What is the deal with referral spam? Aside from it being mega annoying, pointless, and stupid?

If you use Google Analytics, you definitely know what I’m talking about. It’s those almost-real-but-actually-fake-spamming-links that show up on your analytics and screw up your KPIs.

It annoyed me. So I figured out how to get it off my dashboard, and here’s how.

At my company we keep a close eye on our Google Analytics web stats, probably like you. Yesterday, we popped into our real-time stats and noticed a bunch of sessions from around the world. Hey wow, that’s pretty cool!


There were 38 concurrent sessions. That’s not an abnormal level (Phrasee is a niche product, so we don't want or expect millions of sessions), but the geographic spread was interesting. Who knew we were so huge in Southeast Asia?

So I looked into it a bit… and guess what:

Ugh. That’s so annoying.

What is Google Analytics referral spam?

Referral spam has been a trend for the last year or two. Some dodgy spammers refer fake traffic to your site, always from silly looking URLs like these...

(note: don’t actually go to these sites.)

Our site gets thousands of these garbage referrals every month. It reminds me of the “Ch33p V14gr4” email spam that was prevalent in the early 2000s. Slight misspellings of something that’s marginally interesting. 

Why do these nefarious spammers create referral spam?

I’ve got a few theories, but there are likely other reasons. Anyways, here are my thoughts:

  1. These spammers want you to back-link to them, and figure less-aware webmasters will ping back to their sites.
  2. Some of the referring sites have malware on them, so they’re hoping you’ll see them in your stats, visit the sites to investigate… and get infected.
  3. These spammers have singled me out and want to mess up my web stats, because I got to the bar about three seconds after them and got served first, which annoyed them, so they’ve gone out of their way to make my life difficult.

Likely #s 1 & 2 are the culprits. #3 likely didn’t happen. I always note the time-sequence of arrival and stand by the unwritten rule of bar service. Because a civilisation without rules isn’t a civilisation at all. It’s anarchy. And I don't want to contribute to that form of anarchy.

Why should you care about referral spam?

Referral spam isn’t going to mess up how your site functions (as far as I can tell), so from that standpoint it’s no biggie.

What it will do is screw up your data-driven decision making!

Why? Because if a huge amount of traffic comes from spurious sources, and you don’t remove it from your KPI metrics, then your web statistics will be untrustworthy and skewed.

Say 10% of your traffic is referral spam, and the bounce rate for it is 98%. This brings up your overall bounce rate to, say, 60% from 52%.

So based upon that bounce rate jump, you’d initially think you’ve got a user experience problem, and spend loads of time trying to fix it. But there’s not actually a problem – referral spam is messing up your decision making. See what I mean? 

So how do you get rid of referral spam in Google Analytics?

Here’s the bad news: stopping it is virtually impossible. It’s going to keep happening, and I’m sure that the smart brains at Google Alphabet are trying to figure out a solution.

One caveat to mention:

I’m not a Google Analytics expert like many other people out there are. I’m a pragmatist, and I wear many hats on a daily basis, one of which is periodically looking at our web stats. So what I wanted to figure out was a simple, effective solution. It’s entirely possible (even probable) there’s other methods to fix this problem. This is just me sharing how I figured how to do something about it.

If you’ve got a better method then by all means share it in the comments! I’d love to know if I could be doing it better myself.

Option 1: Block IPs server-side (pain in the butt)

What you could do is identify the source IP addresses of the referral spam and block them from accessing your site.

I tried this for a bit, but found that these dastardly spammers kept moving IP addresses! Plus, making server-level adjustments requires mucking about in Apache or something like it (the Wordpress plugin I tried mega messed up our .htaccess file, so I just did it old-school in a console.)

Also, most marketers wouldn’t have the access or skill set to do this, so they would refer it to their IT team… and delays would ensue…

Plus, and importantly, you run the risk of blocking legitimate traffic. These spammers could be using a phished botnet to serve the referral traffic. So by blocking IPs you could be stopping potential readers from accessing your site. I don’t know if this was the case or not, but I didn’t want to risk it. 

