Successful digital marketing relies on two key principles: sending quality traffic to your website, and converting website visitors into customers. But as increasing amounts of bot traffic infiltrate the internet, it’s getting harder for marketers and advertisers to guarantee quality site visitors with the potential to convert.

Traffic bots already outnumber human internet users. And according to Imperva’s Bad Bot Report 2023, the human online traffic share dropped by 5.1% from 2021 to 2022:

The increasing number of sophisticated traffic bots that can successfully simulate human behaviour is a cause for concern. Bad traffic bots generate spam leads, drain your ad budget, and damage your PPC advertising performance. But there are ways to block traffic bots from your site, ensuring accurate data and genuine leads.

Here, you’ll learn everything you need to know about traffic bots: what they are, why you need to distinguish between good and bad bots, and how to stop traffic bots disrupting your digital marketing strategy.

“Invalid traffic includes any clicks or impressions that may artificially inflate an advertiser’s costs or a publisher’s earnings. Invalid traffic covers intentionally fraudulent traffic as well as accidental clicks.”

Abraham Moreno-Riano

Job title, DeVry University

What are traffic bots?

Traffic bots are automated programs created to perform specific online functions. Bots can be helpful (e.g. SEO crawler bots that help your pages rank in search results) or harmful (e.g. bots that click your ads with zero chance of conversion). Either way, traffic bots can inflate site visitor numbers, skew your metrics, and waste your ad spend.

Traffic bots are a type of invalid traffic (IVT). Here’s how Google defines invalid activity:

“Invalid traffic includes any clicks or impressions that may artificially inflate an advertiser’s costs or a publisher’s earnings. Invalid traffic covers intentionally fraudulent traffic as well as accidental clicks.”

All bot traffic is invalid, but not all invalid traffic comes from bots. Invalid traffic includes accidental clicks from real human users as well as bot traffic. In this article, we’ll focus exclusively on non-human IVT and how it impacts marketers.

“Good” traffic bots

Some bots are essential. They help your site (and the rest of the internet) run smoothly. SEO crawler bots, for example, scan billions of web pages so search engines like Google can index and rank them in their search engine results pages (SERPs).

Other types of good traffic bots include:

• Analytics bots — Bots that monitor website metrics like site visitor volume, page load speeds, and unique page visits. These give you useful insights into your digital marketing performance.
• Aggregation bots — A type of authorised scraper bot, aggregation bots collect information from your website and display it elsewhere. These are widely used in the travel industry to collate information about flight and hotel availability.
• Copyright bots — Bots that identify copyright infringement and content theft from your website or other online assets.

Good bot traffic is usually classed as general invalid traffic (GIVT). GIVT is relatively easy for ad platforms to detect and block, so they’re less likely to damage your marketing efforts than bad bots.

“Bad” traffic bots

Bad traffic bots are a much bigger problem for marketers. Left unchecked, bad bot traffic can disrupt sales, waste your ad spend, steal and sell your content or data, and erode customer trust in your brand.

Types of bad traffic bots include:

• Ad fraud bots — These bots click paid ads to intentionally drain your ad budget. In 2022, this cost businesses $12.35 billion on Google alone. According to our Wasted Ad Spend Report 2024, this is estimated to rise to $16.59 billion in 2024.
• DDoS bots — Bots that attack your website and overload your server so your site is unavailable for genuine users. Around half of DDoS attacks lead to noticeable service disruption, with 24% causing complete denial of service.
• Scraper bots — Bots that steal information from your website without authorisation. This may include contact details, content, or other valuable data.
• Lead gen/spam bots — Bots that complete forms on your website, leading to an increase in fake leads and lead gen fraud. Almost 70% of businesses have experienced spam leads, draining their sales resources.

Bad bots are classed as sophisticated invalid traffic (SIVT). They closely mimic human behaviour, conducting low-and-slow attacks that are much harder to detect than good bot activity. Sophisticated invalid traffic uses methods that emulate human behaviour. It uses things such as legitimate IP addresses, and rotates these IP addresses to bypass static methods of blocking bots. It can store cookies, emulate click patterns, and blend in with website traffic. It’s very hard to detect.

The business cost of traffic bots

Traffic bots cost businesses billions in wasted ad spend, lost time, and missed revenue opportunities every year.

