Referral Spam and Fake Traffic in Your Analytics

Short answer: Referral spam and fake traffic are visits in your analytics that were not made by real customers. They appear as strange referring sites, sudden spikes from one country, sessions that last zero seconds or traffic that never reaches your server at all. Spot them by looking for patterns, exclude them in your reports and, where the bots really visit your site, block them at the server or firewall.

What referral spam is

When a person clicks a link on another website and arrives at yours, analytics tools record the other website as the referrer. Spammers abuse this. They send fake visits that claim to come from a site of their choosing, so that the site appears in your list of referrers. The hope is that you will click it out of curiosity, and visit a page that sells something, spreads advertising or tries to infect your computer. Your own site is not the target. Your curiosity is.

There are two main kinds. Ghost spam never visits your website. The fake data is sent straight to the analytics service using your tracking identifier, which is easy to guess or copy from the page source. Your server logs show nothing. Crawler spam is a real bot that requests your pages, runs the tracking script and leaves a referrer, so it does appear in your server logs.

Other kinds of fake traffic

Scrapers and content thieves. Bots that copy your pages, often without declaring themselves. See what to do about copied content.
Vulnerability scanners. They request many paths that do not exist, hoping to find weak points.
Click and ad fraud. Automated visits that follow paid links.
Monitoring and uptime tools. These are legitimate but add visits if they load your tracking script.
Your own team and developers. Internal visits can distort figures on a small site.
Aggressive crawlers. Some real search and research bots visit often. The article on bad bots and aggressive crawlers explains how to tell them apart.

How to recognise fake traffic

Strange referrers. Domains with names that urge you to click, offer SEO services, or contain words unrelated to your topic.
Visits with zero engagement. A 100 percent bounce rate, zero seconds on page, and only one page per visit from one source.
Sudden spikes. A jump in traffic from one country or one city, with no campaign, article or mention to explain it.
Odd hostnames. In some analytics reports, the hostname field shows which site the hit claimed to be on. Ghost spam often shows a hostname that is not yours, or none.
Unusual technical fingerprints. Old browser versions, unusual screen resolutions or language codes that no real person uses.
Mismatch with server logs. If your analytics shows thousands of visits that your access log does not show, the data is ghost spam. If the log shows thousands of requests that analytics ignores, you have bots that do not run scripts. The guide to reading access logs shows how to count requests.

Why it matters

Fake traffic is more than an annoyance. It changes the numbers that you use to decide. Conversion rates look worse because the visitors never intended to buy. Bounce rates look worse or better, depending on the bot. Campaign results are distorted, you may blame a good source or praise a bad one. Reports to a boss or a client become unreliable. And if the bots really load your pages, they cost server time and can slow the site for real visitors.

Clean up your reports

Do not visit the spam domains. Some lead to harmful pages.
Use the bot filtering that your analytics offers. Many tools have a setting to exclude known bots and spiders. Turn it on.
Create filters or segments. Exclude traffic where the hostname is not your own, and exclude known spam referrers. Apply them to reports so that history is not lost, and check the effect before you rely on it.
Exclude internal traffic. Filter your office address and your developers’ addresses.
Use a referral exclusion list for payment and login providers. This is not about spam, but about keeping sessions from breaking when a visitor returns from another service.
Annotate known events. Note the day of a spike and what you found, so that future you understands the data.

Remember that filters in some analytics tools change future data only. Keep an unfiltered view as a backup, so that a wrong filter does not destroy information.

Stop the bots that reach your server

Find the pattern. Look for shared addresses, user agents or paths in the access log.
Block or limit at the firewall. Deny the offending address ranges or rate limit them. The article on rate limiting explains how.
Use a web application firewall or bot management. Many services identify known bad bots for you. See the web application firewall.
Do not rely on robots.txt. Bad bots ignore it. It only guides polite crawlers.
Verify claims. If a bot says it is a search engine, check it. See how to verify Googlebot.
Protect forms. Spam bots that fill in forms also create fake traffic. Read contact form spam protection.

Protect the tracking identifier

You cannot hide the identifier of a tracking script, because it must be in the page. But you can reduce ghost spam by using the newer version of your analytics tool, which relies on secrets that are harder to guess, by sending data from your own server for important events and by enabling the tool’s own bot detection. If you use a tag manager, restrict the tags so that they fire only on your own hostname.

Common mistakes

Blocking a referrer in robots.txt or in the firewall to fix ghost spam. Ghost spam never touches your server, so the block does nothing.
Deleting real referrers because they look unfamiliar. Check before you exclude.
Making filters that are too wide, such as excluding a whole country.
Making decisions on a sample that includes a known spike.
Ignoring the server load that real bots create.

A worked example: the spike from nowhere

A small consultancy sees its weekly visits triple, and almost all the new traffic comes from one referrer with a name that promises cheap website traffic. The analytics report shows that every one of these visits lasts zero seconds and views one page, and the hostname field shows a name that is not the consultancy’s. The owner opens the server access log for the same days and finds none of those requests. This tells her that it is ghost spam, so no blocking on the server is needed. She adds a filter that keeps only data whose hostname matches her own domain, creates a view without the spam referrer for her weekly report, and notes the date in her annotations. A month later, she finds a second pattern: hundreds of requests a day for the login page from a handful of addresses, which do appear in the log. This is real bot traffic, and she asks her host to rate limit those addresses. Two different problems needed two different fixes, and the logs were the tool that told them apart.

A short weekly routine

Open the referrer report and sort by sessions. Look at any new name with a high count and no engagement.
Compare total sessions with the number of requests for pages in the server log. A large gap in either direction deserves a look.
Check the countries and devices for unusual clusters.
Update filters and note any changes, so that the history is explained.

Ten minutes a week is enough on a small site, and the habit keeps your reports honest.

How Site AI Audit helps

Site AI Audit does not read your analytics or your logs, so it cannot count fake visits. It checks the public settings that make a site harder to abuse and easier to trust: robots.txt and the sitemap, redirects, security headers, exposed software versions and the SSL certificate, together with speed and email setup. A re-check after a change in your firewall or hosting shows whether the response time improved. The free check covers up to 50 pages and needs no sign-up. You can run a free check of your website or see the plans for re-checks and weekly monitoring.

The bottom line

Fake traffic is common, and it distorts the numbers that you use to make decisions. Learn the signs, filter your reports, separate ghost spam that never reaches you from bots that do, and block the second kind at the server. Clean data makes every other marketing and technical decision safer.

FAQ

Is referral spam dangerous?

The data itself is harmless, but the sites it advertises may not be. Do not visit them, and filter them out of your reports.

Can I block ghost spam with my firewall?

No. Ghost spam goes directly to the analytics service and never reaches your server, so you must filter it in the analytics tool.

Why did my traffic jump overnight?

It may be a real mention, a campaign or a crawler. Check the sources, the countries and the engagement. Real visitors view several pages and stay for some time.

Does fake traffic affect my SEO rankings?

It does not directly, but if bots overload your server the site can become slow, which can hurt visitors and indirectly your search results.

Should I delete old data that contains spam?

Usually not. Use filters or segments to hide it in reports, and keep the raw data in case you need to review it later.