OwnlyticsBot and referrer spam: how to filter your analytics
Bot and referrer spam are visits that no buyer made: scripts that load your pages, or fake referrer entries that exist only to get you to click. You cannot block all of them, but you can spot most with five checks and stop letting them steer your decisions.
Fig.Spam referrers: plenty of visitors, no sales. Sample data, not a real site.
What counts as bot traffic and what counts as referrer spam?
They are two different problems, and the fix differs.
Bot traffic is real HTTP requests from software. Some bots are useful (search crawlers, link preview fetchers). Others scrape, probe for login pages, or run uptime checks. Most simple bots do not run JavaScript, so a JavaScript tracking script never sees them. The ones that do run it, such as headless browsers, are the ones that can still show up in your charts.
Referrer spam is a fake or misleading source. Someone sends a request that claims to come from a page of theirs, hoping you see the domain in your sources list and visit it. It can also be a legitimate-looking link that sends a burst of low-quality visits.
Neither is a reason to distrust analytics entirely. They are a reason to look at traffic quality, not just traffic volume.
How can you tell a visit is probably fake?
Real people are messy. Bots are uniform. Look for these five patterns in your own data.
- A spike with no cause. A tenfold jump in a single day, with no post, launch or email behind it, is rarely a surprise fan base.
- Zero depth. Every visit lands on one page, stays for 0 seconds, never scrolls. Real visitors vary. If scroll and reading time (see engagement) are flat across the spike, be suspicious.
- One odd source or country carrying the surge. Check whether the extra visitors share a referrer, a device type or a location that has never mattered before.
- Round-the-clock regularity. Humans have waking hours. A steady flow at 3 a.m. in your main market is a flag. The peak hours view makes this pattern easy to see.
- Traffic without revenue, forever. Any source that sends many visits and never a sale is not proof of a bot, but it is proof that the visits do not matter for decisions.
The most reliable bot test for a seller is a payment test. If a source sends thousands of visits and zero customers over weeks, treat its visits as noise whether or not they are technically bots.
Example (made-up numbers for illustration)
Your site normally gets about 400 visits a day. One Tuesday it gets 3,400.
| Source | Visits | Avg. reading time | Sales |
|---|---|---|---|
| Normal sources combined | 410 | 1m 40s | 3 |
| One unknown referrer | 2,990 | 0s | 0 |
The unknown referrer accounts for 88% of the spike, every visit read for no time at all, and nothing sold. You would exclude that referrer when judging the day, and you would not conclude that your pricing page suddenly became popular.
What should you do about it?
Work from the cheapest fix to the most involved.
- Do not click the spam link. Visiting the domain rewards the sender and may expose you to malware.
- Compare periods, then read the breakdown. A change in total visits means little until you see which source moved. The dashboard shows each period against the previous one, and an AI agent connected through MCP can list the biggest gainers and losers.
- Judge sources by revenue, not visits. The revenue attribution view shows which sources produced paying customers. A source with traffic and no sales is simply a source that does not matter.
- Exclude your own visits. Your own browser and office address create clutter that looks like bot patterns. The tracking script docs explain how to stop counting a browser or a list of IP addresses.
- Block at the edge if the pattern is stable. If you run on Cloudflare, firewall rules and bot controls in your Cloudflare account are the right layer to stop repeat offenders before they reach your site. Which controls your plan includes is a question for Cloudflare's current documentation. This is a Cloudflare setting, not an analytics one.
- Set a retention window. Raw traffic that is clearly junk does not need to live forever. Ownlytics lets you choose how long events, sessions and bot traffic counts are kept, and never deletes payments. See data retention.
Fig.The dashboard after filtering them. Sample data, not a real site.
What about the visits you cannot filter?
Some of it will stay. Headless browsers that look like real devices are hard to separate from real visitors, and any tool that promises perfect filtering is overselling. The practical goal is not zero bots. It is that bots stop distorting your choices.
That is why we suggest tying decisions to outcomes. Conversion rate and revenue per visitor stay meaningful even when raw visits are inflated, because a bot adds to the denominator but never to the revenue. If revenue per visitor falls sharply on a day with a spike, that tells you the spike was probably not customers.
When this doesn't apply
If your site has little traffic, a handful of bot visits can change the percentages, but not the story. Do not spend an afternoon scrubbing 20 visits. Likewise, if you only care about payments and use a revenue-first view, you can let the traffic charts be approximate and trust the sales list instead.
Also note that AI crawlers and AI assistants are not spam. Some visits that look automated are users clicking citations from assistants. We cover that separately in how to track ChatGPT referrals.
At a glance
| Symptom | Likely cause | First move |
|---|---|---|
| Sudden unexplained spike | Scripted traffic or a bad referrer | Check the breakdown by source and country |
| Zero reading time, zero scroll | Headless bot | Judge the day by sales, not visits |
| Strange domain in referrers | Referrer spam | Do not click it; ignore it in reports |
| Traffic at odd hours only | Automated checks | Review peak hours; block at the edge if steady |
| Visits that never buy | Low-quality source | Rank sources by revenue |
| Your own visits inflating numbers | No self-exclusion | Exclude your browser and IP |
Keep the signal clean
If you want to see sources ranked by revenue next to visits, the live demo shows how that comparison looks on a sample site.
FAQ
Do bots affect my conversion rate?
Yes. Bots add visits but not purchases, so they lower your conversion rate and revenue per visitor. This is another reason to read those numbers alongside the source breakdown and to look at a period without a spike.
Is referrer spam dangerous?
The spam entry itself is just a line in a report. The risk is visiting the domain behind it, which may be a scam or carry malware. Ignore it and rely on revenue-ranked sources.
Can I stop all bot traffic?
No. You can block known bad actors at your edge and exclude your own visits, but sophisticated automated browsers will still sometimes pass. Aim to make them irrelevant to your decisions rather than to remove them completely.
Does a visit with zero reading time always mean a bot?
No. Real people bounce too, especially from social links. Look at the whole pattern: a source where almost every visit has no scroll, arrives in a burst, and never buys is the suspicious one.