1

I am having a problem with my site where I am getting spam direct traffic. I get over 700 "visits" a day with 0% Bounce Rate, 2 pages "visited" (it is the same page listed twice) and every session time of 0 seconds. The "traffic" is coming from all over the world. See the screen shot of my analytics.

enter image description here

enter image description here

The traffic is visible in the server log. How do you stop this spam traffic?

  • To tell you how to stop it, you need to tell us a lot more info about the traffic. What is the user-agent? Is it actually hitting your site (also appearing in your server logs), or is it just hitting Google Analytics directly with your id? – Stephen Ostermiller Jul 20 '17 at 12:25
  • It looks like the answer to this question could be helpful to you: Can organic traffic be spoofed in Google Analytics the same way as 'Refer spam' It says how to block GA spam no matter what fields it is spamming. – Stephen Ostermiller Jul 20 '17 at 12:27
  • Thank you Stephen. The traffic appears on the server logs as well. – NDLF Jul 20 '17 at 13:43
  • Can you edit the question to include a few lines of this spam from your log files? – Stephen Ostermiller Jul 20 '17 at 15:55
1

I wouldn't call it spam; it is more like bot traffic.

The first thing you should do if you haven't done it already is to enable the option Bot filtering in the view configuration in your Admin section.This won't solve everything but at least will exclude some hits from known bots and spiders.

For the rest, since there is not an obvious source you should play detective a little bit and find patterns that will help you exclude this traffic.

Go to the direct traffic report (or select the direct traffic segment), select the affected page (usually home) and start changing the secondary dimension.

Dimensions worth checking are:

  • Browser/Browser version
  • Operative system/ OS versions
  • Browser size
  • ISP or Network domain
  • City
  • Flash version

Open a second window with dates where you didn't have this issue so you can compare

Depending on what you find you can either create a filter, a segment, or both.

  • Filter: If you find something concrete like a private ISP or very old versions of flash or a browser.

  • Segment: If what you find is not safe to filter because might exclude real users. Segments allow multiple conditions.

Here is an example of an actual segment I use for a similar issue enter image description here

Note: If this is a direct attack to decimate your resources you should also take measures at a server level, either blocking it from the htaccess or using a CDN. Your hosting provider should be able to help with this too.

If you need more specific instructions, you can find them in this guide:

https://www.ohow.co/unnatural-direct-traffic-google-analytics/

  • Thank you. This will help for the analytics. But is there a way to stop this to affect the site directly as I am concerned for the google ranking of my site and the bandwidth it is using (80GB last month)? – NDLF Jul 20 '17 at 19:32
  • As I mentioned in the note I added later. If these bots are using a lot of your resources, you should block them from your server. The same patterns you find in your Analytics(plus others like IPs) can be used in your htaccess (or similar config files) to block temporarily or permanently these visits. Changes on server files are quite sensitive, so always make a backup. If you manage to block them from your server, then you only need the Segment in Analytics to clean your historical data. The filter won't be needed – Carlos Escalera Alonso Jul 20 '17 at 20:02
  • Thank you very much Carlos the link you gave me helped! As for the htaccess... this bot is using over 700 different IPs and many Browser version, many Operative system and Browser size. A total mess. I consider this question fully answered. Thank you very much for your help. – NDLF Jul 20 '17 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.