Why is this even an issue
There are a few reasons;
1) The extra hits skew your analytic results. For a big player this will hardly move anything a 10th of a percentage point. However, if you are a smaller local business who is getting 1000 hits a month and potentially 800 or more are coming from spammers this can be a major issue. Here is example where naive or scammer SEO merchants can take advantage.
Customers site is spam free. SEO company is hired to increase traffic. SEO scum registers site with spammers. Site traffic instantly jumps. Owners is confused because sales have not increased. SEO scum says ‘…this is a long term thing, just keep paying your bill a few more months or years…results will come…’.
Two things tend to happen here. Owners business improves through there own efforts alone and SEO scum takes credit and continues to charge. Owner eventually feels the pain of not getting any real increased profit and stops the service confused. SEO scum blames owner for not converting traffic.
2) Site website hosting resources are getting burned up by spammers.
Again for a big site not really a big deal, in the greater scheme of things. However I have seen smaller sites (some large) getting spammed so bad that it is a virtually a DDOS attack and is crashing their server and/or using so many resources that they have to upgrade their server acount 5-10x times over. Straight up bots cost you the owner money and can negatively affect the way your website runs.
3) This traffic can be scanning and crawling your site for dodgy reasons.
A few things can be going on here:
How to check for bad spammer activity on your website
To check is fairly simple, just pull up your Google Analytics and look in Acquisition Overview then ‘referral’ go through the domains and look them up in google, whois and see what they are and what they are doing.
Some are obvious and if you see things like;
You can pretty much guarantee these are spammers. Check them if you are in doubt. 9/10 they will be for spammy services or affiliate referrals.
This can sometimes be a painful wake up call for website owners. So if you are a developer or SEO specialist be diplomatic. No one wants to find out that they really have near zero traffic and that they may have burned 100s or 1000s of dollars on bad SEO tactics.
How to remove spammers from your website
There are a couple methods:
1) CDN services such as Cloudflare or MaxCDN can GEO block and block domains. They can also challenge any suspect activity, by getting the visitor to complete a human or bot test.
2) You can block access via country through your server firewall. Generally spammers are using IP addresses in Eastern European countries, Russia, Iran etc. You can find a lot coming via USA IPs as well. Therefore if you are not getting business from the USA don’t be affraid to block it too.
3) Block IP ranges.
IP addresses are in limited supply this does make it possible to block IP ranges of spammers and it can be very effective as they tend to just come from the same IPs but change their domains. If you block the IPs it won’t matter what domain they use, they will be blocked at the firewall.
4) My prefered first port of call is .htaccess file.
Here is a little sample of what I add by default.
# Block Spam refers
RewriteEngine on
RewriteCond %{HTTPREFERER} ^http://.*ilovevitaly.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.ilovevitaly..ru/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.ilovevitaly.org/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*ilovevitaly.info/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.iloveitaly.ru/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.econom.co/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*savetubevideo.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.kambasoft.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.buttons-for-website.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*semalt.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.darodar.com/ [NC]
RewriteCond %{HTTP_REFERER} ^http://.guardlink.org/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*event-tracking.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.freefree-social-buttons.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.100dollars-seo.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*responsivetest.net/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.Get-Free-Traffic-Now.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.au.urlm.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.*forum.topic54649747.daridar.com/ [NC,OR]
RewriteCond %{HTTPREFERER} ^http://.k8safesearch.com/ [NC,OR]
RewriteRule ^(.)$ – [F,L]
You can add this to the end of your .htaccess file, long as your on apache, and it should remove the issue. WordPress users tread carefully! Always make a backup or files before you mess with them.
Note: If you are getting smashed by a fake Googlebot attack CDN GEO block is a must. If it is really bad you’ll need to add a googlebot block to your robots.txt file temporarily as well, but this is all stuff for another blog.
