What is Referral Exclusion List?

When a customer leaves your site to pay through a gateway like Stripe or PayPal, or authenticates through an SSO provider, their browser genuinely navigates away and back. Without an exclusion rule, GA4 reads that return trip as a brand-new visit from an external site. That does two things at once: it starts a fresh session, splitting one customer journey into two or more, and under GA4's default attribution model it overwrites whatever channel actually brought the customer in.

Where to find it:

Admin > Data Streams > [your web stream] > Configure tag settings > Show more > List unwanted referrals. Add the payment or auth domain (checkout.stripe.com, paypal.com, etc.) and GA4 stops treating traffic returning from it as a new session source.

Why it matters:

This is one of the higher-impact findings in a GA4 audit because it corrupts the number marketing teams act on directly: which channel actually drives revenue. A NiceLookingData audit checks the last 30 days of session-source data against a list of common payment and auth domains (Stripe, PayPal, Shopify Checkout, Klarna, Adyen, Braintree, Google Pay, Apple ID, Auth0, and others) and flags it once more than 10 sessions show the pattern, since below that it's noise and above it it's a real attribution leak.

Two pitfalls come up constantly:

1. Subdomains aren't covered automatically. Excluding stripe.com doesn't exclude checkout.stripe.com unless you add it explicitly. Plenty of stores exclude only the parent domain and the leak continues unnoticed.
2. It's easy to confuse with cross-domain tracking. The two settings solve related but different problems. Cross-domain tracking passes your own identifiers between domains you control, like a subdomain checkout you own. The referral exclusion list ignores domains you don't control that legitimately redirect users back to you. Sites often configure one and assume it covers the other.

Example: A store runs a Meta ad campaign that converts well, but checkout happens on checkout.shopify.com, which isn't on the exclusion list. Every completed purchase gets attributed to "Referral: checkout.shopify.com" instead of Meta. The campaign looks like it drives zero revenue in GA4, while Shopify's own order data shows it's the top performer. The fix is one entry in Configure tag settings.

See the related setup details in GA4 Cross-Domain Tracking: Setup, Testing, and Common Pitfalls, and how this feeds into credit assignment in GA4 Attribution Models Explained.