Our Wasted Ad Spend Report 2024 predicts advertisers will lose around $16.59 billion to IVT on Google ad channels in 2024, which is substantially less than the forecasted wasted ad spend across social media. It’s estimated that advertisers will lose around $54.78 billion on non-Google advertising channels like Facebook, TikTok, and LinkedIn in 2024.

In total, this represents a 33.1% increase in wasted ad spend between 2022 and 2024:

As well as the immediate costs of wasted ad budget, traffic bots drain your sales team’s resources. They’ll lose time and money checking data and chasing fake leads rather than nurturing real prospects, which also means you’re missing out on valuable revenue opportunities. Businesses stand to lose out on $204.83 billion in lost revenue opportunities in 2024.

You may also be using inaccurate data to inform spending and budgeting decisions, leading to even more wastage. Even good bots can skew your analytics, leading to unreliable data and dubious decisions.

Marketing budgets are being squeezed more than ever. Our Wasted Ad Spend report shows that 40% of marketing teams are being hit with reduced budgets — so eliminating bot traffic from your site is essential to maximising your revenue. Neil Andrew, Lunio’s founder and CEO, explains more:

"We know that brands and agencies have a pressure to do more with tighter resources, and Lunio is here to help. By eliminating wasted ad spend, our solution streamlines the entire process, from media planning and buying to ad tracking and ROAS measurement, driving increased efficiency at a time when every penny counts."
‍
Neil Andrew
Founder & CEO, Lunio

Traffic bots for hire

Hiring traffic bots is a malicious practice that creates the illusion of a high-traffic website. This site is one of the top-ranking pages when you search for “traffic bots” in Google:

But the claims made by this site (and other similar traffic generator sites) are spurious at best. For example:

It’s well-established that buying site traffic and clicks is a black hat SEO practice that will ultimately damage your SEO efforts. It can even get you banned from Google AdSense:

“Clicks on Google ads must result from genuine user interest. Any method that artificially generates clicks or impressions on your Google ads is strictly prohibited. These prohibited methods include, but are not limited to, repeated manual clicks or impressions, automated click and impression-generating tools and the use of robots or deceptive software.”

Additionally, the site claims that their traffic “looks like real human traffic.” However, unlike humans, bots aren’t going to make purchases. So you’ll probably see a downturn in conversions, ultimately making your advertising KPIs look worse.

Google claims to be clamping down on this activity. But both sponsored and organic links to this site are prominently displayed on the first SERP page. In addition, lots of other sites promise the same thing, and don’t seem to be penalised for flouting Google’s terms of service.

There’s clearly a high demand for traffic generation. People are increasingly turning to them to boost their ad revenue, search rankings, and social media engagement. So advertisers can expect the number of traffic bots to rise in the near future.

The increasing prevalence of traffic bots

According to Imperva’s Bad Bot Report 2023, 47.4% of all internet traffic came from bots in 2022 — a 5.1% increase on the previous year. Given that computing power is growing more quickly than the population, it’s likely that the increasing traffic bot trend will continue:

Imperva’s deep-dive into bot types reveals a more worrying pattern. While simple bad bots remain at similar levels to previous years (accounting for around a third of bad bot traffic), advanced sophisticated bots are becoming more prevalent at the expense of moderately sophisticated bots. Advanced bots are more likely to evade traditional bot blocking methods.

Ad platforms are already struggling to cope with traffic bots. And the advent of tools like ChatGPT have also made it easier for individual bad actors to create bots with very limited coding knowledge. So in future it’s going to get even harder for marketers to dodge bad bots.

How do Ad platforms deal with bot traffic? 

The growing threat of bad traffic bots is worrying for advertisers. So you might expect ad platforms to clamp down on this activity. But unfortunately this doesn’t seem to be the case.

While most ad platforms seem able to cope with GIVT, they’re much less reliable when it comes to detecting and filtering out sophisticated bots. We found substantial rates of invalid traffic across all ad platforms, with LinkedIn, X, and Meta among the worst affected:

Google is leading the way when it comes to dealing with bot traffic. As well as having some of the lowest rates of IVT, they also have a refund system where advertisers can request their money back if they notice invalid activity. This system isn’t the most user-friendly, but it’s more than any other platform currently offers.

