Block referrer spam

If you use Google Analytics to track the performance of your website (and you definitely should!), you may have noticed something strange going on in your traffic reports of late. Does this look familiar to you?

Referral spam

If you've seen URLs like buttons-for-your-website.com and 100dollars-seo.com in the 'Referrals' section of your Analytics account, then you - like countless others - are a victim of referral spam. This is when spammers send phony visits to your site so that their name will appear in your Analytics reports.

Hold on - why are people doing this?

For the spammers behind buttons-for-your-website.com and the like, fraudulently appearing in somebody else's Analytics report is like a very unorthodox kind of advertising.

Allow us to explain. When your website gets referrals from a site you don't recognise, your first course of action will probably be to check out that site and find out why you're receiving traffic from them - for all you know, somebody has written a blog post about you or reviewed one of your products. So you type buttons-for-your-website.com into your browser's address bar and press enter...

...and that's how they get you. As soon as you visit your new referrer's website, their shady marketing tactic has worked and they've won. Bear in mind that these spammers have most likely been targeting many thousands of websites; your one inquisitive visit may not seem like much, but multiply it by a hundred thousand and you may begin to see what these people stand to gain by inserting themselves into other people's Analytics data.

The end goal of all this varies depending on which spammer you've been hit by; some want you to sign up for their SEO service or install their button on your blog, whilst others simply get money for every hit their website receives.

Is this a problem?

At first, you may not see much reason to do anything about these referral spammers, but the more they do it, the more your Analytics data will become skewed and inaccurate. For example, Analytics might tell you that you received 3,000 visits last month - a new record for your site - but, upon closer inspection, you'll realise that roughly a third of those visits came from spammers instead of real people.

In short, referral spam makes Google Analytics much harder to use properly, and if you want to get a truthful impression of how well your site is performing, we strongly recommend that you take action.

So how do I block referrer spam?

We're glad you asked. Broadly speaking, there are two types of referral spam: bot referrals and ghost referrals. In this blog post, we'll tell you how to tackle 'em both.

Part 1 - Terminating Your Bots

Some spammers use bots to invade our Analytics accounts, setting up programmes that automatically visit people's websites over and over again. Since Google Analytics can't differentiate between a legitimate session and an automated one, these visits will be counted alongside all of your real customers, and after a while they'll really start to pile up.

Here's how to block bot referrals and put an end to your own personal robot uprising:
  • Log into your Google Analytics account and click on the Admin tab at the top of the page.

  • In the right-hand column, select your preferred View and click Filters. Then, on the next page, click + NEW FILTER.

  • Select Create new Filter and give your filter a sensible name, like this:
Death to spam
  • Under Filter Type, click Custom. Then, click Exclude and, from the drop-down menu, select Campaign Source.

  • In the box marked Filter Pattern, type the name of the website(s) whose referrals you wish to block. If you are blocking multiple referrers, separate each website name with a | rather than a space. You should end up with something like this:
buttons-for-your-website.com|100dollars-seo.com|www.event-tracking.com
  • Click Save to apply your filter and lock the specified websites out of your Analytics reports. Note that you may need to add more websites to the Filter Pattern field further down the line - if so, just add a | to the end of your original list and add the new sites as above.

Part 2 - Exorcising Your Ghosts

Ghost referrals are tricky. These spammers never actually land on your website (not even via an automated bot, like the spammers covered in Part 1); instead, they send information straight to Analytics saying that they've been on your pages.

Fortunately, there is a way to stop them. Here's our step-by-step guide to busting ghost referrals and restoring peace to your Google Analytics reports:

  • On your Google Analytics reporting screen, set the date range to show the past year's worth of data.

  • On the left-hand side of the screen, click Audience > Technology > Network. Then, just underneath the main line graph, you'll have the option to set a Primary Dimension - set this to Hostname instead of Service Provider.

  • You will now be shown a list of hostnames that have used your website's tracking ID in the past year. Your main site URL will (hopefully) be the most prominent, but you'll probably see a bunch of others that aren't so familiar:
Hostnames
  • Make a note of all valid hostnames on this list. This will include your domain name, but it may include other sources too - if you have pages on the domain/server in question, it's probably a legitimate source of Analytics data. In the list above, www.henstuff.co.uk (main website) and freedapromotions.us2.list-manage.com (mailing service) are valid hostnames; the others are spam referrers.
IMPORTANT! You may find that google.com and other seemingly reputable names like mozilla.org and firefox.com appear as hostnames in your Google Analytics report. However, since you probably don't have any pages on the Google servers themselves, this traffic is almost certainly spam. Some spammers fake a 'google.com' hostname to appear legitimate and escape the attention of site owners like you. Don't be fooled - ignore these hostnames!
  • Once you've made a list of all valid hostnames, click the Admin tab at the top of the screen. Then, go the right-hand column, select your preferred View, and click Filters.

  • Click the + NEW FILTER button; then, on the next page, select Create new Filter and give your filter a sensible name, like this:
Ghostbusters reference
  • Under Filter Type, select Custom; then, set the filter to Include > Hostname.

  • In the Filter Pattern box, type each of the valid hostnames you noted down earlier. Again, use the | vertical bar to separate hostnames instead of spaces. Your filter pattern should look like this:
www.henstuff.co.uk|freedapromotions.us2.list-manage.com
  • Click Save to finalise the new filter and block all traffic that isn't using a legitimate hostname.
One final tip: after you've applied the filters described above, it's a good idea to create a new View in Google Analytics (without any filters). This will allow you to compare your filtered, spam-free traffic with Google's raw data and spot any genuine traffic sources you've accidentally blocked.

Need more help managing your Analytics account? Get in touch with Designer Websites now.

Today is Safer Internet Day! This annual event is organised by the UK Safer Internet Centre as a means of promoting online safety for children and young people; the slogan for this year is 'Let's create a better internet together', and we at Designer Websites want to do our bit!

Here, then, are a few simple online security tips that will help your kids (and indeed you yourself) to stay safe and secure while you surf the web:

  • Create a strong, unique password. When helping your children to set up online accounts of any kind, encourage them to think carefully before selecting a password. Avoid obvious sequences like abc123qwerty and 1234567 and popular phrases like batmanfootball or dragon. Oh, and NEVER use your own name as a password!

  • Use different passwords for different accountsOnce you've thought of a good password, it can be tempting to use that same password for every account you set up. This is a big mistake; using the same password for everything means that, if somebody breaks into one account, they can easily gain access to all of the others. Try to think of a different password every time.

  • NEVER share or publish your login details online. You never know who might see them!

  • Parents: research adult content filtersIf you want to make sure that your children don't view any adult content while they use the internet, there are a number of plug-ins that can help you. Adult Blocker is a highly-rated plug-in for Google Chrome, and FoxFilter is the #1 parental control for FireFox. Internet Explorer, meanwhile, has built-in parental controls; just click on the cog in the top-right corner of any IE window, then select Internet Options > Content Family Safety to set parental guidelines for your children's internet use.

  • Parents: use the sites your children useOne last tip for parents (and teachers, too) - get to know the sites your children are using. For example, if they have a Facebook page or a Twitter account, set up a profile of your own and learn how to use it; this will ensure that you understand what your children are doing online, and help you to advise them when it comes to privacy settings.