How to block fake website traffic in Google Analytics using Cloudflare – Traffic spam from Czechia and Seychelles

Not my usual consumer-tech content, but I thought it was worth writing about nonetheless. I will use anything as an excuse to write some content.

I make a living from my website (just about), and just like most people in my position, I have a daily ritual of checking all the various analytics and advertising services I use.

There is Google Analytics, Webmaster Tools, affiliates such as Amazon and my display advertising network, which is Mediavine, but for many, it is Google Adsense.

Being reliant on advertising and affiliate sales, it is essential for me to identify and react quickly to any trends. If I have a dip in traffic, I need to work out why that happened and how to fix it. With an uptick in traffic, I will look for ways to replicate that success.

My traffic tends to be variable based on tech news but also seasonal trends. The hot weather means I get more traffic to my coverage of air conditioning units. Therefore it is not always possible to notice a trend in traffic quickly.

A large increase in traffic from Czechia (Czech Republic) and Seychelles and a decrease in revenue per thousand (RPM)

At the start of August, my traffic was normal, and things have been quite good the past few months. As the days progressed, traffic picked up, and I was happy. I assumed Google was being nice to me, possibly due to the recent product review update. The weather was also warm with forecasts of heat waves which is also good for me.

Being the start of a new quarter, the amount of money I earn per thousand visits to a page (RPM) naturally declined. However, this continued to decrease while my traffic continued to climb, which led me to look into what was going on.

There were no identifiable problems with my landing pages. This is the main thing I look at to see what posts are performing well, new or old. This new traffic seemed to be spread around on normal pages generating enough traffic per page not to cause suspicion.

On August 4^th, traffic from Czechia jumped to 5.77% and Seychelles 2.46%. It wasn’t enough traffic to register on my radar at the time.

On the 5^th it was 11.74% and 4.25%, but again, the total traffic to the site wasn’t beyond what I might normally get.

By the 6^th and 7^th of August, I became suspicious. My RPM rate had dropped 25%, and I was getting higher than expected traffic, considering it was the weekend.

On the Sunday, Czechia was my second-best acquisition country, overtaking the United States, which is a massive red flag. Looking back to August the 1^st, Czechia is 34^th.

Furthermore, the traffic from Czechia and Seychelles had an incredibly high bounce rate (99%), low pages per session (1.02) and almost no average session duration (1 or 2 seconds).

Therefore I wasn’t getting paid for that traffic. Mediavine shows just $4.84 for Czechia and nothing for Seychelles.

Blocking traffic from Czechia and Seychelles using Cloudflare

I, therefore, wanted to stop the fake traffic. At the very least, it makes it harder to work out what your real traffic is and identify trends within that. I was also a bit paranoid that my advertising network may take a dim view of it, as if I was trying to generate fake income (which obviously wasn’t working).

If you use Cloudflare, then fixing the problem is incredibly easy:

• Log in to Cloudflare and select your domain
• Go to security and select WAF (Web Application Firewall)
• Create firewall rule
• Name the rule to whatever you want (I created two, named Czechia and Seychelles)
• Select:
  • Field = Country
  • Operator = equals
  • Value = the country you want. Cloud Flare use Czech Republic, not Czechia
  • You can optionally use the OR statement if you want both countries under one rule
• Under then Then action, select Managed Challenge
• Finally, press deploy firewall rule

You could use block or one of the alternative challenge options, but the managed option appears to perform well and will allow real users through (rather than the total block option).

In the few hours I ran this, Cloudflare only issued a few hundred challenges, but traffic from these locations dropped off.

My Seychelles rule is reporting that there have been no challenges solved, and Czechia is currently reporting an 11.59% success rate.

The Seychelles rule also appears to show the number of challenges being issued is dropping off. I suspect the bot generating this fake traffic will eventually stop pinging my website.

Looking at the WAF analytics, there doesn’t appear to be any common data that is easily identifiable. There is a mixture of IP addresses, the Czechia rule seems to use mainly IP4 addresses while Seychelles is all IP6, and both user agents and ASNs are a mix with no trends.

Filtering out traffic with Google Analytics

If you don't use Cloudflare or similar services, you can filter out the traffic directly within Google Analytics

I wrote this post which has some screenshots to help you: How to remove fake traffic from Google Analytics

Basically you just:

1. Go to the Admin Settings > View Settings > Filters (the right-hand column)
2. Select “Custom” under the filter type
3. Select “Exclude”
4. Select “Country” under the drop-down menu
5. Enter the countries you want to remove from the analytics
6. If you select, verify it should show you the traffic that was coming from that country and how much will show after the filter (it should be blank)

Block spam traffic with WordPress Plugins such as WordFence

Another alternative option is using a WordPress plugin (assuming you use WordPress).

Wordfence is a popular option that has a Block by Country setting within the firewall options. Unfortunately, this is walled off within the premium features and this costs $99.00 / Year

I am not sure of any free plugins that can achieve this.

Why am I getting traffic from Czechia and Seychelles?

During this period, a competing advertising network was trying to court me to move to them (or should I say spam me with emails?).

They promised a 25% increase in RPM, which seemed coincidental that I also had a 20-25% drop in RPM.

However, this issue with traffic from Czechia and Seychelles seems to be widespread. My advertising network has a Facebook group, and many are reporting the problem. It has also been reported on Reddit and seroundtable.com.

At the moment, there appears to be no exact reason for this. Spammers be spammers, and there is not always a great deal of logic in what they do.

New spam traffic sources?

Sigh… As I wake this morning, traffic to my website is doing well, but once again, not all is as it seems.

Traffic from Russia now represents 3.58% of my traffic, with the landing pages spread about, including some to UK-specific pages such as, why is Sky Intenet slow, why is Virgin slow, and delivery boxes for the UK. Russia normally represents about 0.4% of traffic.

Traffic from Seychelles has increased to 3.58%, too, somehow bypassing the Cloudflare challenges.

[Original Post: 12th August 2022]

[Updated: 26th August 2022] Added information about removing traffic via Google Analytics, WordPress Plugins and potential new traffic spam information.