We have a "Thank You" page that users are redirected to after completing a form submission. Random IP addresses are accessing that page over and over causing our analytics data to be skewed.

Here's a screenshot of our page views for the past 7 days: enter image description here

As you can see only 414 unique page views compared to 20k total pageviews. I've tried banning IP addresses but it doesn't seem to make a difference. I've manually banned over 50 and the page view count doesn't decrease.

Tracking the IP addresses returns random US locations. Most of them seem to be from Comcast subscribers.

I'd like to find a solution to eliminate or significantly reduce this traffic.

I considered excluding this page in Google Tag Manager but our conversions are tracked based on accessing that thank you page. So it needs to be tracked.

Any suggestions?

  • EZ button is Cloudflare. This is not an ad I have no affiliation with the company Aug 20, 2022 at 1:18

3 Answers 3


You could require viewers to have a REFERER which matches the calling page.

This would only be a partial solution - you would need to work with your webserver and/or script to filter out the bad results.

If your webserver is Apache, maybe something like the following in your htaccess will do you (untested, and not my speciality) -

 RewriteCond "%{HTTP_REFERER}" "!.*example.com\/path\/to\/form\/.php" [NC]
  • 1
    Consider that legitimate clients may withhold the refer(r)er for privacy reasons. I believe all clients send it by default but some have an option to disable it.
    – Henrik N
    Aug 20, 2022 at 10:54
  • @henrykn Its conceivable but that breaks the standard so thats on them. Implementrd correvtly they shpuld provide this if the pages are on the same domain. The server side alternative is to check the contents of the post request and/or track a session cookie but that is going to be a lot harder to retrofit.
    – davidgo
    Aug 20, 2022 at 18:54

You could POST the submission to the “thank you” URL and not allow GET requests. This assumes the bots don’t submit the form as well - you could reduce the risk of that with e.g. a honey pot (invisible field that humans won’t fill out that causes the submission to be rejected) or a captcha.

Or depending on how much control you have over the page and its analytics tracking, you could potentially allow GET requests as well but only track the relevant analytics on POST requests, or alternatively only if the URL contains some short-lived or use-once token generated on submission.


The solution to your problem will require the following :

  1. Add a google recaptcha to your main form.
  2. Add a file in the middle between the form and the thank you page that redirects to the thank you page.

The steps are the following :

  1. Sign up for google recaptcha v2 service API from here : https://www.google.com/recaptcha/about/

  2. In the page file that has the form insert this script tag by google before the end of the </head> html tag.

         <script src="https://www.google.com/recaptcha/api.js" async defer></script>
  3. Find the file that has the form which is most likely html, and insert this code right under the beginning of the form table, which should starts with <form bla bla... > and replace the sitekey with the one that google gives you when you finish setting up your captaha v2

          <div class="g-recaptcha" data-sitekey="xxxxxxxxxxxx"></div>
  4. At the end of the form file page insert the following code :

// here you must input the secret key, not the site key
// don´t worry, it is server side protected and won´t be
// visible under the page source, it´s php code from now on...
$secret = "yyyyyyyyyyyyy";

$post = [
    'secret' => $secret,
    'response' => $_POST['g-recaptcha-response'],
    'remoteip'   => $_SERVER['REMOTE_ADDR']

$ch = curl_init('https://www.google.com/recaptcha/api/siteverify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);

$response = curl_exec($ch);


$array = json_decode($response,true);

if($array['success'] == 1){

echo "<script> location.href='new_url'; </script>";

    echo "success!" ;
    echo "form not accepted so far....";
  1. Replace $secret = "yyyyyyyyyyyyy"; with the secret code you get from google and replace new_url with the url of a file called redirect.html and create that file in your host directory.
  2. In the redirect.html insert this code :

<script> location.href='new_url'; </script>

  1. Replace the new_url of the last file with the url of the thank you page.

Above is the primary solution, but if you want to go more securely you can do something with PHP called session, which will not allow the redirect file to redirect to the thank you page unless, the user came right from the form page. To do that you will have to add this :

under that same form file add this extra php :

$_SESSION["redirectscript"] = "<script> location.href='new_url'; </script>";

This time you will have to change redirect.html to redirect.php

Change the new_url to the redirect.php link.

Inside of redirect.php delete everything and insert only : <?php session_start(); ?> <?php echo $_SESSION["redirectscript"]; ?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.