Start a Project
SEO for WordPress
Tutorials WordPress

How to Deal with Fake Bot Traffic

  • What is a bot
  • Good vs. harmful bots
  • Spambots
  • Smart spambots
  • Botnet
  • How to detect spam sources
  • How to protect a website from spambots

It can be very exciting to see a spike in traffic on your website; relief that you are finally doing something right. However, it is becoming increasingly more common to have spikes in traffic due to a fraudulent source known as bad bots.

The Bad Bot Report 2020 by Imperva states that bad bot traffic rose to 24.1% in 2019, and it’s the highest proportion ever.


What are bots and how do you stop them from skewing your reporting? Read on. I’m going to help you understand.

What is a bot?

A bot, short for robot, is a software application that has the primary mission of completing automated tasks online. These tasks are typically repetitive in nature and are performed with more efficiency and speed than is possible by a human.

Good vs. harmful bots

Bots are used for beneficial purposes such as indexing internet sources and search engines. However, their uses have also gone over to the dark side. Harmful bots are designed for malicious purposes, such as spreading malware, collecting email addresses, committing click fraud and artificially inflating website traffic. Let’s take a look at the different types of bad bots you need to be aware of.


Spambots are bots used to collect or “harvest” as many email addresses as possible so that they can be targeted for unsolicited commercial email (UCE). This is why more sophisticated Internet users tend to not link their email addresses the natural HTML way, but encrypt them in JavaScript, an image, or text clues like johndoe at gmail dot com. Some bots even fill out forms and thwart CAPTCHA protections.

Other bots spam without even collecting email addresses. They attack the servers directly by going to hundreds of thousands of websites each day and sending HTTP requests with a fake referrer header. They design and distribute these fake headers to avoid being discovered as bots. The phony header typically displays the website that the spammer wishes to endorse, and which they want to get clicks or even links from in the case that server logs have been made public.

Smart spambots

Some spambots are designed to send artificial traffic without even visiting a website. This happens when the bots produce HTTP requests from a Google Analytics tracking code. Your website ID is used as well. Not only can smart spambots send fake traffic to a website, but they can also send fake referrers. Since the referrer website often looks like a legitimate one, you may think that the referring website is real, though it’s not. The GM Block Bots plugin filters out these types of bots with a 403 Forbidden message and prevents them from showing up in your Google Analytics.


Botnet stands for a robot network, and it is a network of computers. The botnet is in communication with each other to perform tasks. It can be located locally, or it can be spread out across the globe. When a spambot accesses a botnet, it can gain access to the whole network of IP addresses and launch attacks including DDoS, Adware, Spyware, E-mail spam, click fraud, fast flux, and scareware. This further confuses website owners as fraudulent traffic can be coming from a wide range of IP addresses.

How to detect spam sources

Start by going to your Referrals report located in your Google Analytics account and sort the report by the bounce rate in descending order. Then, locate any referrers with a 100% or 0% bounce rate, and who also have 10 or more sessions. If you suspect that a website is a spam referrer, try googling information about it. Once you have confirmed these bad bots, you may want to block them from visiting your website. Of course, you could always just ignore them.

How to protect a website from spambots

If you are finding spambots in your Google Analytics frequently, you can block them with .htaccess. While, it is the most effective method, any small .htaccess mistake can bring your site down, so do so with caution.

You can also hide spambots directly in Google Analytics. While it does hide traffic, without spending endless hours setting up the filter, junk traffic is still logged.

Thirdly, if you’re a WordPress user, you can use the GM Block Bots plugin to defeat spambots. It’s compact, requires no setup, and has shown some pretty neat results. See the below graph showing bot traffic before and after the GM Block Bots plugin was installed.

Don’t lose hope. Spambots can be thwarted. While dealing with spambots can be frustrating, it’s important to stay on top of the threat. Doing so will give you a clearer view of how your website is performing.

Also, if you want to get more security tips or develop a highly secure website, please feel free to contact us. Our specialists will provide you with a free consultation and answer all your questions.

You might also like
seo unfriendly things
The Most SEO Unfriendly Things about WordPress

With a little time and set up, you can have your WordPress website running more SEO-friendly.

wordpress title tags
Optimizing Titles Tags for WordPress. Part 3: How Title Tags Can Rock SEO

The call-to-action doesn't belong within the title tag. Like the headline in paid search, the title sets things up.

optimizing title tags
Optimizing Titles Tags for WordPress. Part 2: The Strength of Title Tags

Can you see the potential for title tags to increase sales or leads for your business?

🍪 We use cookies to improve and customize your experience. To find out more about the cookies, read our Privacy Policy.