In GA: Admin -> All Filters -> Add Filter -> Predefined Filter Type -> Include Only -> Traffic to the hostname -> tha contains -> Enter your hostname in the text box ie mysite.com.
That said, there are some weaknesses to this solution. Here's why: For larger businesses, they may have multiple websites, and those websites may need to work together. Additionally, they may be using GA to track actions through an app, for example, or steps in a marketing process. This solution might generally work for individual blogs, but it gets hairy as your needs get more complex.
And, as it turns out, the spam issues become more frustrating the more complex your setup gets.
Agreed, Google Analytics is basically worthless now unless you run a single site and have the time to set up filters every time some jackass gets by the ones already in place.
https://motherboard.vice.com/read/this-pro-trump-russian-is-...
Not long after doing the interview with Vitaly, they had to write a follow-up because the original article ended up being used as GA spam:
http://motherboard.vice.com/read/spammer-now-spamming-google...
That cycle has repeated itself a few times (The Next Web ran into something similar a month prior).
To be honest, the real problem here, far as I can tell, is that Google hasn't figured out a way to make whitelisting traffic easy in Analytics.
Most people don't use a tenth of GA's overall power, and as a result have no idea where to look when it comes to building out filters and such. Yes, those who seriously do analytics for a living know how to handle this, but the problem is, there are a lot of people who use GA because it "just works," and it doesn't do the job if someone's just throwing junk into the referrers.
This problem is widespread and it depreciates the value of a fundamental Google product. Why is a company that's so good at filtering spam apparently ignoring the problem in this case?