TL;DR
- Google Analytics added an Include (allowlist) mode to hostname data filters on 21 September 2026; before that the filter could only exclude named domains.
- Under Include, events from any unlisted hostname are dropped, and events with an empty hostname are blocked automatically, per Google's release note.
- Measurement Protocol events are exempt from hostname Include filters, so spam sent through that route still gets in.
- Filtered data is permanent and cannot be recovered in GA4 or BigQuery, so Google recommends 24-36 hours in Testing mode before activating.
Google Analytics added an Include mode to its hostname data filters on 21 September 2026. A property can now keep an allowlist of the domains that are allowed to send it event data, and GA4 drops events from any hostname that is not on the list. Until this release, the hostname filter could only exclude domains one at a time.
The change is the top entry on Google's "What's new in Google Analytics" release notes, headed "Hostname filters". It is one paragraph and two bullet points long, and those two bullets carry most of the practical weight. This post walks through what the release says, what Google's data filter documentation adds, what the release leaves unsaid, and what a Thai business running GA4 should check before switching the filter on.
What Google changed on 21 September 2026
According to the release note, Google Analytics "now supports Include data filters for hostnames, allowing you to create an allowlist of approved domains authorized to send event data to your property." Google framed it against the older version: "Previously, filtering was limited to Exclude filters, which required ongoing manual updates to keep up with new sources of spam."
That sentence describes the real weakness of the exclude-only filter. Under Exclude, every unwanted hostname has to be named before it can be blocked. Spammers who rotate to a fresh domain get through until somebody notices the new domain in a report and adds it. Under Include, the logic flips. Anything that is not named is refused. The analyst's job changes from tracking the spammers' domains to keeping an accurate list of the business's own domains.
Google says defining approved hostnames up front "simplifies configuration and helps ensure the integrity of your analytics data with minimal maintenance." That is Google's own description. The release carries no figures on spam volume, adoption of the older filter, or how much data either mode removes.
The two exceptions written into the release
The release note lists two "details to note", and both change how the filter behaves in practice.
Measurement Protocol events are not filtered
Google wrote that "Hostname Include filters will not be applied to events sent from the Measurement Protocol, ensuring this data remains unblocked." The Measurement Protocol is the route developers use to send events to GA4 from servers, point-of-sale systems and back-office tools rather than from a browser. The practical reading: an Include filter protects the browser-collected stream. It does not police server-to-server hits, and the release does not say whether the older Exclude filters apply to Measurement Protocol events either.
Events with an empty hostname are blocked automatically
The second bullet reads: "Include filters will automatically block events with empty hostnames (such as gtag.js traffic), as a missing hostname typically indicates spam or abnormal traffic." Blank hostnames show up in GA4 reports as "(not set)", and they are a common sign of ghost spam, where fake events are sent straight to a property using a measurement ID copied from a page's source code.
The parenthetical "such as gtag.js traffic" is ambiguous. Read literally, it could suggest that gtag.js hits as a class arrive without a hostname, which would describe much of ordinary web collection. The narrower reading, that Google means requests shaped like gtag.js hits but missing a hostname, fits the rest of the sentence better. Google does not say which it means. Because filtered data cannot be recovered, that ambiguity is a reason to test before activating.
Exclude versus Include, side by side
The table below sets out how the two hostname filter modes differ, using only what Google's release note and help pages state.
| Question | Exclude (since June 2026) | Include (since 21 Sep 2026) |
|---|---|---|
| What gets dropped | Only hostnames you list | Every hostname you did not list |
| New spam domain appears | Gets through until you add it | Blocked automatically |
| Empty hostname events | Not stated in the release | Blocked automatically |
| Measurement Protocol events | Not stated in the release | Not filtered |
| Cost of a mistake | Spam leaks into reports | Real data from an unlisted domain is lost |
What Google's data filter documentation adds
The release note is short, but the hostname filter sits inside GA4's existing data filter system, and Google's help pages for that system set the rules. Three of them matter here.
First, the effect is permanent. Google's data filter documentation states that once a data filter is applied, "the effect on the data is permanent", and excluded data "is never processed and will never be available in Google Analytics or BigQuery." Filters also work only from the moment they are created. They do not clean historical data.
Second, every data filter has three states: Testing, Active and Inactive. In Testing, GA4 tags matching events with a dimension called "Test data filter name" instead of dropping them. Google's hostname filter guide recommends leaving the filter in Testing for 24 to 36 hours, then building a free-form exploration with Test data filter name, Event name and Event count to see exactly what would be removed, grouped by hostname.
