Google Analytics Referral Spam & Your Site

If you have a blog or a web site that you’ve been working on for any amount of time, one of the first things you learn is how to measure the traffic on your site. Without measuring performance, all the money, time and effort can be a little discouraging if you don’t see results. There are few things more aggravating than seeing an increase in site traffic and then realizing that it is nothing more than spammers artificially increasing your site stats.

What is the Point of Referral Spam?

So what is the point of someone spamming your site statistics? I think a screenshot of some of the referrals makes it obvious. What is supposed to show in this field is a list of sites that have sent your site traffic. Unsuspecting webmasters, thinking that one of these sites is linking to them will click on the site, generating traffic for the spammer. Sometimes it is traffic only and the spammer benefits by CPM ad revenue. Sometimes the link is to a malicious site. Sometimes, it is a product or service provider hoping that someone will be interested in their service. And of course, sometimes it is the ultimate source of spam, it is a link to a porn site.

By the way, this happens to be a site that already has been filtered for spam referrals. These are new spam domains that have been added in the past couple of months. Obviously, the person with the black-friday.ga domain was hoping for click throughs to take advantage of the Black Friday specials. Will the majority of people visit the spam site? No, but through the sheer mass volume of spam referrals, the slight percentage that will make it worthwhile to the spammers.

Why is Referral Spam a Problem?

So someone is messing with your site statistics. Why is this a problem? For sites with a large amount of traffic, it may not be much of an issue as the the percentage of spam versus actual traffic may be miniscule. However, the referral spam has become such a nuisance, that I believe over time it can distort the picture of site traffic and growth even for large sites.

It is a problem particularly for sites that are new and sites without a large amount of traffic. I have seen referral spam that record 200 to 300 visits per month to a single domain for a site. For some small business sites, this completely obscures the true measure of actual site growth. The sites with low traffic volume are also more likely to be inexperienced webmasters that won’t realize that it is spam and will actually visit the potentially malicious site.

How Referral Spam Works

A few months ago, I spent quite a bit of time researching how to get rid of this nuisance. Referral spam has been an issue almost as long as the internet has been around; however, this particular type of spamming is fairly new. Before, spammers would ping your server with a referral, spoofing an actual visit. This would not only generate a bogus referral link (bogus in that an actual person did not visit your site from that referral) but it would also add to your site bandwidth. You would notice it through the bandwidth spike as well as the referral log. Once identified, the spam referral could be blocked through the .htaccess file of the site.

This referral spam is different. There is no actual interaction between the spammer and your site at all. Instead, the spammer interacts directly with Google Analytics, triggering a referral for your site. They do this by obtaining your Google Analytics ID by crawling the code of the web site. Once they have that ID, they use it to tell Google that there has been a visit to your site from theirs. Since there is no interaction with your site, the referral spam can’t be blocked on a site level at all.

How do you know if you are dealing with Google Analytics referral spam versus the old style that jacked up your bandwidth? The problem is so pervasive at this point that I think if any site is using Google Analytics and has any sort of web presence at all, you are probably getting hit. However, you can confirm this by looking at the referrals in Google Analytics and comparing it to the referral log in the stats for your hosting account.

How to Block Referral Spam in Google Analytics

As people came to grips with combating this issue, there was a lot of different advice for blocking it. Some of it was wrong. Some said to block it in the .htaccess file, which doesn’t work. Some methods simply kept the referring domain name from being viewed but still counted the spam referral as real traffic. Not only does it not help at all, but it makes the problem worse.  Your traffic is still inflated but you aren’t seen the source of it, even if it is false.

What I have tried that actually works is creating a filter in Google Analytics to block campaigns referring from spam domains from showing as a referral source as well as being counting in the site traffic.

1. On the admin tab of your domain account in Google Analytics:
2. Click filters.
3. Click Add Filter
4. Enter a name for the filter
5. Select “Custom” for filter type
6. Select “Campaign Source” for filter field
7. In the filter pattern, enter the domain names. Domain names should be separated by pipes (|) and periods escaped by “/”
8. Add the views the filter should apply to. This is an account level filter and you may have multiple domains tracking under that account. Select all domains or unique views that you would like the filter applied to.

