How to Block Ghost Spam in GA4

Step 1: Create a Measurement Protocol API Secret

1. Go to your Google Analytics 4 dashboard.
2. Click Admin (the gear icon in the bottom left).
3. Under Data collection and modification, click on Data Streams.
4. Click on your website’s data stream.
5. Scroll down to the Additional settings section and click on Measurement Protocol API secrets.
6. Click Create and give it a nickname (like GTM Secret).
7. GA4 will generate a long string of letters and numbers. Copy this Secret Value.

Step 2: Add the Secret Key to Google Tag Manager

Now you need to give GTM the “password” so GA4 accepts your real website traffic.

1. Open Google Tag Manager.
2. Go to your main GA4 Google Tag (the configuration tag that initializes GA4 on your site).
3. Under Configuration Settings, you need to add a parameter:
   • Configuration Parameter: api_secret
   • Value: Paste the Secret Value you copied from GA4.
4. Publish your GTM container.

Once this is live, GA4 will check every incoming hit. If a spammer sends a hit directly to your GA4 measurement ID without that exact api_secret, GA4 will quietly drop it into the trash. Your real data stays clean, and the spammers are blocked.