This article has been updated for Google Analytics 4.
GA4 automatically excludes traffic from known bots and spiders. Known bot traffic is identified via Google research as well as a list maintained by the Interactive Advertising Bureau (IAB). [Source]
If your site is affected by spam or bot traffic NOT automatically excluded by Google
Occasionally websites will be affected by spam or bot traffic that is not automatically excluded by Google. Typically this is NOT traffic that is hitting your site at the server level, but because it is showing in analytics, it will impact RPM calculations and Site Health metrics. It does not impact actual revenue or earnings.
First, confirm with your host whether the traffic is hitting their servers as actual traffic to your site. If they can see it, this is something you'll want to work with them on.
If your host confirms that traffic is not hitting servers, you can create a report filter in GA4.
If you'd like to manually calculate RPM for the days that you experienced the surge in bot traffic or referral spam, use the following formula:
Total Traffic - Bot Traffic = Adjusted Traffic
EARNINGS / Adjusted Traffic * 1000 = Correct RPM