Key takeaways
Whether you are an advertiser or a publisher, a significant portion of your web traffic likely isn’t human. Reports published on Gitnux show that the average IVT (Invalid Traffic) rate across all digital campaigns is around 11%. Additionally, click fraud data shows General Invalid Traffic rates increased 86% in H2 2024, due to AI crawlers. This data shows that businesses can no longer ignore invalid traffic.
In this report, we define exactly what invalid traffic is, how to spot the “telltale signs” in your analytics, and how to stop it from corrupting your data.
Invalid traffic (IVT) is traffic or impressions that don’t come from real users with genuine interest. This type of traffic will never result in a lead, sale or meaningful interaction.
IVT operates through a mix of bots and human-driven deception. While some IVT is “benign” (like search engine crawlers), most of it is designed to drain ad budgets or artificially inflate publisher revenue.
There are different types of invalid traffic, and we generally classify them into two buckets:
Our data shows that up to 11.5% of all clicks in Google Ads are invalid, and losses from ad fraud are expected to hit $172 billion by 2028. Additionally, reports from Gitnux indicate that the average IVT (Invalid Traffic) rate across all digital campaigns is around 11%.
Modern invalid traffic involves a wide spectrum of tactics that range from automated scripts to coordinated human-driven deception.
Here are the major types businesses experience.
The most common form of non-human traffic comes from legitimate search engine bots like Googlebot or Bingbot. We classify these “crawlers” as GIVT. They are benign and don’t typically click on ads, and are even critical for ensuring that your business shows up on SERPs.
Unlike search crawlers, data scrapers are often used by competitors or third-party aggregators to “harvest” information like pricing data, inventory levels, and content. They are also classified as GIVT because they aren’t trying to hide or obfuscate their activity.
Click fraud is one of the more malicious forms of invalid traffic, and is classified as SIVT. Here, scammers use methods ranging from click farms and botnets to ad stacking, to generate fake clicks. Depending on the sophistication of methods used, click fraud can be very difficult to detect and stop.
Competitor click fraud occurs when a business rival deliberately clicks on your paid ads with no intention to convert. This can be done manually by employees or automated through bots, and the goal is to drain your advertising budget.
Fraudsters use multiple techniques to hide their true identity and location. In user-agent or device spoofing, a simple script can tell your server it is a “human using Chrome on an iPhone 16” to avoid bot detection. Similarly, bots may falsify their IP address to make traffic from a server farm appear as if it’s coming from a high-value US city.
Fraudsters also route traffic through proxy servers and VPNs to mask their origin and rotate their identities. By constantly switching between thousands of different IP addresses, a single bot can mimic the behavior of a thousand unique visitors, creating user sessions that will never lead to conversion.
Because Google Analytics 4 (GA4) is an event-based tracking system, you can use it to identify telltale signs of invalid traffic. Here’s how:
In GA4, a “bounce” is a session that lasted less than 10 seconds, had no conversions, and viewed only one page. So a bot could spend longer than 10 seconds on your website and technically not count as a bounce. That’s why we recommend viewing engagement metrics as well.
If you see a sudden spike in sessions with a 100% bounce rate, it is likely basic bot activity (GIVT). But if you find low bounce rates with zero conversions or erratic patterns (like thousands of hits from a single data center), that would point to sophisticated invalid traffic (SIVT).
To check your engagement and bounce rates in GA4:
One of the best ways to spot Sophisticated Invalid Traffic is by looking for patterns that are inconsistent with normal human users. Human visitors to your site will have variable screen resolutions, use common browsers, and they live in locations you typically do business.
Use GA4 to build a report that shows all these dimensions:
Look for thousands of sessions coming from a single screen resolution (e.g., 800×600) or an outdated browser version that has zero conversions. This is a classic signature of a bot farm.
Bots often originate from data centers rather than residential ISPs. And while GA4 doesn’t show “Service Provider” anymore, you can still spot IVT via Geography. If you are a local business in the US but see a massive spike in traffic from Singapore or Ireland with 0% engagement, that traffic is almost certainly invalid.
Google does filter some IVT automatically. You can see what invalid clicks have been flagged in your main reports dashboard by following these steps:
Scroll to the right and you’ll see your new columns added along with the data.
Note: Google automatically refunds you for these invalid clicks.
Our data shows that more than 11.5% of clicks in Google ads are invalid. That means it’s not enough to lean on protection from ad platforms or basic filters. Blocking invalid traffic requires a multi-layered approach that stops both basic bots and sophisticated fraud.
