Products Solutions Templates Pricing Resources

Invalid traffic detection: identifying and filtering suspicious activity

Home / Everything About / Everything About Analytics / Invalid traffic detection: identifying and filtering suspicious activity

Your conversion rate suddenly jumps from 2% to 5%. Perfect. Then you notice all the new conversions came from a single IP address in a single session. And each conversion happened one second apart. Suspicious.

Invalid traffic doesn't always announce itself as spam. Sometimes it looks legitimate but follows patterns no human would create. Learning to spot these patterns saves you from building strategy on fake data.

What counts as invalid traffic

Click fraud

Automated clicks on your ads that don't represent real customer intent. Someone runs a bot that clicks your paid search ads, inflating your CPC spend without generating real conversions. You pay more per click for traffic that's not worth anything.

Conversion fraud

Bots submitting forms or completing checkout flows to artificially inflate conversion metrics. They don't actually buy anything. They just trigger conversion events. Your conversion rate looks better than it actually is.

Suspicious traffic patterns

Traffic that looks automated: identical session duration, same exact scrolling pattern, zero variation in behavior. Users from impossible locations (simultaneous sessions from different continents). Traffic that doesn't match normal user behavior for your site.

Impossible user journeys

A user submits a conversion, leaves, comes back, and submits another conversion from a different device two seconds later. Impossible unless it's automation. A user visits 500 pages in 30 seconds. No human could scroll that fast.

Traffic from data centers

Traffic from known data center IP ranges rather than residential or mobile IPs. Data center traffic is often automated. It could be legitimate (your team testing), or it could be malicious (bots, scrapers, click fraud farms).

How to identify invalid traffic

Look for sudden spikes with no cause

Traffic doubles overnight without a campaign launch. Conversions spike but average order value drops to zero. These unexplained changes often indicate invalid traffic.

Analyze traffic patterns for anomalies

Valid traffic has variation. Users spend different amounts of time. They visit different numbers of pages. They bounce at different rates. Invalid traffic is consistent: same duration, same pages, same behavior every time. Look for sessions that are too similar to each other.

Check for single-IP traffic concentration

If 50% of your new conversions came from one IP address, that's suspicious. Real users come from different IPs. A single IP generating many conversions usually means automation.

Use your tool's invalid traffic detection

Google Analytics has automatic invalid traffic filtering. It uses machine learning to detect suspicious traffic patterns. It's not perfect, but it catches obvious cases. Enable it by setting your view's bot filtering setting.

Compare conversion timing patterns

Real conversions spread throughout the day with natural variation. Invalid conversion patterns are regular. Conversions happening at exactly 10-minute intervals. Conversions from the same session happening microseconds apart. These patterns signal automation.

Common invalid traffic sources

Ad networks and click fraud

Ad networks sometimes deliver low-quality traffic that doesn't convert. Competitors or malicious actors might run bots that click your ads to drain your budget. Search ads are particularly vulnerable because you pay per click regardless of quality.

Referral traffic sources

Some referral sources deliberately send low-quality traffic. They get paid by analytics views so they send bots disguised as referrals. Your referral source looks legitimate but traffic doesn't convert.

Affiliate networks

Some affiliates use bot traffic to inflate their commissions. They send automated traffic claiming it came from legitimate sources. The traffic never converts but they claim commission anyway.

Data scraping bots

Bots scraping your content, pricing, or product information. They don't represent real business value. They consume server resources and distort your traffic metrics.

How to filter invalid traffic

Enable automatic invalid traffic filtering

Most analytics tools have built-in detection. Google Analytics automatically marks invalid traffic but doesn't filter it by default. You have to turn on the filtering. Go to your view settings and enable "Exclude all hits from known bots and spiders" and turn on invalid traffic filtering.

Create a segment to isolate invalid traffic

Before filtering it out, measure it. Create a segment that isolates what looks like invalid traffic. How much of your traffic is invalid? What's your real conversion rate without it? Understanding the scope helps you decide whether to filter.

Create custom filters for invalid patterns

If automatic filtering misses patterns, create custom filters. Filter out traffic from data center IP ranges. Filter out sessions with zero bounce time and impossible page counts. Filter out conversions from single IPs that convert too many times.

Work with your ad network

If invalid traffic is coming from ads you're paying for, report it to your ad network. They have tools to identify click fraud and will often refund invalid traffic. Google Ads and most DSPs have fraud detection built in.

The challenge: false positives

Legitimate traffic that looks suspicious

Power users on your site might visit 500 pages in an hour. API clients pulling data might show as single-IP, high-volume traffic. A team testing your site from a data center might look like invalid traffic. Too strict filtering excludes real users.

Balancing sensitivity and specificity

Aggressive filtering catches more fraud but risks false positives. Conservative filtering might miss real fraud. Find a balance by monitoring both the filtered and unfiltered views. Compare them regularly to catch over-filtering.

Document your filtering rules

Keep records of why each filter exists and what it's designed to catch. This prevents someone from removing a filter thinking it's outdated when it's actually important.