> For the complete documentation index, see [llms.txt](https://docs.adpage.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adpage.io/faq/debugging-monitoring/identifying-and-excluding-bot-traffic.md).

# Identifying and excluding bot traffic

Not all collected data is “good” data. Bots generate traffic and some are useful, and some are harmful and can spam forms, CRMs and pollute. In this aricle we explain what bots are and what to do.

### What exactly is bot traffic?

Bot traffic includes every non-human visit to your website or landing page. In AdPage, this often appears as:

* **Spam submissions:** Automatically completed forms.
* **Ghost referrals:** Traffic shown in analytics that never actually visited your page.
* **Ad fraud:** Bots that click your ads and waste your budget.
* **Search engine crawlers:** Bots that crawl websites.
* **Malicious bots:** Automated attacks that actively cause harm.

### Why bot traffic affects your return

Data specialists often underestimate bot traffic as a technical issue. Its impact is tangible and costly. Take it seriously for these reasons:

* **Polluted algorithms:** Ad platforms like Meta and Google optimise for conversions. If bots submit your forms, the algorithm treats them as valuable customers. Your budget then targets more bots instead of real buyers.
* **Damage to your email reputation:** Bot leads with fake addresses can enter Mailchimp or HubSpot. Your *bounce rates* then increase. An email provider may flag your account as spam. Legitimate newsletters may no longer reach real customers.
* **Distorted decision-making:** Your conversion rate may appear to be 5%, while bots create half of it. You may consider a campaign successful while sales reports poor leads. Clean data is the foundation for growth

<figure><img src="https://2963651437-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5eC7lwaeygB0xx6AOZcE%2Fuploads%2F4V4KGJ4MYLuLX6NE43kz%2Fimage.png?alt=media&amp;token=fc2f3ccb-7e81-411a-a178-c196384bcaf8" alt=""><figcaption></figcaption></figure>

### Types of bot traffic

#### ⚠️ Harmful bots (data polluters)

* **Spambots:** Flood your forms and reviews with fake messages. This damages your platform’s credibility.
* **Scraper bots:** Copy content from your website without permission. They often reuse it for competitors.
* **Credential-stuffing bots:** Use stolen login credentials to access accounts. They can make login pages slow or unavailable.
* **DDoS bots:** Overload your complete website with massive, meaningless traffic.
* **Ad-fraud bots:** Click your ads to waste budget and make conversion statistics unusable.

#### ✅ Useful bots (business enablers)

* **Search engine bots:** Index your pages for Google or Bing search results.
* **Chatbots and virtual assistants:** Answer questions immediately and provide support.
* **Content aggregators:** Automatically collect and distribute the latest news to readers.
* **Performance bots:** Monitor website speed and uptime, so you know when something goes wrong.

### How do you identify bot traffic?

Review your data regularly for these indicators:

* **Unexpected traffic sources:** Traffic from regions without active marketing is often spam. For example, a local Dutch campaign may suddenly receive 200 hits from a Virginia data centre. Also check IP addresses from cloud providers instead of consumer ISPs.
* **Illogical session duration:** Bots are extreme. They may visit for milliseconds to scrape data. They may also remain for hours to imitate human browsing. Both patterns are warning signs.
* **Abnormally high bounce rate:** A bot designed to worsen statistics opens a page and leaves without interaction. A sudden, unexplained bounce-rate increase can indicate bot traffic.
* **Spikes in requests:** A sudden jump in page views or requests from one IP address may indicate an emerging DDoS attack or aggressive scraper.
* **Fake conversions (lead spam):** This is the most visible form. Dozens of forms contain meaningless data, random characters, or obviously fake email addresses. This pollutes your list and inflates campaign success.
* **Artificial clicking and scrolling:** Advanced bots imitate human movements. They often reveal themselves through overly linear mouse movements, repetitive clicks, or unnatural scrolling that lacks a logical reading pattern.

### Strategies to identify and block bots

Use these practices to keep your data collection clean:

#### Server-side tagging and filtering (via GTM)

Run tracking through a server-side container. You can filter incoming requests by IP address or User-Agent string.

* **Why this matters:** Block bots before Facebook or Google tracking pixels fire. This keeps data clean and prevents algorithms from learning from fake converters.
* AdPage uses [GEO server headers](https://help.adpage.io/nl/articles/6552898) for filtering.

#### The honeypot method

A honeypot is an invisible form field. Human users cannot see it. Bots automatically complete every available field. Many forms support this approach, but use suitable tooling.

* **How it works:** If the honeypot field contains data on submission, the system identifies a bot.
* **Benefit:** The user experience remains uninterrupted. The bot exposes itself without frustrating challenges.

#### Implement reCAPTCHA v3

Google reCAPTCHA v3 uses a background scoring system. It replaces the old “select all traffic lights” images. Users do not notice it. Each user receives a score between 0, likely a bot, and 1.0, likely human. You can automatically reject submissions below 0.5.

#### Validate email addresses and phone numbers

Add real-time form validation to enforce correct formats. Many bots use random character strings.

* **Expert tip:** Validate fields against specific formats, such as Dutch phone numbers.

#### Use specialised detection tools

Software such as **Cloudflare Bot Management** uses machine learning to detect unnatural behaviour. It blocks suspicious requests before they reach your landing page. It acts as a gatekeeper for your data environment.

#### IP rate limiting

Set a limit on requests from a single IP address within a defined period. This effectively protects against DDoS attacks and spambots that submit hundreds of forms at high speed.

#### JavaScript challenges and header inspection

* **JavaScript challenges:** Ask a browser to run a simple script before the page loads. Most malicious bots cannot do this and reveal themselves.
* **Header filtering:** Bots often use generic or incorrect headers. Filter requests with suspicious headers to exclude much automated noise.

#### Web application firewalls (WAF)

A WAF acts like antivirus software for web traffic. It identifies known bot attacks early and blocks them before they can use your forms or burden your server.

#### Device fingerprinting and server-side validation

* **Fingerprinting:** Bots often change IP addresses, but their device fingerprint usually remains the same. Analyse device data to block repeated attacks from one source, even after an IP change.
* **Server-side tracking:** **This is the primary recommendation.** Move from client-side to server-side tracking, such as Stape or GTM. Validate requests on the server before they pollute analytics. Client-side measurement alone creates unnecessary data-pollution risk.

#### Geographic filtering (GEO filtering)

Are you receiving high traffic from regions where you do not operate? Block those regions or require an additional verification challenge. Do not collect data from countries where you do not deliver.

* AdPage uses [GEO server headers](https://help.adpage.io/nl/articles/6552898) for filtering.

### Conclusion

Protecting landing pages from bot traffic is essential to a healthy marketing strategy. Bots create more than noise. They consume ad budgets, confuse optimisation algorithms, and can damage your email-provider reputation. Unclean data costs money. Accurate data drives growth


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.adpage.io/faq/debugging-monitoring/identifying-and-excluding-bot-traffic.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.