Option 2: Use Google Analytics filtering (less of a pain in the butt)

This is the best solution I found, but it requires a small bit of work on a weekly basis. It takes me about 5-10 minutes each Monday to sort it out.

Follow these steps:

  1. Look at your referral traffic, and identify anything that looks a bit dodgy.
  1. Click 'Add segment' at the top of your screen and click 'New Segment', then click Advanced -> Conditions.
  1. Add a filter for 'Source' ==> 'Contains'. It’s easier to use 'Contains' as you’ll quite often find patterns in the referral spam URLs. This saves you a bit of time and may prevent similarly structured URLs in the future. I also experimented with regular expressions, but the pattern matching was removing some legitimate traffic sources so I don't think it's a durable solution.
  1. Click save. (I forgot to save it the first time, so had to do it twice. I’m smart.)

Now the stats you see in your GA dashboard will be your actual traffic, not these ropey spammer stats. It’ll help you avoid making decisions based upon bad statistics.

It’s not hard to segment out referral spam, and it’s important

Referral spam is a pain in the butt, and I still don’t quite get why these annoying dudes bother doing it. There’s way better ways to annoy people online. For example:

  1. Posting pictures of your dinner on Instagram. Hey! You ate dinner! Well done, I'm happy for your digestive system.
  2. Posting pictures of your kids on Facebook. Hey! You have kids! Well done, I'm happy that your reproductive system is functional.
  3. Posting motivational quotes on Twitter. Hey! You've figured out how to copy and paste! Well done, I'm happy that you know how to plagiarise.


If there are other, better methods to remove referral spam in GA, I’m all ears

This is the way that I figured out to do it, being a non-GA specialist… and it seems to work for now. To be honest, I was annoyed by these dodgy stats, and reckon at least one other person out there is probably annoyed too... so I hope this blog post will help you become less annoyed!

Take that, you spurious spammers! Digital marketers: as you were. 

Parry Malm

Published 24 August, 2015 by Parry Malm

Parry Malm is the CEO of Phrasee and a contributor to Econsultancy. Connect with him on LinkedInTwitter or Google+.

27 more posts from this author

You might be interested in

Comments (21)

Save or Cancel

Andrew Westley, UX Analyst at The IET

This problem seems to have been kicking around a while. Moz wrote this article (https://moz.com/blog/stop-ghost-spam-in-google-analytics-with-one-filter) recently that did a good job of summarising problem and potential solutions. Blocking at server unlikely to solve problem as most of this traffic doesn't generate actual site visits, just fires fake stats into your GA account.

almost 3 years ago


Werner Bastianen, Marketing & Strategy at Stijlbreuk

Hi Parry,

I know where you're coming from. We had the same frustration as you an decided to automate the process, because the number of spammer increase really fast and you'll have to do it for every website & view you manage. Plus, there are more known spammers out there who didn't hit your Analytics yet, but you would love to block them even before they pop up in your data.

We published the tool for free on www.referrerspamblocker.com, so anyone can use it.

It will block future visits from the spam domains and we also provide pre-made segments that you can install easily to filter the spam from your historical data. I'm curious what you think of it and would like your feedback on our tool.


almost 3 years ago

Matthew Hall

Matthew Hall, Managing Director at Hallway Studios

Nice article and a topic we've had issues with in the past with our clients.

We have taken to using Google Tag Manager for dynamic integration of the Google Analytics code. This tactic seems to stop most of it, for now at least. Probably due to the fact that most websites don't use this method for the tracking code integration, and instead use the standard tracking code manually inserted on all pages.

This manually inserted code clearly shows the property ID in the HTML source, which is what the spammers are using to send the fake requests upstream to Google. Using Tag Manager buries this property ID behind another layer. It's probably still possible to send GA spam in this implementation, but I reckon most of the scripts that run these spam submissions aren't written to cope with Tag Manager due to the fact most sites don't use that implementation method.

On top of this, we always tick the bot filtering box ("Exclude all hits from known bots and spiders") under "Admin" -> "View" -> "View Settings".

This combination has been fairly effective.

