I am very new to using GA. The site I am using it on gets tons of hits from spam referrals. I would like to proactively block these rather than having to reactively add them to some exclude regex. I read online that using an includes filter for only good hostnames helps to alleviate some of the spam pressure. However I am afraid that doing this will cause referrals from good sources to not get through in my reports.
How can I solve this? What is the relationship between referrals and a hostname include filter?
The Ga "Hostname" is the hostname associated with the current pageview (regardless of traffic source). A hostname filter with your own domain will not remove your referrals.
The hostname filter works, or is supposed to work, because much of the spam is not sent via the tracking code on your site at all. Instead most spammers generate randomly valid tracking ids (the format is well known, so that's not difficult) and send the spam directly to those accounts. I.e. they do not target specific accounts, they simply aim to hit somebody. After all it's not like making http requests is expensive or something.
There are, however, spambots that actually visit your site and inject their spam events into the existing pagecode. Those will not be stopped by a hostname filter.
But in any case, your referrals are safe.