Your conversion rate suddenly jumps from 2% to 5%. Perfect. Then you notice all the new conversions came from a single IP address in a single session. And each conversion happened one second apart. Suspicious.
Invalid traffic doesn't always announce itself as spam. Sometimes it looks legitimate but follows patterns no human would create. Learning to spot these patterns saves you from building strategy on fake data.
What counts as invalid traffic
Click fraud
Automated clicks on your ads that don't represent real customer intent. Someone runs a bot that clicks your paid search ads, inflating your CPC spend without generating real conversions. You pay more per click for traffic that's not worth anything.
Conversion fraud
Bots submitting forms or completing checkout flows to artificially inflate conversion metrics. They don't actually buy anything. They just trigger conversion events. Your conversion rate looks better than it actually is.
Suspicious traffic patterns
Traffic that looks automated: identical session duration, same exact scrolling pattern, zero variation in behavior. Users from impossible locations (simultaneous sessions from different continents). Traffic that doesn't match normal user behavior for your site.
Impossible user journeys
A user submits a conversion, leaves, comes back, and submits another conversion from a different device two seconds later. Impossible unless it's automation. A user visits 500 pages in 30 seconds. No human could scroll that fast.
Traffic from data centers
Traffic from known data center IP ranges rather than residential or mobile IPs. Data center traffic is often automated. It could be legitimate (your team testing), or it could be malicious (bots, scrapers, click fraud farms).
How to identify invalid traffic
Look for sudden spikes with no cause
Traffic doubles overnight without a campaign launch. Conversions spike but average order value drops to zero. These unexplained changes often indicate invalid traffic.
Analyze traffic patterns for anomalies
Valid traffic has variation. Users spend different amounts of time. They visit different numbers of pages. They bounce at different rates. Invalid traffic is consistent: same duration, same pages, same behavior every time. Look for sessions that are too similar to each other.
Check for single-IP traffic concentration
If 50% of your new conversions came from one IP address, that's suspicious. Real users come from different IPs. A single IP generating many conversions usually means automation.
Use your tool's invalid traffic detection
Google Analytics has automatic invalid traffic filtering. It uses machine learning to detect suspicious traffic patterns. It's not perfect, but it catches obvious cases. Enable it by setting your view's bot filtering setting.
Compare conversion timing patterns
Real conversions spread throughout the day with natural variation. Invalid conversion patterns are regular. Conversions happening at exactly 10-minute intervals. Conversions from the same session happening microseconds apart. These patterns signal automation.
Common invalid traffic sources
Ad networks and click fraud
Ad networks sometimes deliver low-quality traffic that doesn't convert. Competitors or malicious actors might run bots that click your ads to drain your budget. Search ads are particularly vulnerable because you pay per click regardless of quality.
Referral traffic sources
Some referral sources deliberately send low-quality traffic. They get paid by analytics views so they send bots disguised as referrals. Your referral source looks legitimate but traffic doesn't convert.
Affiliate networks
Some affiliates use bot traffic to inflate their commissions. They send automated traffic claiming it came from legitimate sources. The traffic never converts but they claim commission anyway.
Data scraping bots
Bots scraping your content, pricing, or product information. They don't represent real business value. They consume server resources and distort your traffic metrics.
How to filter invalid traffic
Enable automatic invalid traffic filtering
Most analytics tools have built-in detection. Google Analytics automatically marks invalid traffic but doesn't filter it by default. You have to turn on the filtering. Go to your view settings and enable "Exclude all hits from known bots and spiders" and turn on invalid traffic filtering.
Create a segment to isolate invalid traffic
Before filtering it out, measure it. Create a segment that isolates what looks like invalid traffic. How much of your traffic is invalid? What's your real conversion rate without it? Understanding the scope helps you decide whether to filter.
Create custom filters for invalid patterns
If automatic filtering misses patterns, create custom filters. Filter out traffic from data center IP ranges. Filter out sessions with zero bounce time and impossible page counts. Filter out conversions from single IPs that convert too many times.
Work with your ad network
If invalid traffic is coming from ads you're paying for, report it to your ad network. They have tools to identify click fraud and will often refund invalid traffic. Google Ads and most DSPs have fraud detection built in.
The challenge: false positives
Legitimate traffic that looks suspicious
Power users on your site might visit 500 pages in an hour. API clients pulling data might show as single-IP, high-volume traffic. A team testing your site from a data center might look like invalid traffic. Too strict filtering excludes real users.
Balancing sensitivity and specificity
Aggressive filtering catches more fraud but risks false positives. Conservative filtering might miss real fraud. Find a balance by monitoring both the filtered and unfiltered views. Compare them regularly to catch over-filtering.
Document your filtering rules
Keep records of why each filter exists and what it's designed to catch. This prevents someone from removing a filter thinking it's outdated when it's actually important.
Frequently asked questions
How much traffic is typically invalid?
It varies widely. Content sites might see 5-10% invalid traffic. Sites running ads or relying heavily on affiliate traffic might see 20-30%. E-commerce sites are typically lower unless they're targets of click fraud. With WEMASY's website builder, you can set this up directly on your website.
Can I recover revenue lost to click fraud?
If the traffic came from ads you paid for, yes. Most ad networks refund clearly fraudulent clicks. Report invalid traffic to your ad network and they'll investigate and issue credits. For organic traffic, you can't recover lost conversions.
Does Google Analytics automatically detect all invalid traffic?
No. Google's automated detection catches obvious patterns, but sophisticated fraudsters can evade it. It's a good first line of defense, but you should still monitor manually.
Is all data center traffic invalid?
No. Your team testing from your office (which might be a data center IP range) is legitimate. Cloud-based users are legitimate. Some data center traffic is real. But data centers do have higher concentrations of automated traffic, so monitor carefully.
Should I filter invalid traffic retroactively?
Create a new view with filtering applied. Don't change historical data in your existing view. This way you can compare before and after to understand the impact.
How do I know if I'm being targeted by click fraud?
Look for high click volume but low conversions. Low conversion rate but high cost per conversion. Unusual traffic from countries or devices you don't target. Contact your ad network and ask for a click quality report.