Referrer spam: what it is and how to stop it

The scam, explained

The audience for referrer spam is not your readers. It is you, the person who reviews the traffic report. The spammer fabricates visits whose referrer is a domain they want visited, you see an unfamiliar site apparently sending you traffic, curiosity does the rest, and the destination is an affiliate funnel, a casino, or worse. The one reliable rule: never open the domains.

Two kinds of spam hit

• Real requests: a bot actually loads your pages and carries the fake referrer with it.
• Ghost hits: nothing touches your site at all. The spammer fires fabricated events straight at an analytics endpoint with guessed or harvested site IDs.

Ghost hits only work against endpoints that accept events from anywhere. Our ingestion rejects any event whose origin does not match the registered domain of the site, which closes that path entirely. What remains is bot delivered spam, and that is caught the same way other bots are.

How they are kept out of your numbers

A referrer spam blocklist ships alongside the bot signature list and updates on the same weekly cadence, because spammers rotate domains faster than any hand maintained filter can follow. A visit carrying a known spam referrer is classified as a bot with that as the stored reason.

What not to do

• Do not open the domains. That click is the conversion the spammer wanted.
• Do not paste them into an ad network blacklist. They were never a source you paid for, and blacklist slots belong to sources that cost money.
• Do not hand maintain a referrer filter and consider the job done. The domains rotate weekly, which is exactly why the blocklist updates on that cadence.