Your traffic chart just went vertical and your heart did the same.
Before you ping the team at one in the morning, breathe and open Google Analytics with a plan.
Start with the basics that calm the room. Open Real Time and verify that the spike is not already gone, because a spike that vanishes in seconds is often bot traffic or a one link blast from a high follower account that cooled off. Flip to Acquisition and check Source Medium, then look at the top Landing Pages. If the spike is almost entirely one page, think social or press, not a site wide bug. If it touches every page in a flat pattern, think measurement problems like a duplicate tracking snippet or a tag that now fires twice after a theme tweak. Confirm that sessions are tied to your hostname, since the recent wave of referral spam is still crawling and polluting reports for anyone who did not filter it out. Glance at New vs Returning and Device Category to see if this is a fresh audience on mobile from a social share or your same users bouncing around because of a tracking change. Check your time zone setting and remember we just shifted clocks in many places, so reported late night spikes can be a side effect of daylight changes rather than a true surge.
Now turn the spike into a story. Pull a quick segment that isolates the suspicious surge by Source Medium, Campaign, or a Landing Page that is taking off, then compare against the prior week and the same day last week. If the source reads t dot co or m dot facebook with one or two landing pages, this is probably a share that hit the right thread, which you can confirm by checking Twitter search, Facebook search, or that Product Hunt and Hacker News did not happen to feature you on their front pages. If the source says direct for a very specific path with lots of one page sessions, expect people arriving from native apps, chat threads, or email apps that strip referral data, and back that hunch by checking the timestamp against the moment your newsletter went out. If the spike has a high bounce rate but time on page is decent, you probably have a good piece that people read and leave, not a broken experience, which means the right next step is to add a content upgrade or a clearer call to action, not a hotfix. If the spike shows inflated pages per session and almost no exits, suspect duplicate pageview calls, a cross domain misfire, or a script running twice after a recent deploy. If it is organic search traffic to a single newsy page, pair your view with Search Console to see if impressions rose in parallel, since Google just pushed AMP more visibly in Top Stories and some publishers are feeling the ripple already. If one country lights up that you never see, and the content is not in that language, this is probably a scraper, a bot net, or a referral trick, which calls for a filter review and not a champagne pop.
Once you know what kind of spike this is, switch from diagnosis to repeatable habits. Keep three views for every property, a raw one you never touch, a test one, and a reporting one with clean filters like Valid Hostname, language filters that remove garbage values, and the checkbox that excludes known bots and spiders. Move your tags into Google Tag Manager if you have not yet, because controlling one container and setting sane triggers beats chasing hardcoded snippets on every template, and you can preview before you publish so your next spike is not caused by a copy and paste error. Standardize your UTM tagging with a simple shared sheet or generator, and pick a single case for campaign names so your traffic does not end up split into five slightly different versions of the same thing, then teach the team that email equals email and not newsletter or mail blast or something else. Use Annotations every time you ship a new template, roll a press pitch, send a newsletter, or get a big mention, because future you will forget the exact night when that spike happened and a tiny note on the timeline saves an hour every time. Build a small dashboard with trend lines for sessions, new users, bounce, average order value if you sell, and scroll depth or events around your main call to action, then glance at it daily so your eyes learn the normal rhythm and a true anomaly stands out right away. When you work with bigger date ranges or heavy segments, watch the yellow bar that warns about sampling in Google Analytics, since sampled data can turn small spikes into weird patterns, and lower the date range or use standard reports to keep it clean before you make a call. Finally, watch for self referrals in Referrals, which often mean your session stitching is broken across subdomains or a new checkout flow, and fix it with proper referral exclusions so your next spike is not just your own site talking to itself.
The trick is to treat every spike as a clue, not a crisis, and build habits that make the next one easier to read.