Quick answer: Referral spam is fake traffic that shows up in Google Analytics as visits from sites such as darodar.com, semalt.com or buttons-for-website.com. Most of it never touches your website at all. It is sent straight to Analytics to get you curious enough to visit the spammer’s site. The most reliable fix is a valid hostname filter, which only keeps hits that genuinely came from your own domain, combined with an exclusion filter for known spam referrers and a clean annotated view for reporting.
If your referral report has suddenly filled with strange domains, you are not alone. Referral spam grew sharply this year and affects sites of every size. Left alone, it inflates your sessions, drags down average time on site, raises bounce rate and makes every report less trustworthy.
The two types of referral spam
Crawler spam
Crawler spam comes from bots that actually visit your website. They load your pages, which fires your Analytics tracking code, and they send a fake referrer so their domain appears in your reports. Semalt is a well known example. Because these bots hit your server, you can also block them at the server level.
Ghost spam
Ghost spam is more common and stranger. The spammer never visits your site. Instead, they send fake hits directly to Google Analytics servers using random tracking IDs. Any property with a matching ID records the “visit”. Because nothing touches your server, blocking at the server level does nothing. Ghost spam often shows a hostname that is not your domain, or shows “(not set)” as the hostname, which is the key to filtering it.
How to spot referral spam
In Google Analytics, go to Acquisition, then All Traffic, then Referrals. Warning signs include:
- Domains you have never heard of, often with words like “buttons”, “share”, “seo” or “traffic”
- Sessions with a bounce rate of 100 percent or 0 percent
- Average session duration of zero seconds
- A sudden spike in referral traffic with no new links or campaigns to explain it
- Odd language settings in the Audience language report, which some spammers use to push messages
Do not visit these domains to investigate. Some exist to spread malware or affiliate cookies.
Before you add filters: protect your data
Filters in Google Analytics permanently change the data in the view where they are applied. They do not work backwards, and filtered data cannot be recovered. So before you change anything:
- Keep a raw view. Leave one view with no filters at all, as a backup.
- Create a test view. Add new filters there first and check the results for a few days.
- Create a master view. Once the filters are proven, apply them to the view you use for reporting.
Fix 1: The valid hostname filter
This is the most effective defence against ghost spam, because ghost hits rarely carry your real hostname.
- Find every hostname that legitimately sends data to your property. Go to Audience, then Technology, then Network, and set the primary dimension to Hostname. Look back over a year of data.
- Note your real hostnames: your domain, any subdomains, and services that legitimately use your tracking code, such as a payment provider or translation service.
- Build a regular expression that matches them, for example matching yourdomain.com and any approved services.
- In Admin, go to the view’s Filters and create a custom Include filter on the Hostname field with that expression.
- Verify in your test view before copying it to your master view.
If you add a new subdomain or service later, remember to update the filter, or you will lose that data.
Fix 2: Exclude known crawler spam
The hostname filter does not stop crawler spam, because those bots visit your actual site. For these, create custom Exclude filters on the Campaign Source field with a regular expression listing the spam domains you see, such as darodar, semalt, buttons-for-website and their variations.
Filter fields have a character limit, so you may need several filters as the list grows. Review your referral report monthly and add new offenders.
Fix 3: Turn on bot filtering
In your view settings, tick “Exclude all hits from known bots and spiders”. This uses a list maintained by the industry to remove many known bots. It will not stop most referral spam on its own, but it costs nothing and helps.
Fix 4: Block crawler spam at the server
For bots that actually reach your site, you can block them before they load anything. On Apache servers, rules in the .htaccess file can deny requests with known spam referrers. Plugins for WordPress can do the same. This also saves a little server load. It does nothing for ghost spam, so it is a supplement to the Analytics filters, not a replacement.
Fix 5: Use segments to clean past data
Filters only work from the moment you add them. For historical reports, create an advanced segment that includes only valid hostnames and excludes known spam sources. Apply the segment when you look at older data. It does not change the stored data, so it is safe to experiment with.
What not to do
- Do not use the referral exclusion list for spam. It removes the referral label but still counts the session, usually as direct traffic, which hides the problem instead of fixing it.
- Do not visit the spam sites. That is exactly what the spammers want.
- Do not filter your only view. Always keep a raw backup.
Keeping reports trustworthy
Once filters are in place:
- Add an annotation in Analytics on the date you applied them, so future comparisons make sense
- Check the referral and hostname reports each month
- Tell anyone who reports on the site that numbers from before and after the change are not directly comparable
A quick monthly spam check
Spammers change domains often, so a short routine keeps your data clean:
- Open the referral report for the last 30 days and sort by sessions
- Look for unfamiliar domains with zero second sessions or a bounce rate of exactly 100 percent
- Check the hostname report in your raw view for new hostnames that are not yours
- Add any new spam domains to your exclusion filter in the test view first
- Copy the updated filter to your master view once you have confirmed it behaves
This takes a few minutes and stops slow drift in your numbers. It also means that when someone in the business asks why traffic changed, you can answer with confidence.
FAQ
Does referral spam hurt my SEO?
No. Ghost spam never touches your site, and crawler spam does not affect how search engines see you. The damage is to your data and decisions.
Why is Google not stopping it?
Google has said it is working on the problem. Until a full fix arrives, filters are the most dependable protection.
Will a new tracking ID stop ghost spam?
Only briefly. Spammers cycle through IDs, so a new property usually starts receiving spam again before long.
Get reports you can trust
Clean data is the foundation of every good marketing decision. We set up and audit analytics so you know exactly what is working. Learn more about how we help you know what’s working.
