Is Your Website Traffic Fake? 12 Signs of Bots and Junk Clicks (2026)

Not every visit in your analytics is a person who might become a customer. Some are automated bots. Some are people paid or incentivised to click. Some are real people who were never interested, such as visitors from pop-up windows or traffic exchanges. All of them inflate your numbers and hide what your real audience is doing.

This guide shows how to recognise fake and low-quality traffic, why it happens and what to do about it, whether it arrives on its own or through traffic you paid for.

Types of Fake and Low-Quality Traffic

Not all of these are "fake" in the sense of being non-human. Traffic exchange visitors are real people. But for most goals, visitors with no interest in your page behave much like bots: they arrive, they leave and they never convert.

12 Signs Your Traffic Is Fake or Low Quality

Engagement Signs

1. Spikes with no engagement. A sudden jump in sessions where engagement rate falls and average engagement time is close to zero.
2. Single-page visits at scale. Thousands of sessions that view one page and leave, especially from one source.
3. Identical session lengths. Many visits lasting almost exactly the same number of seconds, which often matches an exchange timer or a bot script.
4. No scrolling or clicks. If you track scroll depth or clicks, junk traffic shows almost none.

Source Signs

5. Unexpected locations. Spikes from a city or country you do not target and have never seen before.
6. Suspicious referrers. Unknown sites, odd domain names or referrers promoting their own services.
7. Unexplained direct traffic. Large jumps in "direct" visits with no campaign, mention or reason behind them.
8. Data-center networks. Visits from hosting providers and server networks rather than home or mobile connections.

Technical Signs

9. Unusual devices. Odd screen resolutions, outdated browsers or a single device type dominating a source.
10. Visits at strange hours. Steady traffic at a constant rate around the clock from a source that should follow normal daily patterns.
11. Repeated clicks from the same IP. Many clicks on one link from one address in a short time.
12. Clicks without conversions. Paid clicks grow while opt-ins, sales or form fills stay flat.

How to Check in Google Analytics 4

Google Analytics 4 automatically excludes traffic from known bots and spiders, but plenty of junk still gets through. These checks help:

1. Compare sessions with engaged sessions. GA4 counts a session as engaged if it lasts longer than 10 seconds, has a key event or includes two or more page views. A source with many sessions and few engaged sessions deserves a closer look.
2. Break down by source and medium. Find which source is responsible for a spike before drawing conclusions about your whole site.
3. Add country and city. Look for locations that do not match your audience or your ad targeting.
4. Check device and browser. A source dominated by one unusual device or browser version is suspicious.
5. Look at landing pages. Junk traffic often hits one page, or pages that do not exist.
6. Build a comparison segment. Save an exploration that excludes the suspicious source so you can see your real visitors' behaviour.

Reading a Traffic Spike: A Worked Example

Here is how to work through a sudden jump in visits, step by step. The situation is illustrative, but the process works for any spike.

Say your daily sessions suddenly double overnight, with no new campaign or mention to explain it.

1. Find the source. Break sessions down by source and medium. If the extra visits all come from "direct" or a single unfamiliar referrer, that is your lead.
2. Check engagement for that source. If engaged sessions barely moved while total sessions doubled, the new visits are not interacting with your site.
3. Check location and device. A cluster from one city or one device type you rarely see points to automation.
4. Check outcomes. If sign-ups and sales stayed flat, the spike has no business value.
5. Decide. Exclude the source from reports, block it if your hosting or tracker allows, and keep watching. If it came from traffic you paid for, raise it with the seller.

How Fake Traffic Affects Different Sites

Why Paid Traffic Is Often the Problem

Most people notice fake traffic after buying it. Bulk visitor packages, cheap pop and push traffic, and dishonest solo ad sellers are the usual culprits. Common patterns:

• "Guaranteed visitors" packages that deliver large numbers of short, unengaged sessions.
• Padded orders where a seller mixes bot or exchange visits into otherwise real clicks.
• Ad fraud on networks where some publishers generate fake clicks to earn more.

The fix is to buy from sources that filter clicks and show where they came from, and to verify everything with your own tracking. Our guide to buying website traffic lists the red flags to watch for before you pay.

How to Filter and Prevent Fake Traffic

1. Use tracking links with bot filtering. A click tracker can flag or block bots, repeat clicks and suspicious networks before they count.
2. Buy from platforms that filter. Ad platforms and marketplaces with click filtering reduce what you pay for. Udimi, for example, filters bots, proxies, duplicate clicks and traffic exchange visits from solo ad orders.
3. Exclude bad placements. On native, push and display networks, block the sites and sources that send junk.
4. Keep test traffic separate. Send traffic exchange and other low-intent visits to separate pages, never to pages with Google ads.
5. Protect forms. Use spam protection on sign-up and contact forms so bots do not pollute your list.
6. Measure outcomes. Judge every source by leads and sales, not clicks or sessions.

Fake Traffic and Display Ads

If your site shows display ads, fake traffic is more than an annoyance. Google's AdSense policies say clicks on ads must come from genuine user interest and prohibit any method that artificially generates clicks or impressions. They also prohibit ads on pages receiving traffic from paid-to-click, paid-to-surf, autosurf and click-exchange programs. Publishers are responsible for their traffic, even when a third party sends it.

In practice, that means never buying cheap traffic for pages with ads, never sending exchange traffic to them and keeping an eye on sudden spikes you did not cause.

What to Do If You Bought Fake Traffic

• Collect the evidence: tracker reports, analytics screenshots and order details.
• Contact the seller or platform and ask for replacement traffic or a refund.
• Use the platform's dispute process if you bought through a marketplace or ad network.
• Clean up your data by excluding the source in your analytics reports.
• Change your process: smaller tests, filtered sources and independent tracking.

Frequently Asked Questions