Third, the setup needs the right role and has limited matching. Google's guide says you must be an Editor or above at property level to create a data filter, and it lists two match types for hostnames: "Exactly matches" and "Contains". After a filter is switched to Active, Google says it begins filtering within 24 to 36 hours.
What the release does not say
Several details that decide whether an allowlist is safe to switch on are not covered by the 21 September note.
- It does not say whether listing a domain also admits its subdomains, or whether www and the bare domain count as one hostname. With only "Exactly matches" and "Contains" available, those cases depend on how the list is written.
- It does not mention regular expressions or wildcards.
- It does not say how events that reach GA4 through newer server-side routes, such as the Data Manager API, are treated.
- It does not explain why Measurement Protocol traffic is exempt beyond "ensuring this data remains unblocked".
None of these gaps make the feature risky by default. They mean the Testing state is doing real work, and skipping it is where businesses are most likely to lose data.
Who should use the Include filter, and who should wait
A property that collects from one website on one domain, with no subdomains, no cross-domain checkout and no embedded third-party booking engine, has an easy allowlist. It is one or two hostnames long, and an Include filter removes a whole category of spam with little upkeep.
Properties with several valid hostnames need more care. Common Thai setups include a main site plus a separate shop subdomain, a booking or payment step hosted on a vendor's domain, a staging site that should not report into production, and landing pages built on third-party page builders that sit on their own hostnames. Every one of those production hostnames has to be on the allowlist. Miss one and its events are gone for good, with no way to restore them later.
There is also a question of what the filter will not fix. Spam that arrives through the Measurement Protocol passes straight through an Include filter under Google's stated exemption. Referral spam that carries a real-looking hostname you have listed would also pass. The allowlist narrows the problem, but it does not close every route.
A checklist before you switch the filter on
- Pull a Hostname report for the last 90 days. In GA4, add the Hostname dimension to an exploration with Event count. Write down every hostname that carries real traffic.
- Mark which of those are yours, which belong to partners you rely on (payment, booking, chat widgets), and which are spam.
- Create the hostname filter in Include mode with your list and leave it in Testing.
- After 24 to 36 hours, build the validation exploration Google describes and check which events would be removed. If a real hostname appears, fix the list.
- Check the "(not set)" hostname rows. If a large share of your legitimate conversions carry an empty hostname, find out why before activating, because Include will drop them.
- Only then switch the filter to Active, and note the date in your analytics change log so later trend breaks can be explained.
What this means for Thai marketers
Many Thai businesses run GA4 across a mix of domains: a brand site, a LINE-linked landing page, a Shopee or Lazada store link, and campaign microsites. GA4 only sees the pages where its tag is installed, so marketplace storefronts are not affected. Anything that does carry your tag, including microsites made for a single campaign, needs to be on the list for as long as it runs.
The payoff is cleaner session and conversion counts, which feed Google Ads bidding when GA4 conversions are imported. The risk is quietly deleting real conversions, which would then be missing from both reporting and bidding. If you are not sure how your property is wired, a GA4 setup and audit is the safer first step, and it is worth confirming how imported conversions feed your Google Ads campaigns before any filter goes live.
Frequently asked questions
What is a hostname Include filter in GA4?
It is a data filter that keeps only events from hostnames on your approved list and drops everything else. Google added it on 21 September 2026; before that, the hostname filter could only exclude domains you named one by one.
Does the Include filter stop all GA4 spam?
No. Google's release says Measurement Protocol events are not subject to hostname Include filters, so spam sent through that route passes. It does block events from unlisted hostnames and events with an empty hostname.
Can I get data back if the filter removes real traffic?
No. Google's documentation says data removed by an active data filter is never processed and is not available in Analytics or BigQuery. That is why Google recommends running the filter in Testing mode first.
How long should I test before activating?
Google's hostname filter guide says to wait 24 to 36 hours in Testing before validating, and that an Active filter starts working within 24 to 36 hours. A longer test window that covers a full weekly cycle gives a more complete picture of your real hostnames.
Is this available in Thailand?
The release note does not limit the feature by country. Data filters are a property-level setting in GA4, so the Include option should appear under Admin, Data collection and modification, Data filters for any property where you hold the Editor role.
The Include filter is a sensible default for most single-domain sites and a careful project for multi-domain ones. Test it, read what it would remove, and only then make it permanent.
