A global problem in SEO is the presence of referral spam, which negatively affects traffic metrics. In today’s article, we will look in more detail at how to detect and get rid of it.
What is referral spam?
Referral spam is negative traffic sent by spam bots under the guise of various domains and IP addresses. When referral spam is present, the site receives inflated traffic from spam bots, which can trigger search engine penalties based on behavioral factors (bounce rate or session duration).
Spam bots often look for poorly protected sites and attack them. If your site is hosted on a cheap server or built on an unprotected lightweight CMS, there is a very high probability that spam bots will target your resource.
How to detect the presence of referral spam
➤ Log in to Google Analytics for the site you are checking for referral spam.
➤ Go to “Acquisition” → “All Traffic” → “Referrals.”

➤ Sort the report in descending order by bounce rate.

Pay attention to referrals with a 100% bounce rate and a session duration of 0. This is 100% referral spam.
Methods to combat referral spam
1. Blocking a referrer using a spam bot
To do this, you need to add the following directives to the .htaccess file located in the root of your site.
Example:
RewriteEngine On Options +FollowSymlinks RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*site\.com\ [NC,OR] RewriteRule .* – [F] |
This code will block all HTTP and HTTPS referrers from the site site.com and all its subdomains.
2. Blocking the IP address used by a spam bot
To do this, you need to add the following directives to the .htaccess file located in the root of your site.
Example:
RewriteEngine On Options +FollowSymlinks Order Deny,Allow Deny from 123.45.67.89 |
Important! This is only an example; in this form it will not work, you need to insert your own IP address values.
3. Excluding referral traffic
To ensure that referral traffic is not summed with the total traffic, it is necessary to create and configure traffic filters in Google Analytics, which will subsequently not take into account sources of referral attacks. Go to “Acquisition” → “All Traffic” → “Source/Medium.”

We see traffic sources of different types. We are interested in referral traffic. Spam bots can modify sources and make them similar to each other by name.
Example №1: excluding referral spammers that contain a repeated word in the middle of their name.

Based on the traffic from the last 6 months, we will highlight only those sources that contain the word “buttons.” To do this, we will use the traffic search to filter sources containing “buttons.”

As a result, we will get a list of all domains containing “buttons” in their name that were used by spam bots as referrers.

21 Referral spam source containing “buttons” in the name
To exclude these spam traffic sources, go to the top menu item “Admin.” Then, in the “View” column, select “Filters.” To create a new filter, click the “Add Filter” button.

To create a new filter, click the “Add Filter” button.

Next, you need to create a filter template that will exclude traffic from all spam sources containing “buttons.”

The filter template uses the regular expression .*buttons, which accounts for all characters, including repetitions, before the word “buttons.” From the moment it is saved, all subsequent traffic coming from referral spammers containing “buttons” will not be included in future traffic statistics.

Example №2: excluding traffic from hosts with the same beginning in their name. Currently, 26 hosts have been identified that start with the word “site.”

To exclude these spam traffic sources, go to the top menu item “Admin,” then in the “View” column, select “Filters.”

To create a new filter, click the “Add Filter” button.

Next, you need to set a condition using a regular expression to exclude all sources that start with the word “site.”

The regular expression ^site indicates that all spam hosts starting with “site” will be excluded from the total traffic from the moment the filter is saved. Save it, and you will get the following result:

Example №3: targeted exclusion: suppose we have a single spam host; we cannot exclude it using a regular expression because it is just one.

To specifically block such hosts, you need to create a filter for each individual spam referrer.

Save it, and you will get the following result:

Important! If these filters are deleted, spam traffic will start appearing in the total traffic statistics again. The downside of this solution is that the list of such referrers is constantly growing, so it is necessary to periodically monitor traffic reports for new referrers to avoid skewing the statistics.