Google is processing a lot more data than most other networks. To add to that, Google has an entire knowledge base on invalid traffic, showing advertisers how to prevent it and educating them on the problem. But keep in mind that most of this is dealing with GIVT. It’s SIVT that’s becoming the problem nowadays. Most social platforms like Meta and LinkedIn are not equipped to deal with sophisticated invalid traffic, whereas Google might be in a slightly better position.

How to identify bot traffic 

Google Analytics is a key tool to help you identify bot traffic. Look out for these four key signs of bot traffic:

• High bounce rate — The average bounce rate is 50-70%, so a 70%+ bounce rate may indicate bot activity. That’s because bots don’t tend to stick around to browse your website after their first page visit.
• Low session duration — Bots won’t spend a lot of time on your site. Check how long users spend on your landing page before they return to the SERP. Low session duration (less than 30 seconds) may indicate traffic bots.
• Traffic peaks with low conversions — If your site traffic suddenly spikes (without a similar spike in conversions) this can suggest a high volume of bot traffic on your site. Custom alerts can help you spot these suspicious peaks.
• Repeated suspicious traffic patterns — Bots often run on a schedule, so seeing the same peaks and troughs over and over again may indicate bots. 

Ways to block traffic bots

So how can you deal with a traffic bot problem? Manual monitoring isn’t the most efficient method, but it can help you reduce the impact of bot traffic. Here are four ways to block traffic bots.

1. Understand your traffic

Familiarise yourself with your normal traffic patterns so you can identify suspicious activity more easily. Look at your analytics data to find out more about your typical audience, including:

• Which referral sites they come from.
• When your site traffic usually peaks.
• Users’ typical session duration.

This data can help you understand how your ads drive traffic to your site. You can then optimise your PPC campaigns to remove traffic generated by irrelevant search terms, and pause or adjust campaigns that are affected by high levels of IVT.

2. Set up IP exclusions

Exclude IP addresses that generate fake traffic within Google Ads. Not displaying ads to specific IP addresses should stop them sending bots to your site. However, bear in mind that sophisticated bots easily switch between IP addresses, so this isn’t a foolproof bot blocking method.

Here’s how to set up IP exclusions in Google Ads:

1. Log into your account and navigate to the relevant campaign.
2. Click Settings.
3. Scroll down and select Additional Settings.
4. Scroll to IP exclusions and paste the fraudulent IP address into the box. 
5. Click Save.

3. Use reCAPTCHA

Lead forms, contact forms, and other data capture fields on your site should be protected by reCAPTCHA. Some advanced bots can bypass reCAPTCHA forms, but including them will eliminate many simple or moderately complex bots and prevent them from submitting spam leads on your site.

Find out how to install reCAPTCHA on your site.

4. Exclude specific countries/regions

If you’re being targeted by bots from a specific region or country, you can block bot traffic coming from that geographical area. This is a quicker way to tackle bots than adding individual IP address exclusions every time a new one crops up.

However, it’s easy to block real human users using this method. Be wary of excluding regions you might want to expand into, or where you already have customers.

How Lunio detects bot traffic ad platforms don’t catch

Lunio analyses every click on your paid ads in real-time to determine if they’re a real user. If Lunio detects a user that meets any of the following criteria, they’ll be blocked from accessing your ads:

• Comes from a known blacklisted IP address.
• Shows obvious signs of automated behaviour.
• Fills out a form more quickly than a human could.
• Bounces from the page in less than one second.

But not all bots display such obvious signs of non-human activity, especially in a single interaction. That’s where Lunio categorises traffic as “suspicious.” Instead of immediately blocking the user, Lunio automatically checks hundreds of other data points to assess the user’s validity. It can then accurately categorise the click as legitimate or invalid.

This approach weeds out bots from real users, ensuring genuine users are never blocked by our software. There’s no need for any manual monitoring (although you’ll be able to see all your data in our dashboards on-demand) and invalid visits are stopped at the source. This blocks bot traffic from your site, so you can improve your ad spend efficiency and overall profitability.

See how much of your paid traffic is invalid

Lunio’s 14-day free trial includes a full traffic audit, which shows you exactly how much invalid traffic is affecting your PPC success (and how much you could save by eliminating it).

There’s no obligation to buy when the trial period ends; getting a clear picture of your traffic health can help you decide on the best way to fix invalid traffic on your site. Book a demo to get started with Lunio today.