These are the filter patterns I have right now:

Filter #1

darodar\.|semalt\.|buttons-for.*?website|blackhatworth|ilovevitaly|prodvigator|cenokos\.|ranksonic\.|adcash\.|share.?buttons\.|social.?buttons\.|hulfingtonpost\.|best-seo-(solution|offer|service)|free.*traffic|buy-cheap-online|100dollars-seo

Filter #2

trafficmonetize\.|success-seo\.|videos-for-your-business.\|semaltmedia\.|adf\.ly|copyrightclaims\.org|snip\.to|hosting-tracker\.com|alibestsale\.com|black-friday\.ga|cyber-monday\.ga|free-floating-buttons\.com

Here’s the bummer, there is a character limit to the filter pattern so depending on how many domains that need to be blocked, you may need to create multiple filters. The other thing is that this filter will need to continue to be updated because spammers never sleep. Well they do, but they automate all this so it’s running, creating work for you, while they go off and have coffee.

Easy Way to Block Google Analytics Referral Spam

After all of this, here is the simplest way to block referral spam which I discovered when revisiting all the information to write this article. As I mentioned, this is a headache that continually has to be addressed. Stijlbreuk created a service that automatically updates your Google Analytics filter for you. The why from their site:

Referrer spam blocker started as a friday-afternoon project here at Stijlbreuk. We were tired of manually updating the spam filters and created a tool that did this automatically to make our lives easier. We showed some people in our network and because they were enthusiastic we decided to spend a “little bit more time” on it to make it more user friendly.

We thought about possible business models before making the app public, but we decided that making money of the spam issue just didn’t feel right. We see the tool as our “digitale visitekaartje” or “digital business card” in english. We hope that some companies will notice the quality of the tool and get in touch for similar projects. If you like what you see, please contact us here.

So rather than going back to constantly update your filters,

1. Log into your Google Analytics account
2. Visit the Referral Spam Blocker site
3. Click Authenticate now
4. Click “Allow” to give the Referral Spam Blocker app
5. Select the accounts you would like the filters applied to
6. Click the “Let’s Do This” button at the bottom

But wait, that sounds too easy and it’s free? Yes, it’s free, but here’s the downside. Currently their service has a limit of 2000 calls to Google’s API. To block referrers for one site, they have to make approximately 30 calls to the API, meaning only 66 sites can be added to the service a day. If you visit and their quota is exhausted, try back the next day or follow the instructions to add the filters manually yourself as noted above.

Where to Go From Here

Now that you’ve blocked all the spam referrers from showing up in your web site stats, now what do you do next? First, it doesn’t filter referrals previously recorded so if you view your statistics as most people do for the month, it will take a full month before you are looking at “clean” statistics. If you are in the process of growing your site, be prepared for a drop in traffic numbers. It might be a little discouraging, but remember, they were never actual visitors in the first place.

Further Resources on Blocking Google Analytics Referral Spam

• Definitive Guide to Removing Google Analytics Spam from Analytics Edge: This has a good overview of the history of the different spam tactics
• Guide to Removing Referrer Spam in Google Analytics from Analytics Toolkit: Screenshots of how to set up your filters in Google Analytics, but you have to scroll down to see the most recent solution.
• How to Stop Referrer Spam from Raven Tools: This is another play by play in the search for a solution; however, again scroll down to the bottom of the article for the most current solution.
• Filtering Domain Referrals from Google:  (Added June 2016) Since writing this article, Google has added a resource to their knowledge base for eliminating Analytics spam that uses the method above.
• Guide to Removing Analytics Spam from O How Digital Marketing:  (Added June 2016) In this guide from O How Digital Marketing, they provide steps for providing multiple data views for your site.  They also outline four different steps for eliminating false traffic from your Google Analytics account by 1) eliminating ghost traffic using an include filter for valid hostnames, 2) filtering for crawler spam using the method I describe above, 3) enabling bot filtering in the view setting (I forget this sometimes,) and 4) excluding the IP addresses of web administrators and team members.  The issue with #1 is that first your site has to have enough history to have a record of valid hostnames beyond your own domain name.  The second is that with the proliferation of social media and accounts on other properties, with this method you must remember to add any new referrers to the view as only the hostnames within the filter will display.  As they recommend creating unfiltered master views, the filtered views can be compared; however, I think it would be very easy to forget.  Third, you can only have include one hostname filter for your account which, like all filters, is limited to 255 characters.  If you have one web property on one Analytics account, this may not be an issue.  If not, the 255 character limitation can quickly become an issue.