Google Analytics on September 21, 2026 added an Include mode to its hostname data filters, turning a control that could only reject hostnames one at a time into an allowlist under which unlisted hostnames are refused, 102 days after the exclude-only version first shipped.

In Short

Google Analytics now lets you write down the website addresses that belong to you and throws away tracking data that claims to come from anywhere else. That matters to anyone whose reports have been padded with fake visits from spammers who copy a site's tracking ID, because those fake visits rarely carry the real site's address. Instead of adding each new spam address to a block list as it appears, a property can name its genuine addresses once, but any real address left off that list loses its data permanently.

What changed on September 21

The change is the most recent entry on Google's "What's new in Google Analytics" Help Center page, headed "Hostname filters" and dated September 21, 2026. It runs to one paragraph and two bullet points. According to Google, Analytics "now supports Include data filters for hostnames", letting a property hold an allowlist of "approved domains authorized to send event data". Events reporting any other hostname are filtered out.

Google framed the change against the version it replaces. "Previously, filtering was limited to Exclude filters, which required ongoing manual updates to keep up with new sources of spam," the entry states. Defining approved hostnames in advance, according to Google, simplifies configuration and keeps data clean with minimal upkeep. Those are the company's characterisations. The entry carries no figures on spam volumes, on how many properties adopted the exclude-only filter, or on how much data either mode removes.

A hostname is the domain from which an event reaches a property, according to Loves Data, an analytics training company. Google's June documentation used "google.com" as its example. Filtering on it asks a narrower question than most anti-spam rules do: not where a visitor came from, but which site recorded the visit.

What changes is the default. Under an Exclude filter, every unwanted hostname has to be named before it can be stopped, so a spammer who rotates to a fresh domain gets through until someone spots it in a report. Under an Include filter, anything unnamed is refused, subject to two exceptions set out in the same entry. The administrator's job shifts from tracking the spammers' domains to keeping an accurate record of the property's own.

Two exceptions written into the release

Measurement Protocol events pass untouched

The first bullet carves out server-originated traffic. "Hostname Include filters will not be applied to events sent from the Measurement Protocol, ensuring this data remains unblocked," according to Google. The Measurement Protocol lets developers send events to Analytics over HTTP from servers, kiosks and point-of-sale systems rather than from a browser. Google placed it in maintenance mode in June 2026, with no further enhancements planned. Each Measurement Protocol request carries an API secret as well as a measurement ID.

The release gives no rationale for the exemption beyond keeping that data flowing. Nor does it say whether hostname Exclude filters, available since June, apply to Measurement Protocol events. The carve-out is written for Include filters only.

Blank hostnames are treated as spam

The second bullet sets a default that has no equivalent in the exclude-only version. "Include filters will automatically block events with empty hostnames (such as gtag.js traffic), as a missing hostname typically indicates spam or abnormal traffic," the entry reads. That matches what practitioners have observed. Loves Data wrote in June that spam events typically carry either the spammer's own domain or no hostname at all, which reports display as (not set).

The parenthetical is ambiguous. The gtag.js library sits behind Google's site tag, the standard route by which web data reaches Analytics. Read literally, "such as gtag.js traffic" could suggest that gtag.js traffic as a class arrives without a hostname, which would describe much of ordinary web collection. The narrower reading, that Google means requests formatted like gtag.js hits but lacking a hostname, fits the rest of the sentence better. The note does not say which is intended. Since events removed by an active data filter cannot be recovered, the wording carries weight.

From exclude-only to allowlist in 102 days

Hostname filtering first appeared on the same release notes page on June 11, 2026, in an entry sharing its date with the Source Group dimension. That entry described hostname filters as "a new type of filter within the existing Data Filter section of the Admin section" and said the tool "allows customers to filter out (exclude) events based on their hostname". It joined the two data filter types already on offer, for internal traffic and developer traffic, according to Loves Data.

