Ghosts in the Dashboard: A Practical Clean-Up for UK Analytics Before You Spend Another Penny

There is a particular kind of optimism in a GA4 dashboard. The line goes up, the sessions stack up, and suddenly the marketing plan looks like it is working. Except some of that audience is not an audience. It is bots, referral spam, staff members testing a checkout, or a tag firing twice because someone changed the theme on a Friday afternoon.

For UK small businesses and e-commerce teams, the problem is not just messy reporting. It is spending money against it. If your paid search or social budget is optimised towards visits that were never going to buy, you are not buying growth. You are buying noise with a nice graph attached.

Why 'traffic' and 'people' are not the same thing

GA4 is good at counting events and sessions. It is less good at knowing whether the thing on the other end was a human with a debit card and a reasonable amount of patience. Known bots are filtered, but plenty of automated activity slips through. Referral spam can arrive from domains that look vaguely plausible until you notice they have names like best-seo-traffic dot something. Internal visits from your own team can inflate engagement on exactly the pages you care about most.

Then there are the quieter problems: duplicate tags, missing consent settings, cross-domain tracking that broke after a site migration, and filters that were set up in a hurry and never reviewed. None of these feel urgent. All of them distort the picture you use to decide where the next pound goes.

The fix is not to become an analytics purist. It is to make your reporting honest enough to trust for everyday decisions.

Start with a suspicion, not a filter

Before changing settings, spend an hour looking for patterns. Pick a recent week and open GA4 Explorations. Compare traffic acquisition against engagement. Look for sources with lots of sessions and almost no engaged sessions. Check pages with high views and near-zero average engagement time. Look at tech details: unusual browsers, strange screen resolutions, or a sudden cluster of sessions from a country you do not serve.

A useful exercise is to ask, 'Would a real customer plausibly do this?' A visitor who lands, stays for zero seconds, views one page and leaves is not automatically a bot. But hundreds of them from the same referral source, all at the same time, is worth a closer look. If you run an online shop, compare GA4 sessions with orders, payment provider data and server logs. The gaps often tell you more than the dashboard does.

The four usual suspects in a UK small-business account

Internal traffic. This is the classic. The office IP, the founder's home broadband, the agency's VPN, the developer testing a new banner. GA4 lets you define internal traffic and then activate a data filter, but the rule is only as good as the IP list behind it. If your team works from home, a single office IP will not catch everything. Create a clear process for updating the list, and consider labelling internal traffic first so you can see how much is there before you exclude it.

Referral spam and ghost referrals. Some spammy domains never send a real visitor; they just poke your analytics. GA4 has a setting for unwanted referrals, but it needs care. Do not exclude payment providers, email tools or partner domains that are genuinely part of the customer journey. Build the list slowly, review it quarterly, and keep a note of why each domain was added. A wrongly excluded referral can make a good channel look worse than it is.

Bots and scrapers. Turn on bot filtering in your GA4 data stream settings and leave it on. That catches the obvious stuff, not everything. For a more thorough check, look at unusual user agents, sudden traffic spikes, and sessions with no meaningful event activity. If you run a content site, scraper traffic can be a real share of your totals. Server-side logs or a CDN report can help you separate the automated from the curious.

Tagging and consent mistakes. A tag that fires twice will double-count conversions. A consent banner that blocks analytics for most UK visitors will leave you with a smaller, modelled and less complete dataset. Neither situation is a reason to panic, but both need to be documented. Check your tags after every site change, keep a simple record of your consent setup, and do not compare pre-consent and post-consent periods as if nothing changed.

A sensible exclusion routine, without blinding yourself

The goal is not to remove every imperfect session. It is to remove the ones that would change a decision. Start with internal traffic, because that is usually the easiest win. Define the rule, run it in testing mode for a week if you can, then activate the filter once you are confident. Keep a note in your analytics documentation: what was excluded, when, and by whom.

For referrals, create a small unwanted referrals list rather than a giant regex you will never dare edit again. Review it when you see a new suspicious source. For bots, use GA4's built-in filtering plus periodic sanity checks. If you have a developer or agency, ask them to confirm that your measurement plan still matches the site after any major release. A five-minute check after a checkout update is cheaper than a quarter of misleading reports.

One underrated tactic is to keep a 'staff' segment rather than trying to exclude every possible internal visit. You can compare staff traffic with customer traffic and spot when your own team is accidentally inflating a campaign. It is not perfect, but it is more honest than pretending the problem does not exist.

Rebuild reporting around humans, not hero numbers

Once the worst of the noise is gone, change what you report. Instead of leading with total sessions, lead with engaged sessions by channel, key events, conversion rate and revenue per session. For e-commerce, look at orders and average order value alongside traffic. For lead generation, look at qualified enquiries rather than form fills alone. Add a short note to every monthly report explaining any filter changes or tracking updates, so nobody compares two months that are not actually comparable.

This is also the moment to set a few alerts. A sudden spike in direct traffic, a referral source you have never seen, or a jump in sessions with zero engagement is worth investigating. You do not need a data team for this. You need a habit.

The uncomfortable bit: less traffic can be good news

When you clean your analytics, the session count will probably fall. That can feel like a setback, especially if someone senior likes the old number. But a smaller, more accurate figure is more useful than a larger, flattering one. It stops you chasing ghosts, it makes channel comparisons fairer, and it gives you a better chance of spending your budget where real customers actually are.

In 2026, with UK ad costs still demanding a decent return, a clean dashboard is not housekeeping. It is part of the acquisition strategy. Clean first, then optimise. The ghosts will not miss your budget, but your business will.