TraficStats

Data Quality

Detect Referral Spam and Bot Traffic

Recognize suspicious traffic patterns and protect reports without deleting legitimate visits.

By TraficStats Editorial Team · Updated September 26, 2026 · 6 minute read

What this metric or method tells you

Bots and spam can create abrupt sessions with implausible engagement, locations, hostnames, or referrals. Document filters and preserve an unfiltered view so corrections remain reversible.

The useful question is not whether a number moved in isolation. Ask which audience, page, campaign, device, and time period produced the change. Keep the definition and reporting scope visible so another person can reproduce the comparison.

A practical analysis workflow

  1. Write the decision first. State what you will change if the evidence points in one direction or another.
  2. Check the collection. Confirm the event, date range, filters, consent behavior, and comparison period before interpreting the chart.
  3. Segment carefully. Break the result down only where the segment has enough volume and a plausible reason to behave differently.
  4. Look for supporting evidence. Pair the headline metric with volume, quality, and downstream outcomes.
  5. Record the next step. Document the finding, limitation, owner, and date for a follow-up check.

Actions worth taking

  • Check hostname, geography, and behavior together.
  • Exclude internal and known automated traffic.
  • Annotate every filtering change.

Start with the smallest change that can test the explanation. Preserve the earlier report or annotation so you can distinguish the effect of the change from seasonality and ordinary variation.

Common interpretation mistakes

  • Blocking a whole country from one spike.
  • Editing historical exports without keeping the original.

A dashboard cannot remove uncertainty. Use these measures as evidence, state the limits, and avoid presenting estimated or attributed values as exact counts of individual people.

Review checklist

  • The metric definition and denominator are written beside the result.
  • The date range and comparison period represent similar business conditions.
  • Internal, test, and known automated traffic are handled consistently.
  • No personal or sensitive information appears in URLs, event names, or parameters.
  • The conclusion leads to a specific decision or a clearly defined follow-up question.