Bot detection vendors charge per request and integrate awkwardly with sGTM. For most sites, three simple heuristics catch the majority of bot traffic that pollutes reports, with no vendor needed and no per-request cost.

Heuristic 1: user agent matches a known pattern

Real browsers have predictable user agents. Bots either advertise themselves (SemrushBot, AhrefsBot, etc.) or use a minimal UA that is shorter than any real browser would send.

const ua = getRequestHeader('user-agent') || '';
const lower = ua.toLowerCase();
const botPatterns = ['bot', 'crawler', 'spider', 'scraper', 'curl', 'wget', 'headless'];
const isUaBot = botPatterns.some(p => lower.indexOf(p) !== -1) || ua.length < 30;

Heuristic 2: missing or malformed Accept-Language

Real browsers always send an Accept-Language header. Many bots do not, or send something obviously wrong (a single character, an unrecognised locale code).

const acceptLang = getRequestHeader('accept-language') || '';
const isLangBot = acceptLang.length < 2 || !/^[a-z]{2}/.test(acceptLang.toLowerCase());

Heuristic 3: geographically improbable behaviour

A user landing on a French-language page from a Hetzner cloud IP in Germany, with a user agent claiming to be a Mac, is very probably a bot. The combination of cloud-provider IP plus mismatched language plus suspicious UA is rarely a real user.

A simple version: if the IP belongs to a known cloud provider (DigitalOcean, AWS, Hetzner, OVH ranges) AND there is no referer AND no _ga cookie, treat as bot.

Combine into a single variable

const ua = getRequestHeader('user-agent') || '';
const accept = getRequestHeader('accept-language') || '';
const ref = getRequestHeader('referer');
const cookie = getCookieValues('_ga')[0];

const uaBot = /bot|crawler|spider|scraper|curl|wget/i.test(ua) || ua.length < 30;
const langBot = accept.length < 2;
const noContext = !ref && !cookie;

return uaBot || langBot || noContext;

Add as an exception trigger on every tag that should not fire for bots. The tag fires only when the variable returns false.

When heuristics are not enough

Sophisticated bots (residential proxies, headless browsers with full cookie support, scraping farms that mimic human behaviour) bypass simple heuristics. If your bot problem is dominated by these, you do need a commercial vendor.

For the typical case (SEO scrapers, security scanners, automated content fetchers), the three heuristics above filter 90 percent or more of the volume. The remaining 10 percent is small enough to ignore. A more aggressive layered approach is in the broader bot-blocking post.