GA4 Hostname Filters for Arab Websites: A Safe Allowlist for Multi-Language and Salla Stores

Google Analytics 4 now lets you allow only approved hostnames into a property, and a wrong list deletes data for good. Google added hostname Include filters on 21 September 2026. A property holds at most 10 data filters, and filtered events never reach reports or BigQuery. Arab sites with Arabic subfolders, store subdomains and several markets need an inventory before any filter goes live.

What did Google add to GA4 on 21 September 2026?

Google added Include data filters for hostnames, which work as an allowlist: only events from approved domains enter the property. Until now GA4 offered only Exclude filters, which needed a manual update for every new spam source. The filter also drops events that arrive with an empty hostname.

Google’s Analytics release notes state two exceptions and one trap. Include filters do not apply to events sent through the Measurement Protocol, so those stay unblocked. They do block empty-hostname events, and Google’s own note mentions gtag.js traffic in a way that leaves the scope unclear. The same notes list dashboards (9 September) and app-conversion reporting (29 September) as separate changes.

Why is a wrong hostname list so costly?

Filtered data is gone for good. Per the PPC Land analysis of the release, excluded events are never processed, never reach reports, and never reach the BigQuery export. A filter applies only from activation onward and does not clean history. A missing hostname therefore creates a permanent hole in your trend lines.

Three more limits from that analysis matter here. A property can hold at most 10 data filters, and Include filters share those slots with internal-traffic and developer-traffic filters. Creating a filter needs the Editor role at property level. Updated 8 October 2026: Google’s hostname filter help page now documents the matching rules. Each filter takes one value in a Hostname field, with Include only or Exclude as the operation and four match types: exactly matches, begins with, ends with and contains. The page lists no regular expression option. Google’s Hostname dimension includes the subdomain (its example is www.example.com), so www.example.com and example.com arrive as two separate values. For each domain, pair an exactly matches filter on the bare domain with an ends with filter on a value that starts with a dot, such as .example.sa, which covers www and every subdomain. A plain ends with example.sa would also admit lookalikes such as fakeexample.sa, and contains is looser still.

Which hostnames does an Arab site usually send?

Most Arab sites send more than one hostname. A bilingual WordPress site may serve Arabic from a subfolder or from an “ar” subdomain, a store may sit on its own domain plus www, and a multi-market brand may run one domain per country. Every hostname that should be counted must appear in the allowlist, or its sessions disappear.

Use this inventory as the starting point. It lists the places a hostname change is most likely, based on how the platforms document their own setups, and it names the one check that confirms each.

What does Salla’s setup mean for the filter?

Salla’s GA4 setup asks you to enter your store’s domain without “https://” when you create the data stream, then install the Google Analytics app and pick the stream. Salla’s help page, updated 28 August 2026, says data collection can take up to 48 hours to begin. The store domain you type there should be your first allowlist entry.

Salla’s Google Analytics guide does not mention checkout hostnames, multi-market domains or subdomains, so it cannot tell you which hostnames arrive at the property. Salla’s help center also lists separate guides for connecting a subdomain, connecting an external domain, multi-market stores and a server-side GTM app. If you use any of those, you have a second hostname to count.

We have not run a hostname filter on a live Salla store, and we have no client case to report. What we can say is where to look: the hostname report in GA4 is the only reliable source for what your store sends today.

What Arab sites actually send, and which payment pages stay off the list

A VOCTOS crawl of 29 Arab brand homepages on 2 October 2026 suggests most allowlists stay short. Each Arabic homepage was loaded once in desktop Chrome from Cairo, and the crawl recorded the URL, redirects, hreflang alternates and Google tag IDs. It saw homepages only, so checkout hostnames were not observed, and it stored hostnames without www, so www and bare-domain use could not be counted. 8 of 37 sites returned a bot challenge or a blank page and are excluded.

The risk sits with multi-country brands and country subdomains, where every market hostname must be on the list. Payment pages are the opposite case: they send shoppers back to your thank-you page, so they belong in unwanted referrals, not in the allowlist. Google’s unwanted referrals page names third-party payment processors as a use case and allows up to 50 conditions per web data stream. The setting adds ignore_referrer to matching events instead of removing them, so it can be changed later.

After saving, watch Session source for a week. Sessions already credited to a gateway can keep that credit on later direct visits, because GA4 uses last non-direct click.

How do you roll the filter out without losing data?

Use the Testing state first. Google lets a filter run as Testing, Active or Inactive, and in Testing the matching events get a “Test data filter name” dimension, so you see what would be removed before you activate. Run it for at least one full week, covering weekend and promotion traffic, before activation.

1. Export the hostname dimension for the last 30 days and list every value, including unexpected ones.
2. Remove staging, spam and translation-cache hostnames from the list; keep every live domain, language and market host.
3. Create the Include filter in Testing state and wait seven days.
4. Compare filtered and unfiltered sessions by country, and check that Arabic pages and the checkout step still appear.
5. Activate the filter, and write the date down so future trend breaks are explained.

If you have consent banners or server-side events, read how they interact first: our guides on consent mode tracking and server-side tagging for Arab markets cover the event sources that can arrive without a normal hostname.

Not sure which hostnames your property receives? Check my GA4 hostnames.

Our read

We would turn this filter on for most Arab sites, but only after a seven-day Testing run. The benefit is real: a fixed allowlist stops ghost domains from polluting reports, with no more manual exclude lists. Updated 8 October 2026: The risk is also real, because the loss is permanent. Google now documents four match types, but a missing www, language or country hostname still deletes those sessions for good.

Our position is simple. If your site has one domain and no server-side tagging, the filter is low risk and worth a test this month. If you run several markets, an Arabic subdomain, or a platform setup you did not build yourself, audit the hostnames first. A clean report is not worth a blank week of Arabic traffic. For the wider measurement picture, see our GA4 AI traffic guide for Arab markets.

FAQ

Will the hostname filter fix my old spam data?

No. Google’s filter applies only from the moment you activate it, and it does not clean data already stored. Past sessions from unwanted hostnames stay in reports, so annotate the activation date and compare trends before and after that date, not across it.

My Arabic pages are on a subdomain. Do I list it?

Updated 8 October 2026: Yes. GA4 treats each subdomain as its own hostname value, so ar.example.sa is separate from example.sa and www.example.sa. Add an exactly matches filter for the bare domain and an ends with filter on .example.sa, which covers www and every subdomain. Check the Testing report before you activate the filter.

Can I test the filter without losing data?

Yes. Google offers a Testing state in which matching events receive a “Test data filter name” dimension instead of being deleted. Run it for at least seven days, review which hostnames would be removed, and only then switch the filter to Active.

Does it block server-side events?

Events sent through the Measurement Protocol are exempt from Include filters, per Google’s release notes. Other server-side events that arrive with an empty hostname are blocked. Check a sample of your server-side events for a hostname value before you activate anything.

Does my hostname filter count against a limit?

Yes. A GA4 property holds at most 10 data filters in total, and hostname Include filters share those slots with internal-traffic and developer-traffic filters. Review your existing filters in Admin before you add one, keep the hostname list short, and remove any filter you no longer use.

Where to start this week

If you can see every hostname in a 30-day report and none surprises you, create the filter in Testing state today. If the report shows hosts you do not recognize, or your tracking was set up by an agency or platform app you cannot inspect, audit first and filter second. For help with the audit, talk to us about my analytics setup.