Traffic has spiked — hallelujah! This is what you’ve been working towards!

Pause: before you start celebrating, it’s good to do your due diligence and make sure that glorious, spiked blue line under “All Users” is in fact genuine users visiting the site, and not spam.

The checklist to determine whether or not increased traffic is spam is not too difficult to follow. You’ll probably know in 10 minutes whether it’s time to do a celebratory dance, or if you need to solve a problem. Either way, today you’re going to do something valuable.

Before taking action on that pesky spam traffic, be sure to read this article in full. It’s important that spam traffic is identified from multiple indicators.

Identify spam traffic by checking suspiciously high (or low) metrics in Google Analytics

There are four core metrics that can point toward spam traffic:

• Average Session Duration

• Bounce Rate

• Pages/Session

• New Users

These Google Analytics metrics are incredibly useful for SEO and can be found in Google Analytics > Audience > Overview. Simple!

The more metrics throwing a suspiciously high or low result, the more likely it is that traffic is spam.

GA graph shows Audiences > Overview report. Metrics are looking healthy; no suspicious results. The four metrics used to determine if traffic is spam are highlighted with a blue rectangle.

#1 Average Session Duration

Average Session Duration in Google Analytics shares how long, on average, a user (visitor/person) has spent on a website during one session (a visit).

Generally, spam traffic doesn’t spend long on a website. Spam traffic isn’t browsing the site — it’s not reading blogs or researching the products or services provided. Instead, spam traffic usually lands on a page, then bounces.

#2 Bounce Rate

Bounce Rate on Google Analytics is an incredibly useful metric for indicating that there’s a problem on the site.

The Bounce Rate metric shares the percentage of users who visited one page on the site, didn’t engage, didn’t click to another page, and left. Every user who lands on a page and leaves on the same page without clicking to another counts as a bounce.

*A little note for those who are using GA4 (I salute you!), Bounce Rate is no longer a metric. It was replaced by Engagement Rate.

As always with SEO and data analysis, you need to contextualize the data. Not all pages with a high bounce rate indicate a problem. For example, organic traffic might search “brand name + telephone number”, visit the contact page from SERPs, grab the number, and leave to make a call. It’s a bounce, but it’s not a bad thing — the user was served.

One guarantee is that a percentage of users will bounce. Artificially low bounce rates definitely need attention. Pictured below is a screenshot from a client’s Google Analytics account. Their analytics was reporting a 1.47% bounce rate. Seem a little too good to be true? It is.

After some investigation, this site was found to have two analytics tags. The duplicated UA codes were skewing the results. It’s for reasons such as this that I reiterate the importance of checking numerous data points before assuming increased traffic is spam.

#3 Pages Per Session

If there’s quality traffic on site (aka not spam), then you can expect to see users viewing multiple pages per session. Naturally, engaged traffic clicks around the site.

Spam traffic is most likely going to view 1.00 (or a very low number of) pages. If the Pages Per Session metric is plummeting with increased traffic, then it’s a strong indicator the traffic is spam.

#4 New Users

If Google Analytics is reporting 100% new users to a site or a significant increase in new users, then this may be spam traffic. To determine if new users have spiked, compare the percentage of new users with historic data and look out for a spike.

Check your traffic sources: spam traffic is often hidden in referral traffic

If you’ve looked at the metrics in Google Analytics and it’s pointing to spam, then referral traffic is the next place to go.

By looking at the data under Traffic Sources, you can find which links are sending spammy traffic, then you can decide what to do about it. Generally, the action is either to disavow the link and/or set up a spam filter, which helps reduce the spam within Google Analytics reporting. Both of these options are covered below.

Find referral traffic

First, find referral traffic by visiting Google Analytics > Acquisition > All Traffic > Overview > Channels > Referral

Review the links pointing to the domain and driving traffic. If the links are highly relevant and recognizable, they’re fine.

If a link feels spammy and/or the traffic coming from the link appears to be returning some suspicious metrics (see bottraffic.pw pictured below), that’s an indicator of spam.

An increase in spam traffic from referral can go unnoticed on websites with a high volume of genuine traffic, since it’s often a minor inflation and impactless. However, spam traffic can have a greater impact on smaller or new websites since it can largely skew data by percentage.

The screenshot below shows a small website with only 120 users. The top referrer — bottrffic.pw — is driving 66 users, more than 50% of overall users. If the domain name alone wasn’t enough to conclude that the traffic is spam, the metrics — 0% bounce rate, two pages/session, 66 users (all of which are new), and an incredibly short average session duration — certainly point to spam.

Check your traffic’s geographics

Another indicator of spam traffic is increased traffic from countries that aren’t targeted by the digital strategy.

It’s incredibly important to reiterate here that in order to decide whether or not traffic is spam, numerous indicators of spam traffic must be present. It’s not enough to see an increase in traffic from a non-target country and assume it’s spam. Always do your due diligence and check different reports before reacting to potential spam.

The screenshot below shows the geographic report for a B2C website. The company ships products to consumers in the US and Canada, yet traffic from other countries is finding the site. Unlike bottraffic.pw above, the metrics don’t scream spam traffic.

Some investigation proved the traffic was genuine. It was organic traffic from blogs. In this instance, you can accept that websites will occasionally reach audiences in different countries. If the data is not useful, Google Analytics provides an option to filter out traffic by country.

Take action against spam traffic

If you’ve checked multiple metrics and see at least a few indicators that your traffic spike might be the result of increasing spam, you have a couple options.

Action option 1: Disavow spam backlinks

Disavowing links is not something to be taken lightly. Before you take any action with a disavow, you need to be certain that this is the right thing to do and the link is definitely spammy and harmful to the site.

Google’s disavow recommendation is: “You should disavow backlinks only if:

1. You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND

2. The links have caused a manual action, or likely will cause a manual action, on your site.”

In the instance of bottraffic.pw, it might be enough to simply filter the traffic in Google Analytics (see instructions below), but if you feel a disavow is needed, then follow Moz’s instructions on When & How to Disavow a Link.

Action option 2: Filter spam traffic in Google Analytics

Thankfully, Google is pretty well informed about which websites drive spam traffic and which don’t. (You can see how Google might wise up to a domain like bottraffic!) This means that you can avoid risky disavows, and instead, simply set Google Analytics to filter out bot traffic.

Here are the five steps you need to take to filter spam in Google Analytics:

1. Head to the “Admin” cog in the bottom left-hand corner

2. See the “View” section within settings

3. Click “View Settings”

4. Look out for the tick box that reads “Exclude all hits from known bots and spiders”

5. Save

Remember, a filter view will filter the data from the date it was added. Historic data will remain exactly the same. It helps to take note of the date you added this change so you can rationalize the inevitable drop, big or small, in traffic when you stop recording spam traffic in GA.

Keep an eye on spam traffic

All websites have a percentage of spam traffic, and how you deal with it depends on the website, the impact of the spam, and the potential harm. It’s wise to be diligent and stay close to the data so you can spot a problem if it arises.

• Check in on your core site metrics so you’d spot a drastic change when it happens.

• Run quarterly backlink audits and check that links to the site are not causing inflated traffic spikes.

• If you haven’t already, add the bot filter to GA

Stay aware of spam and always run a double-check if there’s a sudden spike in traffic. The optimist in all of us could easily overlook such a problem.