What changed
On September 21, 2026, Google Analytics added hostname Include filters, letting administrators allowlist approved hostnames for eligible collected events. Google explicitly states that the Include filter is NOT applied to Measurement Protocol events, while events with empty hostnames are blocked. This is a meaningful limitation for Measurement-ID spoofing and server-side event ingestion; it cannot be described as universally stopping ghost traffic.
Why it matters
Ghost traffic can pollute a GA property without visiting the actual website when third parties send events using a site's Measurement ID. Exclusion rules are reactive: every new spam hostname creates another value to maintain. An allowlist reverses the model so only known legitimate hostnames are accepted, improving traffic, attribution and conversion analysis without an ongoing spam-domain chase.
The control moves from denylist to allowlist
Previously, hostname cleanup relied heavily on excluding unwanted values. The new Include filter lets an administrator specify the hostnames that are legitimate for the property and reject everything else. That is simpler for sites with a known set of production, staging or campaign domains.
It cannot stop Measurement Protocol spoofing
A Measurement ID can be abused to submit synthetic events via Measurement Protocol. Google's official September 21 release notes explicitly say hostname Include filters do not apply to Measurement Protocol events, so this filter does not protect that ingestion path. For browser-tagged events with unexpected hostnames, allowlisting remains useful; server-side and API-sent events require separate validation and monitoring.
Configuration mistakes can now delete legitimate data
An allowlist is stronger precisely because unmatched events are discarded. Teams with multiple domains, payment flows, embedded applications or staging environments need to inventory legitimate hostnames before moving a filter from testing to active enforcement.
The documented ingestion exceptions matter
Google explicitly exempts Measurement Protocol events from hostname Include filtering and says the filter blocks events with empty hostnames. Teams using server-side tagging, multi-domain sites or mixed event pipelines should test what each collection path actually sends. A blank hostname is not automatically spam in every implementation, and filters can discard legitimate events if misconfigured.