Here is a pattern worth being able to recognize, because it turns up constantly on small business sites and it fools people who should know better.
Your analytics reports 477 users over the last three months. Search Console, for the same period, reports 3 clicks. You are looking at two reports from the same company about the same website and they disagree by more than a hundred times.
Somebody sold you traffic, or somebody is counting something that did not happen. Usually the second.
First, these two things were never supposed to match
Before assuming a fault, understand what each one counts, because they are not measuring the same thing and a gap between them is normal.
Search Console counts clicks from Google search results only. Somebody searched, saw your listing, clicked it. That is the entire universe it reports on. Not Bing, not direct visits, not a link from Facebook, not somebody typing your address in.
Analytics counts sessions from everywhere. Search, social, direct, email, a link in someone’s newsletter, and your own visits if you have not excluded yourself.
So analytics should always be the larger number. On a healthy small business site the ratio might be two or three to one. A gap of a hundred and fifty to one is not a difference in definitions. That is something else.
The usual explanation
Referral spam, and it is worth understanding how it works because the mechanism explains why the obvious fixes fail.
Your analytics measurement ID is a short public string that sits in the source code of every page on your site. Anyone can read it. Analytics accepts data sent directly to its servers using that ID, which is what makes it possible to track things other than web pages.
Spammers use that. They send fabricated visits to your property, with a referrer set to a domain they want you to look at. The hits never touch your website. Your server has no record of them, because nothing was ever requested from it. They exist only inside your reports, which is exactly where the spammer wants them, because reports are read by the business owner they are advertising to.
How to identify it in about a minute
The shape is distinctive.
Look at the traffic graph over ninety days. Real traffic to a small business is a low, noisy line that wanders around. Spam is a flat line at nearly zero and then one enormous vertical spike on a single day. If your chart looks like a heart monitor that flatlined and then got startled, that is your answer.
Look at the referrer names. In GA4, open Reports, then Acquisition, then Traffic acquisition. The table defaults to channel groups. Change the dimension dropdown just above the first column to Session source / medium.
You are looking for domains that are obviously selling something. Names containing words like traffic, seo, buy, cheap, or a top level domain you do not recognize. A domain whose name is a sales pitch, sending you four hundred visits in one day, is a sales pitch.
Look for numbers that cannot both be true. Spam frequently reports absurd engagement, because the fabricated data was never constrained by physics. An engagement rate above ninety percent on hundreds of sessions, on a site where everything else sits near fifteen percent, is not a suddenly fascinating page.
Add hostname as a second dimension. Click the plus sign next to the dimension dropdown and choose Hostname. This shows which domain each session claims to have happened on. Sometimes the spam declares a hostname that is not yours at all, which settles it immediately. Sometimes it copies yours, which does not clear it, it just means you rely on the other three signals.
The popular fix makes it worse
Search this problem and nearly every result will tell you to use the unwanted referrals setting in your data stream configuration.
Do not.
That setting does not remove anything. It reclassifies those sessions as direct traffic. Four hundred and sixty five obviously fake referral visits, which announce themselves with a ridiculous domain name, become four hundred and sixty five plausible looking direct visits with no label on them at all. You have not deleted the problem. You have camouflaged it, from yourself, permanently.
The setting exists for a legitimate purpose, which is stopping your own payment processor or booking system from appearing as a referrer when a customer comes back from it. It is the wrong tool for this.
What to do instead
Draw a line and date from it. If the spam arrived in a burst on a known day, run your reports from after that day. Simple, honest, and it costs nothing.
Do not quote a number that the other system cannot corroborate. This is the durable lesson. Two independent measurement systems agreeing is the test for whether a figure is real. When you remove the junk referrers and the remaining organic sessions line up with Search Console’s clicks, both systems are describing the same reality and you can trust the pair. When they disagree by two orders of magnitude, believe neither until you know why.
Leave your measurement ID alone. People suggest generating a new one to escape the spam. It breaks your history, it is a code change, and scrapers find new IDs quickly. It is a large cost for a speculative benefit. Reserve it for a genuine, repeating problem.
Check whether it recurs. One burst on one day is noise. A monthly pattern is a different conversation.
Why this matters more than a tidy report
Two reasons, and the second is the expensive one.
The first is that decisions get made on these numbers. If you believe 477 people visited, you conclude the website is working and the problem is conversion. You then spend money redesigning a page that four real people saw. The diagnosis was wrong because the input was wrong.
The second is that traffic numbers are the easiest thing in this industry to present flatteringly. An agency reporting “traffic up 400% this quarter” on a chart with one enormous spike in it, without ever cross checking against Search Console, is either not looking or hoping you will not. I cannot tell you which from the outside, and neither can you, which is the point. It is one of the specific things worth asking about, along with everything else in how to tell whether an SEO proposal is worth anything.
The same instinct applies to how the work is paid for. A model that rewards spend rather than results has the same shape of problem, which is covered in why paying an agency a percentage of ad spend is misaligned with you.
The short version
Analytics counts everything and can be lied to. Search Console counts Google clicks and cannot, because it is measuring its own search results. When they disagree wildly, believe Search Console and go find out what analytics is counting.
Getting to a set of numbers you can actually act on is most of the value of measurement, and it is where search work should start rather than end. If your reports say something you do not believe, tell me what they say and I will tell you whether it is real.
