters. The points that matter in practice:

• Include filters automatically block events that have an empty hostname.
• Hostname Include filters do not apply to Measurement Protocol events (events sent to GA4 directly from a server, not from the browser).
• A filter has three states: Testing, Active and Inactive. Google recommends waiting 24-36 hours in Testing before you validate.
• Filters only apply to new data. Data already collected stays as it is.
• You need the Editor role or higher at property level to create a filter.

Why does an e-shop need a hostname allowlist?

Your GA4 measurement ID is visible in the page source. Anyone can send events with it: spam bots, a scraper that copied your whole site including the tag, or your own developer testing on a staging copy.

For a content site that is just noise. For an e-shop it is money. Fake or duplicated purchase events inflate revenue in GA4, and if you import GA4 conversions into Google Ads, the bidding algorithm learns from them too.

Automated campaigns are the most sensitive here. If you are deciding between campaign types, the logic in Performance Max vs Search, which should you run first? only works when the conversions feeding the algorithm are real.

Which hostnames belong on your allowlist?

The hostname is the domain part of the page where the event happened, without https and without the path. Before you create anything, list every domain that legitimately runs your tag.

Hostname you see in GA4	What it usually is	Include it?
yourshop.sk and http://www.yourshop.sk	Main shop, with and without www	Yes, both if both appear
yourshop.cz, yourshop.hu	Country domains in a multi-country setup	Yes, if they send data to this property
checkout.yourshop.sk	Checkout or account subdomain	Yes, otherwise you lose purchases
staging.yourshop.sk, dev domains	Test copy of the site with the live tag	No
Unknown domains you do not own	Copied site, scraper or spam	No
Empty hostname	Often spam sent without a page	Blocked automatically by the Include filter

How to set up the GA4 hostname include filter step by step

1. Pull the real list of hostnames. Build a report or exploration with the Hostname dimension for the last few months, with event count and purchases next to it.
2. Mark each hostname as yours or not. Ask your developer and whoever manages the shop platform. Country domains and subdomains added later are the ones people forget.
3. Check your access. You need the Editor role or higher on the property.
4. Create the filter. Go to Admin > Data filters, create a hostname filter of the Include type and enter only your approved domains. Save it in the Testing state.
5. Wait 24-36 hours. This is Google’s own recommendation. Do not judge the filter after an hour.
6. Validate against your shop backend. Compare purchases and revenue in GA4 test data with orders in the shop admin for the same days. If legitimate orders would disappear, a hostname is missing from the list.
7. Switch to Active and note the date. Write the activation date into your reporting notes, so nobody later reads the drop in sessions as a traffic problem.

What to do with Measurement Protocol events

If your shop sends purchases from the server through Measurement Protocol, the hostname filter does not touch them. That is good for legitimate server-side purchases, but it also means this filter will not protect you from anyone abusing that route. Treat it as a separate check.

What I see in the accounts I run

When I audit a GA4 property before touching Google Ads bidding, the hostname report is one of the first things I open. The surprise is rarely exotic spam. It is usually the client’s own forgotten domains: a staging copy with the live tag still firing, or a new country domain that went live without anyone telling the person responsible for analytics.

My rule is simple. Before any filter goes Active, the purchase count in GA4 for a normal week has to be compared with the orders in the shop backend. If the numbers already disagree, the filter is not the fix. The tracking setup is.

This matters because in the accounts I manage, campaigns run inside the client’s own accounts and optimise on the conversions GA4 or the ads tag reports. A clean allowlist is cheap insurance for that signal, the same way checking search terms for wasted spend protects the budget side.

Most common mistakes with hostname filters

• Activating without testing. One missing subdomain, typically checkout, and your purchases stop arriving from that day.
• Forgetting www or country variants. List what you actually see in the Hostname report, not what you think the site uses.
• Expecting history to be cleaned. Filters only affect new data. Old spam stays in past reports, so compare periods with that in mind.
• Assuming server-side events are filtered. Measurement Protocol events are not covered by hostname Include filters.
• Using the filter to hide a broken setup. Duplicate purchase tags, missing consent handling under GDPR or a wrong revenue value (with or without VAT) will not be fixed by an allowlist.

When not to bother yet: if your property receives no unknown hostnames and your GA4 purchases match the backend, the filter is a low priority. Fix revenue accuracy first, then add the allowlist as protection.

What to do first

Open the Hostname report today and write down every domain sending data to your property. Then create the Include filter in Testing, wait 24-36 hours and compare it with your shop orders before you activate it.

If you want someone to check your tracking and the campaigns that rely on it, see my PPC and performance marketing services or work with me as your PPC specialist. Email me and I’ll reply within 24 hours.