If you’ve noticed a spike in "Direct" traffic recently, I’m sorry to report that it may not all be actual human traffic. If you look deeper, that traffic may be coming from places like Lanzhou or Gansu in China. We’re seeing this across many publishers and media sites right now. Wired recently covered this trend, showing that this is a fairly widespread issue. Even the U.S. government websites are getting hit.
These sessions usually have almost no engagement, a single pageview, and no meaningful interaction. They inflate the total number of sessions and drag down the engagement rate, making some reporting look worse than it actually is, and other reporting look much, much better.
What’s Actually Happening
There are two common scenarios.
In some cases, automated systems are actually loading your site. When that happens, your GA4 tracking code fires like normal, and the session gets recorded. If this is what’s happening, you’ll see the traffic reflected in your server or CDN logs.
In other cases, the traffic never touches your website at all. Instead, automated systems send fake signals directly to Google Analytics. That means you won’t see matching traffic in your hosting logs — only inside GA4. Blocking traffic at the server level won’t fully eliminate this version because it bypasses your infrastructure.
Why It Matters
At first glance, this might seem like harmless noise in your analytics, but it can quietly distort the way your performance looks over time. Inflated session counts and near-zero engagement can skew metrics like engagement rate, average engagement time, and even geographic reporting. That makes it harder to understand how real readers are behaving and whether your content and marketing efforts are actually working. Left unchecked, it can lead to decisions based on misleading data.
How to Fix the Issue
The first step is to determine whether the traffic is actually reaching your website. We recommend asking your developer to review your CDN or server logs during the spike to confirm whether there’s matching activity at the infrastructure level. If there is, the right move is to block or challenge that traffic at the CDN or firewall level based on what the logs show.
Even though the traffic itself isn’t harmful to your website, letting bots repeatedly hit your pages adds unnecessary noise to your data and can create extra load on your infrastructure. Addressing it at the CDN or firewall level is the cleanest fix because it stops the traffic before it ever reaches your analytics. The result is clearer reporting and a more accurate picture of your real audience.
Subsequently, you need to address the impact this has on your analytics. For many publishers, filtering out traffic from China (or outside the United States) at the reporting level is often the simplest solution. For brands with international audiences, engagement-based filters are safer than geography-based ones. We recommend applying report-level filters in GA4 dashboards, Looker Studio, or your default reporting solution.
Analytics can be messy sometimes, but they’re still one of the most valuable day-to-day signals you have about what your audience cares about, so keeping your data clean and your site healthy is well worth the attention and effort.