Hi - there are 2 types of spam and they need to be addressed separately.
Referral spam - these are genuine visits to the website in order to spam. They will not be blocked by the valid hostname filter but you can set up GA filters or block with .htaccess.
Ghost spam - these directly spam the GA account, there is no real visit to the website. You can block these with GA filters but it is like trying to capture smoke in your hands as they morph daily to different names and different methods. The only long-term solution is to set up a GA filter to only allow a valid hostname.