Hope that helps!

almost 3 years ago


Henry Green, marketing at Online

I faced a similar problem. A little bit of googling showed me that it is possible to exclude referral spam for good with a single filter in Analytics.
This comprehensive article should cover everything you need to know:

Maybe an interview with the authro will be a more useful article!

almost 3 years ago

Matt Clarke

Matt Clarke, Ecommerce Director at B2B

Unfortunately, attempting to block IP addresses on your server won't actually block referral spam. This is because they're sending it directly to the Google Analytics server and they didn't actually interact with your website in the first place. Google could detect them and block them, but at the moment it does not.

If you've got any unpublished Google Analytics properties you'll probably even find they suffer from referral spam, even if they're not published. I suspect this is because the referrer spam bots just guess random property IDs and send the referrer spam via Measurement Protocol.

By the way, the creation of filters can be made easier using this clever Spam Filter Insertion Tool by Simo Ahava: http://www.simoahava.com/analytics/spam-filter-insertion-tool/

almost 3 years ago


Andrew Zack, Account Manager at MLive Media Group

A few other good ones to throw in your segment are: Filtering by hostname to only include users who visited your site on your hostname. A common practice among these spam bots is to just fire your GA code and never actually go to your site so their Hostname is usually not from you. Another one is to exclude "not set" screen resolution, another quick and easy spam remover.

Lastly, I've found it easier to do a regex expression to remove/exclude spam so your regex can just look like: buttons|seo|free|semalt etc... so you don't have to keep adding a new source every time free-share-buttons change from www1. to www2

almost 3 years ago

Parry Malm

Parry Malm, CEO at Phrasee Ltd.

Thanks for the comments everyone! Useful to know there are many ways to skin a spammer.

Re regex pattern: I tried it but was blocking some legit back link traffic. Lots of websites have the word "buttons" in them :)

Great to know there are automated tools to fix it also. Wish they had turned up in my search results, would have saved a bit of time :)

almost 3 years ago


Clive Holtman, Search Marketing Manager at 3M UKEnterprise

As others we have this issue as well. We have also tried Property>Tracking Info>Referral Exclusion List in Admin as suggested by Google. Unfortunately this also has had little effect so far. We have contacted Google about this and they are looking into the problem as to why it is not working as intended.

almost 3 years ago


Chris Monkman, Web Developer at E-Dzine

It depends on your server, we run an MS shop and in the web.config you can add a black hole for the referral headers which we've found quite effective at knocking referral spam to size.

almost 3 years ago


Laura Marks, Digital Marketing Co-ordinator at Armit Wines

This is something I recently tackled since our website was receiving barely disguised spam referral links alongside something called 'Event Tracking' which is also spam. I did a bit of research and have been able to completely filter out traffic from these sources (so far).

I added a new view to GA and filtered out the spam referral and hostname sites using a combination of information from the following webpages:




Took a bit of patience but seems to have worked for the excluding the offending referers!

almost 3 years ago


Laura Marks, Digital Marketing Co-ordinator at Armit Wines

Just to specify - when I say event tracking it appears as a referral through 'event-tracking.com' and claims to be related to analytics.js

When I delved deeper into the reporting to ascertain the trigger by event action or category I got the message "to use this feature visit: EVENT-TRACKING.COM".

(dont visit that website)

It is well disguised spam.

almost 3 years ago


Laura Abbott, Marketing Manager at Dods Group

Thanks for the post Parry. This really is an infuriating problem. Our websites mostly get 100-200 visits a day and we found that at one point referral spam was doubling our visits. To start with we thought we were getting excellent campaign results until we properly looked into it.

We have managed to block a lot of it through the filtering method you suggest, I have also done something similar but with host names. Although now spammers are using a different hostname each time so that has stopped working.

I really can't understand how people can have created something that's just a little bit annoying and can't benefit them much. I'd be interested to see if referral spam actually helps them get many hits.

almost 3 years ago

Parry Malm

Parry Malm, CEO at Phrasee Ltd.

