Google Analytics can now block every domain except yours

Google Analytics now lets you name the domains allowed to send it data and throw away everything else. Google logged the change on September 21, 2026: “Google Analytics now supports Include data filters for hostnames, allowing you to create an allowlist of approved domains authorized to send event data to your property.” It replaces the routine of excluding spam domains one at a time, and it is permanent: anything an active filter blocks is deleted, not hidden.

What actually changed

The September 21 release note adds a behaviour to the Data filters section of Admin. Until now a hostname filter could only exclude: you found a junk domain in your reports, added it, and waited for the next one. An Include filter inverts that. You list the hostnames you own, and Google blocks every event from anywhere else.

Two rules sit inside the announcement and neither is obvious:

• Events with no hostname are blocked automatically. Google’s wording is that a missing hostname “typically indicates spam or abnormal traffic”, and it names gtag.js traffic as a case where this happens.
• Events sent through the Measurement Protocol are exempt. Server-side data keeps flowing whatever the allowlist says.

The cost of a mistake is stated plainly on Google’s data filters page: filtered data “is never processed and will never be available in Google Analytics or BigQuery”, and “once you apply a data filter, the effect on the data is permanent.” Search Engine Journal confirmed the same limits on September 22, and notes the filter is not retroactive and takes 24 to 36 hours to take effect.

One honest gap: as of today the Include option is not written into the data filters help page, which still documents three exclude-only filter types. PPC Land made the same point on September 21, listing what the release note does not answer: whether a hostname must match exactly, whether wildcards work, and whether www and the bare domain count as one. Nobody outside Google knows yet.

What this means for Georgian Bay businesses

This is useful to any Collingwood or Wasaga Beach trade whose GA4 reports carry traffic it cannot explain. Referral spam is the common case: a plumber’s property logs sessions from domains nobody has heard of, and the monthly visitor count is quietly wrong. An allowlist of one hostname ends that.

It is dangerous to a larger group than it looks. A service business often sends real traffic from a hostname it does not think of as its website: a booking or quote tool on a subdomain, a separate landing page for a Google Ads campaign, or a second domain kept from a business name change. Turn on an allowlist without listing those, and that data is gone, not parked somewhere recoverable.

We have not run this on a client property yet. Google released it yesterday, so anyone claiming to know how it behaves at scale is guessing.

What to do

1. Look before you touch anything. Open Admin, then Data filters, and see whether the Include option is there. The rollout is staged.
2. Find out which hostnames actually send you data. Build a free-form exploration in GA4 with Hostname as the dimension and Sessions as the metric, over the last 12 months. That list, not your memory, is the allowlist.
3. Write down every real one. Include the bare domain and the www version until Google documents whether it treats them as one, plus any booking subdomain or campaign landing page you found in step 2.
4. Set the filter to Testing, not Active. Testing tags matching events with a dimension you can report on instead of deleting them. Wait 24 to 36 hours, then check what it caught. If a real hostname is in there, fix the list before going further.
5. Activate only after Testing comes back clean. There is no undo, and it will not repair the spam already in your reports.
6. If your reports are clean, do nothing. A single-location trade site with one domain and no subdomains gains nothing here and takes on a deletion risk for it. This is a fix for a problem you can see, not routine maintenance.

If the real question is which channel produces the calls, that is a better measurement than visitor counts: see our comparison of Google Ads and SEO for Collingwood trades.

Frequently asked questions

Will this recover the spam traffic already in my reports? No. Google states the filter applies to new data only and does not change data already collected. Historic months keep whatever is in them.

Can I undo an Include filter? Set it back to Inactive and new data flows again. You cannot get back what it blocked while active. Google’s wording is that the effect is permanent.

Does this block my Google Ads landing pages? It does if they sit on a hostname you left off the list, and that is the most likely way for a trade to lose data it needs.

Do I need this if I only have one website? Probably not. If your reports show one hostname and no referral spam, an allowlist adds risk and removes nothing. Check first, then decide.

Does it affect server-side or offline conversion data? No. Google says hostname Include filters are not applied to Measurement Protocol events, so server-originated data is unaffected.