The June text contained a mismatch. Its stated purpose was to "make sure any data that does not come from an approved domain is not collected". An exclude list cannot deliver that. It stops only the hostnames it names, and anything new passes. The September entry's reference to "ongoing manual updates" describes the gap between what the June documentation promised and what the June product did.

Practitioners said as much at the time. Loves Data's June 12 post, by Benjamin Mangold, identified the exclude-only design and the absence of regular-expression matching as limitations, and said it looked as though Google might add an option to include hostnames. GA4 Optimizer, which publishes Analytics tooling and guides, wrote on June 17 that the exclude-only design meant filters had to be updated by hand for each new spam source. FourFront's guide, in a version dated August 12, still stated that the filter supported only exclude rules and that an include option might come later. Forty days later, it did.

Where the fake events come from

According to Loves Data, the measurement ID sits in tracking code that anyone viewing a page can read. Spammers copy it and send fabricated events directly to Analytics without visiting the site, a practice known as ghost spam or referral spam. Because those events never touch the real site, their hostname rarely matches it. Before native filters, the usual defences were configuring Google Tag Manager to fire tags only when the hostname matched the site, or building report comparisons that excluded suspect hostnames, Loves Data wrote.

Accounts of the delivery route differ, and the difference bears directly on the exemption. GA4 Optimizer described ghost spam as injected through the Measurement Protocol, bypassing both the website and Tag Manager. If that description holds for a given property, the Include filter will leave such spam in place, because Google has exempted Measurement Protocol events from it. Loves Data's account centres on the copied measurement ID alone. Google's release does not identify which route the Include filter was built to close. Its only diagnostic claim is that a missing hostname typically indicates spam.

GA4 Optimizer proposed a heavier remedy in June: routing collection through a server-side Tag Manager container, which keeps the measurement ID off the public page and can validate hostnames before anything reaches Analytics. The site acknowledged that the approach demands more technical setup and monthly cloud hosting costs.

Permanent by design

Include filters inherit the rules governing every Analytics data filter, and those rules are unforgiving. According to Google's help documentation, a property can hold at most 10 data filters, creating one requires the Editor role at property level, and a filter's effect is permanent. Data excluded by an active filter is never processed and never becomes available in Analytics or in the BigQuery export. Filters act only from the moment they are switched on and do not clean historical data, according to both Loves Data and FourFront.

Each filter sits in one of three states: Testing, Active or Inactive. In Testing, Analytics labels matching events with a dimension called Test data filter name, carrying the filter's name, so an administrator can inspect in reports and explorations what the filter would remove before activating it, according to Google's documentation.

The Include mode changes what a mistake costs. An error in an Exclude list lets spam through, which can still be segmented out in analysis. An omission from an Include list deletes legitimate data with no way back. Loves Data identified cross-domain configurations, subdomains and properties receiving data from several websites as the setups that produce multiple valid hostnames. FourFront noted that some Google-owned hostnames, such as translated or cached versions of a site, are legitimate sources of data. In June 2025, PPC Land's GA4 audit checklist described cross-domain tracking as essential for businesses operating several domains or subdomain structures. Under an Include filter, each of those hostnames has to be on the list.

The 10-filter ceiling adds a further constraint. A hostname Include filter competes for the same slots as internal traffic and developer traffic filters.

What the release leaves out

Matching rules are not described. The September entry does not say whether a hostname must match exactly, whether wildcards or regular expressions are supported, whether listing a domain also admits its subdomains, or whether www and bare domains are treated as one. Nor does it say whether matching works on full hostnames or on the registrable domain, the eTLD+1, on which many blocklists and inclusion lists are keyed.

Newer server-side routes are not addressed. The May 7 entry on the same page describes the Data Manager API as an alternative to the Measurement Protocol for sending recommended and custom events to web and app data streams. Since July 2026, Shopify purchase events have reached Analytics server to server through the Data Manager API for stores running the Google & YouTube app. The September note exempts the Measurement Protocol by name. It says nothing about events arriving through the Data Manager API, whether they carry a hostname, or whether the empty-hostname rule would catch them.

