Is That Traffic Spike Real? Telling Growth From a Bot or Referral Spam Spike in Google Analytics

Nothing feels better than opening Analytics and seeing a spike — until you check the details and realise 800 of those "visitors" spent zero seconds on your site and came from a domain that sounds like it was named by a random word generator. Traffic spikes lie constantly, in both directions: fake spikes that flatter you, and fake drops caused by tracking issues that panic you. Here's how to tell what's actually happening before you make a decision based on a number that was never real. 💖

What most businesses get wrong when a spike appears

• Celebrating the top-line number without checking anything else — total sessions is the least informative metric in the entire report on its own.
• Assuming a spike must mean a marketing win — most real businesses can trace a genuine spike back to a specific cause (a post going semi-viral, a press mention, a new ad); if you can't think of one, be suspicious.
• Not checking session duration and bounce rate together — either one alone can be misleading, but a near-zero duration combined with a near-100% bounce rate is close to a smoking gun for bot or spam traffic.
• