Your own team is in your analytics
Every site has staff, developers, agencies and clients visiting it — often heavily, often on the pages that matter most. Unfiltered, they inflate sessions, distort conversion rates and occasionally generate conversions from testing a form.
On a low-traffic site this is not a rounding error. It can be a third of the data.
The step everyone misses
GA4 filters have two stages, and the second is easy to overlook.
Define the filter — usually by IP address, matching traffic tagged as internal by the data stream's internal traffic rule.
Activate it. A newly created filter defaults to testing, which means it does nothing except let you preview the effect via a dimension.
A filter left in testing state looks configured and filters nothing. This is probably the single most common analytics misconfiguration, precisely because the interface shows a filter that appears to exist.
The IP problem
IP-based filtering assumes static IPs and office-based work. Neither is reliable now. Remote staff on domestic connections, mobile networks, and VPNs all bypass it.
Partial mitigations:
A named list of known IPs for offices and any static home connections. Better than nothing.
A cookie-based opt-out — a page that sets a cookie, a tag that suppresses on that cookie. Requires everyone to visit it on every device and browser, which they will not, but it catches the frequent visitors who cause most of the distortion.
A separate staging property for pre-production, so testing never touches production data at all. This is the one that actually works and it requires the discipline to keep environments separate.
Do not filter retrospectively
Filters are not retroactive. Data collected before activation stays. If you need a clean historical view, that is a reporting-layer exclusion, not a filter.
The check worth running
Look at your top pages by users and ask whether any of them are pages only your team would visit — an admin login, a style guide, a test page. If those have meaningful traffic, your filter is not working, whatever its status says.