Google Analytics Spam: How to Stop It In Its Tracks

If you’re going “whaaaaa?” at the sound of that headline, don’t worry – let me explain:

Spam in Google Analytics has always been a small percentage of what’s going on in your account – and for most of my clients, it’s been so small that it’s not even worth worrying about.

However, sometime around the end of April / beginning of May – I’ve seen spam in Google Analytics EXPLODE in my client’s accounts. (Sometimes you see this referred to as “referral spam”)

Spam data in your account consists of “fake” visits that are messing with your numbers. Making you think that you have way more visits than you actually do and is starting to skew things like bounce rate to look worse than it is.

So what exactly is going on?

Two different kinds of analytics spam are increasing:

1. Ghost Visits. These are people who aren’t even visiting your website. How is that possible you ask? They’re using fancy tools to send visits straight to your Google Analytics account without actually visiting your website. The magic behind this is that they either know your UA number (that number that’s unique to your GA account) or they guessed it (kind of like those robo-call telemarketers).
2. Robot Visits. These are people who are using a robot to actually visit your website, but it’s not a human. So they obviously don’t help us at all

Why is this happening?

These companies/people think that if they send you fake visits that’ll you think “wow! such-and-such website must have mentioned me because they’re sending me a ton of visits! I should click over to the website to see what the mention is.” and such, they’re driving you to their website.

Slimy?

Hells yes.

It’s a gross way to market and it’s basically a loophole in Google Analytics reporting that THEY should fix.

But they’re not (as of the time of this post).

So what can we do about it?

Let’s walk through 2 ways to fix it.

#1 – Stop the Ghost Visits

With the Ghost Visits, we just need to filter them out of our Google Analytics account since they’re not actually visiting our website.

How do we do that?

With something called a filter.

With a filter, we can filter out the junk traffic before it hits our Google Analytics account – resulting in clean, non-spammy data. Yay!

First, login to Google Analytics and head to Admin

Second, make sure you select the Main View for your account.

(PRO Tip: If you don’t have one already, create a second view for your account that you call “Test View” and try this filter out on that view first. Once filters are setup on your main view, your data can’t be unfiltered. You can delete a filter and it’ll stop filtering from that day forward, but you won’t be able to go back and undo its effect on your data for the time it was live.)

Third, select Filters.

 

 

Fourth, setup a new filter!

Finally, let’s configure this bad boy.

We’re going to setup what’s called a Hostname filter. Meaning that only visits to your actual website name will be counted in Google Analytics.

Why does this work? Because those ghost visit people only know your UA number, not your actual website name.

So how do we do that?

1. Select Custom.
2. Select INCLUDE. (very important)
3. Under Filter Field, select Hostname
4. Type the following*** (without quotes and with your domainname): “.*yourwebsite.com”

(the weird-looking punctuation is actually called “RegEx” or a “regular expression” and is basically telling Google Analytics that anything like yourwebsite.com or www.yourwebsite.com or blog.yourwebsite.com or shop.yourwebsite.com are all acceptable to track)

Testing, testing 1-2-3. Hit “Verify Filter” to see if this filter would work on your data if applied to the last 7 days of visits in your account. (Hint: if this almost completely eliminates your data – you may have hit EXCLUDE or mistyped your domain name.)

Once satisfied you’ve set this up properly – hit SAVE.

***CAUTION: If your Google Analytics code is actually on more than website (let’s say also on a .leadpages.net or a membership site of yours or say inside your YouTube channel….) this simple approach won’t work for you. You’ll need a more complicated RegEx expression to make sure those very real visits don’t get filtered out. Need help with that? Let’s chat.

Once this is setup, from this day forward you’ll have eliminated most of your spam!

#2 – Stop the Robot Visits

Okay, this one is more complicated.

Because we need to stop them from hitting our website, not just our Google Analytics account.

Warning: this may be a bit more complicated and something you want a developer’s help with.

The biggest offender right now is a website called semalt. So we’ll walk through this process for excluding visits from semalt.

Where do we stop the Robot Visits from hitting our website?

We can do this in what’s called our htaccess file.

(If you’re saying HUH??, you may want to phone a developer for help.)

On WordPress, you can actually do this within the Yoast SEO plugin.

Triple Warning: Editing this file the wrong way can break your site. Please don’t attempt if you’re at all worried about doing that.

Simply Head to Tools-File Editor under the Yoast plugin.

Scroll down to the htaccess portion.

Add the following code to the file:

And, presto! Moving forward, these robot visits should miss your site completely.

(Remember – ONLY edit your htaccess file if you know what you’re doing – it’s incredibly easy to break your site by making the wrong edit to this file)

The list of sites you need to block in this way unfortunately continues to change frequently. The best way to keep on top of this is to have an analytics pro handle this for you (like moi ;)) or to continue to monitor your analytics for spam-looking sites and add them here.

#3 – Fix the Data You’re Already Looking At

So now that we’ve blocked the Robot Visits and the Ghost Visits moving forward… how do we fix the data already in Google Analytics?

Well first, you probably want to create an annotation on your account so you know why your data suddenly looks different. (More on that here.)

Because you know, Google Analytics doesn’t do much in the way of retroactive fixes (womp, womp).

We have to setup what’s called an Advanced Segment.

Yay retroactive loophole!

You’ll have to apply this Advanced Segment *every* time you look at your Google Analytics data to ensure you’re looking at the right data.

It doesn’t load by default.

How to Setup An Advanced Segment to Filter Out Spam Visits

First, head to Reporting and click on +Add Segment.

Second, hit the big red +New Segment button.

Third, configure your Custom Segment to include just your hostname visits + excluding known bot traffic. (aka those two things we just fixed for all visits moving forward)

You’ll need to setup 2 filters in your advanced segment as shown below – (1) for your hostname and (2) to exclude the ghost visits.

And don’t forget to give your Advanced Segment a name! Something like “Excluding Referral Spam Visits” works well for me.

RegEx I’m currently using to exclude bot visits:

semalt|buttons|trafficmonetize|best-seo-offer|100dollars-seo|4webmasters|darodar|ranksonic|bestwebsiteawards

(Note: I’m constantly updating this as I discover new bot visits in my account and you should too)

You can hit Preview to see if this will exclude the traffic you’re intending to. At the time of this post, my segment filters out about 10% of total visits. If it filters out either ZERO percent for you or 100%, you’ve probably configured something incorrectly.

Once you’re satisfied, hit SAVE and the filter will automatically apply.

Just remember to load it up every time you go into Analytics now and looking at data from before you setup your filters.

That Wasn’t So Hard Was It?

Okay, I know this got a BIT more techie than I usually keep it on the ol’ LLM blog here, but I’ve been getting *so* many questions about this issue that I wanted to write something up for you guys.

If this has you going HUH??? but you know you need to fix this… shoot me an email if you want me to fix this for you.

Huge thanks to Analytics Edge for the inspiration for this post. (If you’re more technically inclined, I highly recommend checking out their post for a more complex explanation of what’s going on with Referral Spam)

Have something you think I should add here? Have you seen a spike in Referral Spam visits in your Analytics account? Find this helpful? Let me know in the comments!