App data is not addressed either. Hostnames belong to web collection, and the release does not say how an Include filter, in particular its automatic block on empty hostnames, treats events from app data streams in a property that combines web and app.

How the two modes interact is left open. The entry does not say whether a property can run hostname Include and Exclude filters side by side, or how several Include filters combine. Nothing in it says whether the filter can tell a genuine hostname from one written into a fabricated event.

Availability is implied rather than stated. Beta entries on the same page, including those dated January 16, February 10 and May 4, carry a warning that the feature may not be available to every property. The September 21 entry carries no such caveat and gives no rollout schedule.

A year spent on what enters a property

The What's new page lists 15 release dates for 2026, running from January 16 to September 21. A large share concern the quality of what arrives in a property rather than new ways to display it. On April 29, Task Assistant added configuration recommendations, including a category for fixing data issues. On May 13, a native AI Assistant channel began classifying chatbot referrals without manual setup. On June 11, the same day the exclude-only hostname filter shipped, Source Group began folding variant strings such as facebook and fb into a single value.

The summer continued in that vein. Campaign data import began requiring a currency field on every cost upload from July 28. Two days later, a diagnostic arrived for missing GBRAID and gad_ parameters, whose absence reclassifies paid sessions as organic. On August 10, a validation report began flagging non-Google campaigns that lack cost, click and impression data. The next day, fixed conversion windows gave way to any integer from 1 to 30 days for engaged-view conversions and from 1 to 90 days for click-through conversions. On September 9, Dashboards arrived with a 15-card ceiling on standard properties.

The hostname Include filter sits at the front of that pipeline. Source Group, the currency field and the GBRAID diagnostic all label or repair data after collection. A data filter decides whether collection happens at all.

Why this matters for the marketing community

Analytics data no longer stays inside Analytics. The August 11 entry notes that conversion windows set in Analytics can also be managed through the linked Google Ads conversion management interface. The July 13 AdMob entry describes ad impressions serving as conversions for Google Ads target ROAS campaigns. Where Analytics events feed bidding, the integrity of the event stream is a media-buying matter as well as a reporting one.

The allocation of responsibility echoes a Google Ads help page PPC Land examined on September 20, which stated that Google's invalid traffic filters do not by themselves stop bogus form submissions, and placed reCAPTCHA, double opt-in and server-side validation on the advertiser's side. In both cases Google supplies a control and the property owner defines its scope. With the Include filter, the owner also carries the cost of an incomplete list, paid in permanently lost data.

For agencies running many properties, the maintenance burden moves rather than disappears. Spam domains no longer need chasing. But every new microsite, campaign landing domain or regional subdomain becomes a potential data loss if it is missing from the relevant property's list when traffic starts to arrive.

The open questions sit where Google has been building fastest: server-to-server ingestion, app streams and collection routed through servers. The September 21 release answers the central question, whether a property can refuse data from hostnames it does not recognise. It does not yet explain how that refusal interacts with the collection routes Google itself is steering customers towards.

Timeline

Summary

Who: Google, through the Google Analytics Help Center release notes. The change affects Google Analytics property administrators and editors, agencies managing multiple properties, and analysts whose reports carry spam events from unrecognised hostnames.

What: Hostname data filters, available since June 11, 2026 in an exclude-only form, now support an Include mode that works as an allowlist of approved hostnames. Events from the Measurement Protocol are exempt from Include filters, and events with empty hostnames are blocked automatically. Data filters are permanent once active, limited to 10 per property, and require the Editor role.

When: The Include mode was documented on September 21, 2026, 102 days after the exclude-only hostname filter appeared. No rollout schedule or eligibility caveat was published.

Where: In the Data Filter section of the Google Analytics Admin interface, applied to data collected in a property from the moment a filter is activated.

Why: According to Google, exclude-only filtering required ongoing manual updates to keep up with new spam sources, while an allowlist simplifies configuration. The release leaves open how Include filters treat Data Manager API events, app data streams and hostname matching rules, and the parenthetical reference to gtag.js traffic in the empty-hostname rule is ambiguous.