Honeypots are invisible elements on your website that legitimate users can’t see or interact with, but bots will. By adding hidden form fields, links, or buttons to your pages using CSS (display: none), you create a trap that only automated scripts will trigger.
When a bot fills out the hidden field or clicks the invisible link, you can flag that session as invalid and block the IP address.
Honeypots are very effective against spam bots and basic crawlers, but less so against more sophisticated invalid traffic.
You can exclude IP addresses in Google Ads from seeing your ads, preventing repeat offenders from draining your budget. Navigate to your campaign settings and add suspicious IP addresses under “IP exclusions” (found in Additional Settings). You can exclude up to 500 IP addresses per campaign.
Made For Advertising (MFA) websites are low-quality sites designed solely to generate ad revenue with minimal real content. An ANA study found that advertisers waste 21% of their programmatic display ad budgets on websites like these.
MFA sites generate invalid traffic through everything from auto-refreshing pages and accidental clicks to misleading layouts that trick users into clicking ads.
Review your Google Ads placement reports to identify MFA sites with high impressions but extremely low engagement rates. Exclude these domains at the campaign level, and consider using topic exclusions to avoid entire categories of MFA content like “parked domains” and clickbait sites.
Note: Read more about how budgets are wasted on these made for advertising websites.
The tactics above help, but they’re reactive. By the time you spot invalid traffic in GA4 and manually exclude IPs, the damage may be done.
Dedicated click fraud protection platforms analyze every click in real-time, detecting fraud before it impacts your budget. These tools evaluate hundreds of signals per click including:
When fraud is detected, the IP is automatically added to your exclusion list with no manual work required.
Fraud Blocker provides automated, real-time protection against click fraud and invalid traffic across your entire paid advertising campaigns. Our platform monitors every click on your ads, analyzing behavioral patterns, device fingerprints, and engagement signals to distinguish between genuine users and fraudulent traffic.
When Fraud Blocker detects invalid traffic, it automatically adds the source to your exclusion lists in Google Ads and Facebook Ads. This prevents repeat fraudsters from clicking your ads again, stopping the bleed before it impacts your budget.
Ready to protect your ad spend? Start your 7-day free trial today and see exactly how much invalid traffic is costing your business.
No. Invalid traffic (IVT) is the broader term that includes all non-human or fraudulent traffic, including both benign bots and sophisticated bot farms. Click fraud is a type of IVT and it refers to malicious clicks on paid ads designed to drain ad budgets or inflate publisher revenue.
No. You should only block malicious invalid traffic (SIVT). Some forms of General Invalid Traffic (GIVT) like Googlebot and other search engine crawlers are essential for SEO, and they need to access your site so you can rank in search results. If you block these, search engines can’t index your pages and you’ll disappear from search results. Focus on blocking sophisticated invalid traffic that drains ad budgets and corrupts your analytics.
Use Google Analytics 4 to spot invalid traffic patterns. Look for sessions with 100% bounce rates and zero engagement, traffic spikes from unlikely locations (especially data centers), thousands of visits from a single screen resolution or outdated browser, and high click volumes with zero conversions.
Invalid clicks and click fraud are a type of invalid traffic. Invalid traffic is any traffic that doesn’t come from real users with genuine interest. Invalid clicks are clicks on your ads that come from invalid traffic sources and don’t represent genuine user interest. Click fraud is a malicious subset of invalid clicks where someone intentionally clicks your ads to drain your budget.
Yes, Google Ads has built-in systems that automatically detect and filter invalid clicks before charging you. When Google detects invalid activity, they issue automatic credits to your account. However, the filters aren’t perfect as more sophisticated invalid traffic (SIVT) often slips through.
General Invalid Traffic (GIVT) consists of non-human traffic that’s relatively easy to identify and doesn’t attempt to hide its true nature. It is typically benign, and includes search engine crawlers and known bot signatures. Sophisticated Invalid Traffic (SIVT), on the other hand, actively tries to appear human and evade detection. It is usually malicious and includes click fraud from botnets, competitor clicks, and coordinated click farms.
Start by using Google’s built-in Invalid Click Report to see what invalid clicks have been flagged in your account. You can also enable IP exclusions to block known sources of invalid traffic, and use geographic and demographic targeting to limit your ads to locations and audiences where your actual customers are located.
Finally, you can use third-party click fraud detection tools like Fraud Blocker to identify and block invalid traffic in real-time.
ABOUT THE AUTHOR
Matthew is the resident content marketing expert at Fraud Blocker with several years of experience writing about ad fraud. When he’s not producing killer content, you can find him working out or walking his dogs.
Matthew is the resident content marketing expert at Fraud Blocker with several years of experience writing about ad fraud.