Apparently there is an easy way to fix it. All you have to do is transfer £150,000 to the wife of a recently deceased Nigerian general.

almost 3 years ago

Simon Lamble

Simon Lamble, Director at Blossom Associates

@Clive Holtman Using the referral exclusion setting won't stop you counting referral spam - it just means analytics will not show traffic to those locations as coming from an external traffic source (it's meant for avoiding seeing referrals from subdomains etc).

We've found adding a filtered view based on hostname the most effective - only including hostnames that you know that you use (obviously, you need to stay on top of this if your site is evolving)

almost 3 years ago

Steve Pannett

Steve Pannett, Senior Designer at three sixty

Filtering is the only real fix at the moment, as the visits don't technically land on your website at all (they just hit the GA server)

Rather than blocking each 'referral' visit individually you could use the "include" option and then input your web address? Because the spammers don't land on your server, it would then only show visitors who actually visited your website in your GA.

This is particularly helpful because the spammers often add numbers to their names or tweak them ever-so-slightly, meaning you'd have to create a new "exclude" addition to your blocking filter each time.

I'm no expert but I just added an "Include > Hostname > www.yourwebsitehere.co.uk&quot; filter and it seems fine to me. I've been monitoring it carefully against an unfiltered version of my GA to ensure I'm not filtering out any useful traffic and there doesn't seem to be any collateral damage.

Google will be working hard to come down on this like a ton of bricks, so apart from these patched fixes the best thing we can do is wait :)

almost 3 years ago


Mike Sullivan, Founder at Analytics Edge

Hey Parry, welcome to the battle. Several of us have been fighting this for months now, and I have summarized the best known solution in my Definitive Guide article. I also include up-to-date filter expressions and step-by-step instructions for both filtering and using a custom segment. The approach works, with over 150,000 people already adopting it.

Also, if anyone thinks the Referral Exclusion List is a solution, here is why you should reconsider:

almost 3 years ago

Parry Malm

Parry Malm, CEO at Phrasee Ltd.


Sensible, I'll try it out! Cheers!

almost 3 years ago


Paul Maddock, Account Director at APD

The easiest filter I've found for removing this is to create a filter to only allow traffic that has your hostname. For example under filters create one that include hostname that matches .*example\.com.*.

This has removed all referral spam from my analytics views when implemented.

almost 3 years ago


Steven Chiocchi, President at Areli Group


My first referral spam encounter within my Google Analytics dashboard piqued my curiosity, how I could of landed in their trap myself? Upon researching solutions to mitigate the problem and reclaim my clean data, I noticed that thousands of people were having the same problem.

Unfortunately, a majority of the advice available prompted everyone to build filters within Google Analytics that "exclude" the traffic, this seemed daunting. Who has time for that? There are hundreds of referral spam bots out there and the list is growing every week. That would mean I would have to catch them as they come in and refine as I go! How can one possibly do this while managing their day to day responsibilities? All in all, it seemed inefficient.. like using a band-aid for a deep gash.

So we came up with a solution, and since you asked if anyone had a better solution I figured I would jump in.

I was wondering if you would consider checking out www.foxlytics.com and testing it with us, its just a snippet of code that block referral spam from ever hitting your analytics reports. It seems to be working very well for everyone we have testing, but we would like your opinion as well.

Let me know!

almost 3 years ago


George Bates, Digital Marketing Executive at Studio-40

Great article Parry!

Reading through the comments here and there's a whole host of decent resources that echo what you say as well as tools that go some way to stopping the problem.

However, all of these guides/tools seem to have their limitations and I for one am not too pleased about giving them access to my analytics account (which is what some of these bot blocking tools need).

I know it's only a short term fix but i've created a similar guide with an added list of referrer spam domains and a Google form for you to contribute your own.

I thought if we pool our collective knowledge of these known spam domains together we can go someway to stopping the problem. Please take a look :) : http://bit.ly/spamreferrallist

over 2 years ago


tedi post, student at student

over 2 years ago

Save or Cancel

Enjoying this article?

Get more just like this, delivered to your inbox.

Keep up to date with the latest analysis, inspiration and learning from the Econsultancy blog with our free Digital Pulse newsletter. You will receive a hand-picked digest of the latest and greatest articles, as well as snippets of new market data, best practice guides and trends research.