How to Remove Referral Spam

There has been a lot of talk about spam referral traffic lately and what to do about it. Whether you work for an agency or you monitor your own site’s traffic, if you regularly use Google Analytics, chances are you’ve come across some spam in your GA referrals report.

Spam traffic is not a new concept, but it has recently picked up momentum and is becoming a major annoyance for most webmasters. While this traffic is indeed annoying, there is no need to lose sleep over it.

There are ways to remove it from your reporting and get your analytics back to normal.

In this post, I’ll go over what referral spam is, why it’s an issue, and what you should – and shouldn’t – do to get rid of it.

What is referral traffic?

Before you can understand spam referral traffic, you first need a good understanding of referral traffic in general. At the most basic level, referral traffic is traffic to your site that was ‘referred’ from another site. Generally speaking, legitimate referral traffic comes from sites that have linked to your site.

For example, if you visit our post How the Internet Changes Your Brain and click through to National Geographic’s website (via the first link), webfx.com would now show up in Nat Geo’s Referral Traffic report because WebFX ‘referred’ you to Nat Geo.

What is referral spam?

Referral spam is fake referral traffic from other sites that aren’t necessarily linking to your site.

Some spam referrals actually visit your site, but most simply trigger your GA tracking code to record a false visit without actually visiting.

This leads us to the two types of spam referral: Crawler Referrals and Ghost Referrals. Crawler Referrals (the majority of which are bots) actually visit your site, resulting in ‘legitimate’ traffic sessions. On the other hand, Ghost Referrals are spam referral traffic that never actually visit your site, but rather trick your GA code into registering a false session via an automated script.

Most likely, these sites are not linking to your site, but you’ll want to do your due diligence and double check using your favorite backlink tools.

All of these sites are spammy sites (hence the name) and likely have a bad reputation with Google’s algorithms – and you don’t want their bad link juice affecting your site’s rankings.

If you haven’t already, be sure to activate GA’s ‘Bot Filtering’ setting. This will not exclude the spam bots I’m talking about in this article, but it is essential for helping to keep your traffic data clean from non-spam bots and spiders. This can be done by Admin > View Settings > Bot Filtering

How do I know if I have spam referral traffic?

Most webmasters become aware of spam referrals when their site suddenly experiences a major influx in traffic.

Upon looking into the new traffic sources, they discover that a majority of the new traffic is spam referral traffic.

The fastest way to determine if you are getting hit with spam referrals is to check your Referral data in GA (Acquisition > All Traffic > Referrals).

If you see sites like semalt.com and free-share-buttons.com, you have a spam referral problem. Here is a snapshot of some common referral spam offenders:

Does referral spam harm my site?

Some site owners are alarmed when they discover that they have spam traffic, but there is no need for concern. Simply put, these spammy sites are only creating pseudo statistics in your GA data.

These sites are not infecting your site, hacking into your server, or stealing your data.

Spammy visits and artificially inflated numbers are not going to cause any harm to your site or its visitors. So you can sit back and relax in this sense.

Why do I have spam referral traffic?

Other site owners worry that referral spam indicates that their site is being targeted by black hat SEO tactics. Once again, you can relax – this is not the case.

These spammy sites are not solely targeting you or your site, but rather they are hitting thousands and thousands of sites every day.

The majority of these sites use automated scripts to randomly generate GA codes to ‘visit’ thousands of sites in a wide range of industries. Since they are generating codes randomly, it’s possible (and highly likely) your site will get hit multiple times a week, if not multiple times a day.

You may be wondering why these sites generate spam referrals, and what they get out of it. It all comes down to traffic – they are trying to drive traffic to their sites.

By spamming your site and showing up in your Referral Traffic report, they are hoping that curiosity will get the best of you and you’ll click through to their site.

The spammers have several tactics they use to make money and benefit from this traffic, including bombarding you with ads, redirecting you to a store front or an affiliate site, hitting you with a marketing scam, and possibly even infecting your computer with malware. Your safest and best bet is to NEVER click on any questionable referral links.

Why is referral spam an issue?

Since these sites aren’t negatively targeting you and they aren’t harming your visitors, you may be questioning if referral spam is even a problem. The biggest issue is that these “visits” skew your traffic data.

When you’re hit with referral spam, you might think that your traffic is up and get excited.

