Since some days ago, Google Analytics is reporting an abnormal (anomaly) in the number of users and visits.
I’ve checked and they all seem to appear to be from the same foreign city and are mostly referrals from URLs with strange names, including some that seem empty/void.
What is this? Has my website been hacked? How does one fix this?
Update: I believe it might be “Crawler referrer spam” or “Ghost spam”?
The website is hosted in “BSS sites” configured with cloudflare, so I believe I don’t have access to the .htaccess file to fix it, if it’s the first case…
It’s not uncommon to get bot traffic from all over the world. Some of it is good, some is harmless, and some is malicious. Most is just nuisance traffic (as you mentioned, “referral” or “ghost” spam.) Some of these “nuisance bots” are looking for exposed plain-text email addresses to harvest so they can spam those emails with emails of their own that contain bad links. Some are looking for forms to which they can submit spam submissions in an effort to get people to click on bad links in the submissions.
It’s extremely rare to encounter bots that actually try to gain access your server, inject bad code, or do other kinds of damage. It takes a some very sophisticated hacking to do this sort of stuff without people discovering it, and unless your website or server offers something of great value to the hacker (i.e. banks, government websites, huge companies with databases containing people’s personal info like insurance companies), there’s not much reason for them to bother.
It really nothing to lose sleep over. These spam bots are not infecting your site, hacking into your server, or stealing your data. But they can mess up your analytics. You can activate Google Analytics ‘Bot Filtering’ to help keep your analytics data clean. It won’t stop the bots, but it will allow you separate your legit traffic from the spam traffic. This article may help.
If you truly want to stop the bots altogether, @kuligaposten gave you the answer. Use Cloudflare. Their platform uses sophisticated A.I. to identify and block spammers.