GA4 hostname include filters and User Groups Admin API

Google Analytics 4 shipped a run of changes between 10 August 2026 and 5 October 2026, and three of them change daily work: Include filters for hostnames (21 September 2026), Dashboards (9 September 2026) and a User Groups Admin API (5 October 2026). Most teams need to act on one or two of these, not all of them.

The rest of the list is narrower but still touches reporting numbers: custom conversion lookback windows, app conversions in cross-channel conversion reports, and a validation report for campaign data imports.

Key takeaways

• Hostname Include filters let you list the domains allowed to send data to a property, which replaces chasing spam with an ever-growing exclude list.
• Include filters block events with an empty hostname, including gtag.js traffic, so test before you activate one. Measurement Protocol events are not filtered.
• Dashboards put KPIs on a single report. They are a presentation layer, not a fix for unreliable underlying data.
• The User Groups Admin API is for organisations managing access across many properties and people. Small teams can ignore it.
• Conversion window and app conversion changes alter attribution results, so record the date of every change you make.

What changed in Google Analytics 4 between August and October 2026

Six releases in the notes are worth a practitioner's attention. The campaign data import validation report (10 August 2026) is the only one where the notes are brief, so read the linked documentation before you plan around it.

Release	Date	Who it affects	Action
User Groups Admin API	5 October 2026	Admins running many properties or large teams	Review how access is managed today; automate only if it is painful
App conversions in conversion reports	29 September 2026	Teams with Google Ads app campaigns	Check whether your property is eligible; review app attribution settings
Hostname Include filters	21 September 2026	Anyone seeing spam or foreign-domain traffic	Audit hostnames, then test an allowlist
Dashboards	9 September 2026	Analysts and stakeholders who want one-page KPI views	Build one dashboard for one audience first
Custom conversion windows	11 August 2026	Teams with long or short buying cycles	Compare your cycle against the old preset windows
Campaign data import validation report	10 August 2026	Teams importing non-Google campaign data	Run the report and fix what it surfaces

None of these is a migration. All of them are settings or surfaces you can adopt gradually, which is the right way to treat them.

Should you use GA4 hostname Include filters?

If spam or stray-domain traffic is a recurring problem in your property, yes. If your data is clean and your site runs on one domain, the benefit is small and the risk is not zero.

Until 21 September 2026, hostname filtering in GA4 was limited to Exclude filters. You had to notice a bad hostname before you could block it, and the list never stopped growing. An Include filter flips the logic. You name the hostnames you trust, and everything else is blocked. For a company with a handful of known domains, that is far less maintenance.

Two behaviours in the release notes deserve attention:

• Empty hostnames are blocked. Events with no hostname, such as gtag.js traffic, are blocked automatically, because a missing hostname usually indicates spam or abnormal traffic.
• Measurement Protocol is exempt. Events sent through the Measurement Protocol are not filtered by hostname Include filters, so server-side data keeps flowing.

The first point is the one that catches teams. If you collect data legitimately from something that arrives without a hostname, an Include filter will drop it silently. Gaps in a report are much harder to spot than spam in a report.

Here is a worked example. A retailer runs a main shop, a checkout subdomain, a separate loyalty site and a help centre hosted by a vendor. Someone builds the allowlist from the three domains they remember. The help centre is missed, its traffic vanishes, and nobody notices until a support-deflection report looks odd a month later. The fix is not complicated. It is an audit done before the filter goes live.

How do you set up a hostname allowlist without losing data?

Build the list from evidence, not memory. Then stage the change so you can compare before and after.

1. Pull a hostname breakdown for a representative period in an exploration. Include low-volume rows; legitimate third-party properties often hide there.
2. Sort each hostname into three groups: yours, partners you deliberately track (payment pages, booking engines, embedded tools), and noise.
3. Check which collection paths feed the property. Anything arriving without a hostname will be blocked; anything via Measurement Protocol will not be touched.
4. Apply the filter in a test or secondary property first if you have one, and use any testing state the filter offers before activating it.
5. Write the change into your annotation log with the date, the list and the owner.
6. Compare event counts and key event counts before and after for a full week, by hostname and by channel.

Do not treat spam volume as the success metric. A filter that removes spam and a real checkout subdomain at the same time looks like a win in the session count and a disaster in revenue. Watch key events and revenue by hostname alongside raw traffic.

This is a job most in-house analysts can do in an afternoon. A partner earns their fee only when the domain estate is messy: many brands, vendor-hosted pages, legacy subdomains or a tag setup nobody has documented.

What are GA4 Dashboards good for, and what are they not?

Dashboards, released on 9 September 2026, give you a way to view KPIs on a single report. The notes describe a new interface with simpler visualization creation, drag-and-drop layout and new report visualizations.

The practical value is audience separation. Standard reports and explorations serve analysts. A dashboard can serve the commercial director who wants five numbers and a trend, without asking them to learn the report library. If you have been rebuilding the same view in a slide deck or an external tool every Monday, this is worth a trial.

It will not repair a weak measurement plan. A dashboard with six tiles pulling from a badly defined key event is just a faster way to circulate a wrong number. Before building, settle which events count as key events, which channel grouping you trust and which date range convention you use.

A sensible first pass looks like this:

• Pick one audience and one decision. For example, a paid media lead who decides weekly budget shifts.
• Limit the first dashboard to a handful of visualizations, each tied to a metric you can define in one sentence.
• Put the definition next to the number, in a shared note or the dashboard title.
• Review it with the audience after two weeks and remove whatever nobody opened.