Without analyzing your data, you could think your site is performing really well – when really, you’re experiencing drops in traffic that matter, like organic and paid traffic. Spam referral traffic also negatively impacts metrics like bounce rate, average time on site and pages per session.

Plus, if your job is dependent on increasing traffic, spam referral traffic can create major headaches if the spam stops and your overall site traffic plummets.

If you do SEO for a company that isn’t yours, inflated traffic numbers from spam referrals can cause even bigger headaches. For example, try explaining to your boss why traffic is up 200% over last month yet sales are down.

Likewise, good luck trying to explain to them why best-seo-solutions.com is sending them traffic and why it doesn’t matter.

Your best bet is to address and remove this ‘traffic’ from your data ASAP.

Why doesn’t Google address referral spam?

Another question you might be asking yourself is: if this is such an issue, why hasn’t Google addressed it yet? While no one really knows why Google does the things they do, we can take a couple of educated guesses.

The biggest obstacle for Google is likely creating a fix that doesn’t exclude legitimate traffic. If Google started blocking legitimate traffic, Google Analytics users everywhere would become furious.

By selectively blocking domains, Google could potentially run into some legal issues as well.

To make things even more complicated, spammers are continually evolving their methods. That means that a fix today might not be a fix in a few weeks when they inevitably find a way around Google’s solution.

I expect that Google is in the process of addressing this issue, and I look forward to a solution in the future. However, for now we have to take matters into our own hands and do what we can to combat this spam traffic.

Ways NOT to remove referral spam

Before I explain the things you should do to combat referral spam, I’ll mention a few that you shouldn’t.

Although they may on the surface seem like effective solutions, they’re short-term fixes that won’t help you in the long run.

Referral exclusions

Since spam traffic shows up in the Channel Report as Referral traffic, you might be tempted to simply add the domains to your Referral Exclusion List (Admin > Tracking Info > Referral Exclusion List). While this makes sense based on the name and some have suggested this as a fix, DO NOT use Referral Exclusions.

As Google explains here, the Referral Exclusion List is meant to prevent new sessions from starting during a current session – such as a visitor returning to your storefront after checking out via a third-party shopping cart. The confusion comes from this line: “When you exclude a referral source, traffic that arrives to your site from the excluded domain doesn’t trigger a new session.”

People interpret this to mean the session will be excluded in its entirety.

However, this is not the case. While no referral session is recorded, the visit is recorded as a direct session. In your reporting, it might appear that you have removed the spam traffic, but all you have done is transformed spam referral traffic into spam direct traffic, and your numbers will still be messed up.

Hostname filter

Another rumored way to fix spam referral traffic is by using a hostname filter.

At first glance, you might notice some of the spam referrals have a Hostname of “(not set)” or some other rubbish you quickly identify as spam. Upon this discovery, you might jump to filtering out all of these identified Hostnames.

However, spammers are already a few steps ahead of you. They have developed the ability to change their hostnames to anything they desire and the majority of them do.

If you closely examine your reports, you’ll notice some of them are using your hostname or are cleverly using hostnames such as google.com or bing.com.

As a result, hostname filters can cause you to filter out good traffic along with the bad.

Changing Google Analytics tracking IDs

Desperate for relief, some people have even suggested changing their Google Analytics tracking code. The thought behind this method is that the majority of IDs follow the template ‘UA-XXXXXXXX-1’. So if you change your ID to end in a 2 or 3 (or any other number), the spammers will no longer be able to generate your tracking code.

While this might have worked for a short time, the spammers have evolved their scripts to now include all variations of tracking IDs.

Save yourself the time and troubles and DO NOT change your tracking ID.

How to properly remove referral spam

As I discussed above, there are two types of spam referral traffic: Crawler Referrals and Ghost Referrals. Unfortunately, there is no one-size-fits-all fix to address both types of referrals. Instead, there’s a two-part fix you will need to implement to remove referral spam tracking from your Google Analytics data – .htaccess codes for Crawler Referrals, and a filter for Ghost Referrals.

Using .htaccess to remove referral spam

If you remember from above, Crawler Referrals actually visit your site.

Because of this, you can stop them from initiating spam sessions by putting up a virtual road block using your .htaccess file. By adding a spam referral ban section, you can stop spam traffic before it has the chance to enter the site and register as a referral session.

