How to spot bot and bought traffic

4 min · no code skills needed · updated June 2026

Quick answer. Junk traffic gives itself away: hundreds of visits, only seconds on site, no engagement, from a domain you have never heard of. Names with "traffic", "cheap" or "buy", and odd TLDs, are almost always bots or bought visits. It inflates your totals and hides your real signal. Confirm it in GA4 by engagement time and conversions (junk converts nothing), then exclude it with a filter or simply ignore it.

A spike that converts nothing is not a win, it is noise wearing a costume. Learn to recognise it so you never make a decision off it.

What you'll need

Tell junk from real traffic

  1. Read the tells. A referral you do not recognise, sending a lot of visits that stay for seconds, with a name like trafficbot, cheap-traffic or a random TLD. That pattern is bought or bot traffic almost every time.
  2. Confirm with engagement. In GA4, check average engagement time and conversions for that source. Real visitors spend time and occasionally convert. Junk shows near-zero on both.
  3. Exclude it or ignore it. Add a filter to keep it out of your reports, or just mentally discount it and watch your real channels. Either way, never celebrate it or act on it.

Do it with AI

Not sure about a source? Have Claude or ChatGPT sanity-check it.

Judge a suspicious source
A referral source called [domain] sent me [N] visits this week, average time on site [X] seconds, [Y] conversions. Based on what you know about that domain and these numbers, is this likely real traffic or bot/bought junk? Be blunt, and tell me what to do about it.

How to check it worked

After filtering, your visitor count may drop, and that is good. Your engagement rate and conversion rate should rise, because what is left is real people.

Common mistakes

FAQ

How do I know if traffic is from bots?
Look for high volume with near-zero engagement time and no conversions, from sources you do not recognise. Real humans leave a trace, bots do not.
Should I block bot traffic in GA4?
GA4 filters known bots automatically, but bought or spammy referrals slip through. Add a referral exclusion or a report filter for the offending domain.
Is buying traffic ever worth it?
For real analytics and growth, no. It inflates vanity numbers, never converts, and hides the channels actually working for you.

We call junk traffic what it is.

Holy Bucket flags sources that pour in volume but leak straight out, so you can tell a real win from a costume.

It reads engagement and behaviour, not just the headline number, and tells you plainly when a spike is noise.

Keep going

Last updated June 2026. By Holy Bucket.