Stopping bot traffic is like a game of whack-a-mole: just when you think you’ve knocked it out, it pops up again.
Not all bots are bad; good bots do things like index websites for search engines and monitor site performance. But bad bots automate malicious behavior, like scraping your content without permission.
And while some bad traffic is to be expected, an influx of it can start to create problems for your website. A 2025 report from cybersecurity firm Imperva found that automated traffic now makes up 51% of all web traffic, and of that, 37% are considered ‘bad bots.’
So what can you do to stop bad bots from attacking your website?
What is bad traffic?
First, let’s define what we mean when we say ‘bad traffic.’ There are two types of bad traffic that we see most often: bot traffic and invalid traffic, or IVT.
- Bot traffic is non-human traffic that visits your site, prompting your ads to load. This can affect CPMs, because advertisers don’t want to pay for impressions that they don’t think will convert.
- Invalid traffic is any non-human or non-intentional human behavior. It can include bot traffic but also extends to bots or humans clicking excessively on ads. If high amounts of IVT are detected, it can get your domain flagged and greatly reduce advertiser spend.
And to further complicate things, you may also be up against analytics spam. This “traffic” doesn’t actually load your site or ads, it just pings your Google Analytics account and makes it look like there were visits that never happened. While it artificially inflates pageviews and skews RPM metrics, analytics spam doesn’t affect advertiser spending or overall ad earnings.
What are the consequences of bad traffic?
Bad traffic can have a number of negative impacts, such as:
- Domain blacklisting
- Reduced advertiser spend
- Artificially inflated pageviews
- Incorrect RPM metrics
- Content theft from bot scanners
Where does this bad traffic come from?
The exact cause of invalid and bot traffic varies:
- Some of it targets wikis and forums, where it’s easy to harvest data, suggesting it’s content scraping by AI platforms.
- Some bot traffic comes from platforms that promise to drive traffic to a site to inflate ad earnings.
- Some of it is email security systems for .edu and .gov addresses, which click every link in an email to ensure it doesn’t contain viruses.
How can I tell if I’m being impacted by bad traffic?
There are some signs that you might be experiencing bad traffic, such as:
- Extremely low RPM or impressions on pages where ads are running normally
- Traffic spikes from countries you don’t normally have traffic from, in particular China, Singapore, and Brazil
- Substantial traffic to every link in your emails, including footer links that very few humans would click on
What can I do to stop it?
We’re helping organizations like Cloudflare, NerdPress, and BigScoots establish a reliable way to distinguish bot traffic from legitimate traffic and block it from your site, but bad traffic can be evasive.
Right now, we recommend two courses of action:
- Reach out to your host about blocking any bot traffic. Depending on your traffic patterns, they may also suggest blocking some country-specific traffic if there’s a high likelihood that it’s bots, not humans.
- Add the paid version of Cloudflare with a partner like BigScoots, Nerdpress, or Rocket.net to your tech stack if you haven’t already. It has more robust features to combat invalid traffic and protect your site, and these partners are experts in blocking bot traffic. Other hosts may also be able to help here, but we see the most success with these three.
I’m still seeing bad traffic! Is there anything else I can do?
At this stage, there isn’t a reliable solution we can recommend beyond the steps above. Bot traffic is an ecosystem-wide issue that no single publisher, platform, or partner can fully eliminate on their own.
We actively monitor bot and invalid traffic across our network, identify emerging patterns, and proactively reach out to sites that may be impacted to help mitigate risk as early as possible. We'll continue to work with industry partners to explore and test additional solutions, though it’s too early to say which approaches will prove effective at scale.
While some level of bad traffic is an unfortunate reality of the modern internet, our focus is on minimizing its impact, protecting advertiser trust, and supporting you with clear guidance and real-time intervention wherever we can.