What to ignore: the urge to recreate every existing report as a dashboard. Reports that analysts use in exploration do not need a second home.

Do you need the User Groups Admin API?

Only if access management is already a chore. The API, announced on 5 October 2026, lets you manage user group access to properties and accounts programmatically. You can create, edit and delete groups using their unique identifier. You can also add users to groups, remove them and assign a Member or Owner level. The notes say User Admin or Org Admin permissions are required on the organization.

The case for it is scale. A group with fifty analysts across twelve properties, with people joining and leaving every month, is exactly where a script beats a person clicking through screens. The case against it is that a script can remove or grant access faster than anyone can review it, so mistakes spread quickly.

If you do automate, keep the logic boring. Drive membership from a source of truth such as your HR or identity system, log every change, and run the first few cycles in report-only mode that lists the changes it would make. Keep Owner assignments manual or require a second approver. Check the reference documentation and the Developer Changelog that the release notes point to for request details rather than relying on a summary.

A team with three properties and ten users should skip this entirely. The better use of their time is an access review: who has edit rights, who has left, and which groups exist only because someone made them in 2023.

What do custom conversion windows and app conversions change?

They change the numbers you report, which is why they need dates attached.

On 11 August 2026, Google Analytics conversions gained custom integer lookback windows. Click-through conversion windows can be any integer from 1 to 90 days, where before you chose from presets of 1, 7, 14, 30, 60 or 90. Engaged-view conversion windows can be any integer from 1 to 30 days, where before they were fixed at 3 days. You set them under Advertising > Conversion management > more options icon > Settings, and in the linked Google Ads conversion management interface.

That matters most if your sales cycle sits awkwardly between presets. A B2B team with a typical consideration period of about three weeks was forced to choose 14 or 30 days. Now a window that matches the real cycle is available. The risk is comparability: change a window and you change how much credit channels receive, so month-over-month trends stop being like for like.

On 29 September 2026, app conversions became fully supported in conversion reports, covering performance, attribution analysis and attribution models. Attribution settings can also be adjusted independently for app conversions. The notes add two caveats: the feature may not be available to your property while Google expands it, and cross-channel budgeting features currently support web conversions only. If you run app campaigns, ask your support contact about eligibility rather than assuming it.

Finally, the campaign data import validation report from 10 August 2026 is designed to help you assess non-Google campaign data and imported campaign data. If you import cost or campaign data from other platforms, run it. Naming mismatches in imports are a common reason paid channels look better or worse than they are.

How should you roll these changes out?

One change at a time, with an owner, a date and a comparison. The table below is a workable checklist.

Step	Owner	Evidence you need	Done when
Hostname audit	Analytics lead	Hostname breakdown, tag inventory	Every hostname is classified as yours, partner or noise
Include filter test	Analytics lead with web developer	Before and after event counts by hostname	No drop in key events from known domains
First dashboard	Reporting analyst	One audience, one decision, metric definitions	The audience confirms it replaces a manual report
Access review	Property admin	List of users, groups and owners	Stale users removed; automation decision recorded
Conversion window review	Paid media lead	Sales cycle data, current settings	Window chosen and dated in the annotation log
Import validation	Marketing operations	Validation report output	Mismatched campaign data corrected at source

Space the changes out. If you change a conversion window and activate a hostname filter in the same week, you will not be able to explain a movement in either number.

How do you measure whether it worked, and what should you avoid?

Measure each change against the problem it was meant to solve, not against traffic totals.

For the hostname filter, the signals are the share of events from unrecognised hostnames, which should fall, and key events from your own domains, which should not. For dashboards, count how many scheduled manual reports disappear. For group management, track the time from a leaver notice to access removed. For conversion windows, compare attributed conversions per channel under the old and new settings for the same period, and keep both views until stakeholders accept the new baseline.

Avoid these mistakes:

• Switching on an Include filter without checking for events that arrive with no hostname.
• Assuming Measurement Protocol data will be cleaned by a hostname filter; it is exempt.
• Building dashboards before agreeing metric definitions.
• Automating group membership before reviewing who should have access at all.
• Changing conversion windows without logging the date, then explaining a trend break as a market shift.
• Assuming app conversion reporting is available on your property without checking eligibility.

None of this requires heroics. Each item is a small hygiene task that pays off the next time somebody asks why a number moved.

Where does an implementation partner help, and where can you do it yourself?

You can do most of this yourself. A hostname audit, a first dashboard, an access clean-up and a conversion window decision all sit within the reach of a competent analytics team with admin rights.

A partner becomes worth the money in three situations. The first is a fragmented domain and tag estate, where the question of what should be on the allowlist is really a question of what is running on the site. The second is organisation-wide access governance, where the API sits inside a broader identity and process design. The third is attribution change across paid channels and app campaigns, where the settings are easy but the reconciliation with finance and ad platforms is not.

If you do bring someone in, brief them on outcomes: which numbers must not move, which data must keep arriving, and what you want documented at the end. The GA4 RFP template gives you a structure for that brief. To see who works in this area, start with the GA4 partners directory, and for more write-ups on analytics changes, browse the MarTech Partners blog.

For everyone else, the order of play is simple: audit hostnames this week, review access this month, and leave the rest until you have a decision it would improve.

Sources

• Google Analytics Help: What's new in Google Analytics — Release notes for 10 August 2026 to 5 October 2026 covering hostname Include filters, Dashboards, the User Groups Admin API, conversion windows, app conversions and the campaign data import validation report.