This can easily be done by adding the following code to your .htaccess file. As a best practice, always create a backup of your original .htaccess file before changing it.

 (Note: I’ve only included four domains, but you will need to include a line for all active spam Crawler Referrals – see list below.)

### Start Referral Spam Traffic Ban

RewriteCond %{HTTP_REFERER} ^https?:\/\/([^.]+\.)*semalt\.com [NC,OR]

RewriteCond %{HTTP_REFERER} ^https?:\/\/([^.]+\.)*best\-seo\-solution\.com [NC,OR]

RewriteCond %{HTTP_REFERER} ^https?:\/\/([^.]+\.)*buttons\-for\-website\.com [NC,OR]

RewriteCond %{HTTP_REFERER} ^https?:\/\/([^.]+\.)*success\-seo\.com [NC,OR]

RewriteRule .* – [F]

### End Referral Spam Traffic Ban

Using a filter to remove referral spam

As I mentioned earlier, Ghost Referrals never actually access your site. This means you can’t block them using the .htaccess file. The only true way to remove this referral spam from your GA data is via a filter.

Some SEOs suggest that you use a ‘referral’ exclusion filter, but your best bet is actually to use a ‘campaign source’ exclusion filter – as Google recommends here.

If you’re new to filters, here are some important notes to keep in mind when creating them:

• Review Google’s Filter Guide
• Always keep an unfiltered profile, because the effects of profile filters cannot be reversed
• Always test filters in sandbox profiles before adding to your primary profile
• Filters do not apply to historical data, so you’ll need to create a segment to clean historical data (see instructions below)

To set up a Campaign Source Exclusion Filter, follow these steps:

1. Within your Google Analytics account, select ‘Admin’
2. Under ‘View’, (be sure to select your sandbox/test view) select ‘Filters’
3. Click on ‘+ New Filter’
4. Enter a ‘Filter name’ – something like “Exclude Referral Spam”
5. Under ‘Filter Type’ select ‘Custom’
6. Under ‘Filter Field’ select ‘Campaign Source’
7. Enter your RegEx code (see example below) in the ‘Field Pattern’
8. Test your new filter using the ‘Filter Verification’
9. Click ‘Save’ to save your filter

Example RegEx code: semalt|success-seo|share-button|trafficmonetizer

After you test out your new filter in your test view and are happy with it, you can apply it to your primary profile. This can be done by: Admin > Account > All Filters > Select Filter Name (in our example it would be “Exclude Referral Spam”) > Apply Filters to View > Select your primary view > Click Add > Click Save

Notes: You will need to add in a snippet for each spam referral that is affecting your data. There is a 255 character limit for each filter, so you will likely need to create more than one.

Additionally, there is a limit on the number of filters you can have. Once applied, filtered results can take up to 24 hours to become visible. Spam referral are constantly coming and going, so you’ll need to monitor for new ones to add and old ones you can remove.

Setting up a custom segment for historical data

To clean up your historical numbers, you will need to create a custom segment that can be applied to your data.

Creating a custom segment is much like creating the filter above, minus the permanent effects on your data.

To create a segment, follow these steps: Reporting > + Add Segment > + New Segment > Name Segment (something like ‘Exclude Spam Referrals’) > Traffic Sources > Filter Sessions > Source (select ‘Does Not Match Regex’) > insert you RegEx code used in your filter above > Preview & Save.

You can now apply this segment to any report within your Google Analytics account. You’ll be amazed at how much better your numbers are after filtering out the junk!

Bonus: List of identified referral spammers

Since we’re all in this together, we’ve created a complete list of the spammers we’ve identified.

[yellowbox]To view our list of over 330 spammers, simply visit our public Google Doc and download a copy for your personal use.[/yellowbox]

Note: While we try to keep this doc up-to-date, new spammers appear almost every day, making them nearly impossible to keep up with. With that said, if you identify any that are not currently on our list, let us know in the comments below!

The bottom line

Referral spam is very annoying and affects almost every site at some point or another.

To preserve the value of your data, you’ll need to take action to remove it.

I expect Google to take action in the near future, but until then, the filtering methods I’ve outlined here are the best way to manage and eliminate spammy traffic. If you’ve found something that works better, please let me know in the comments!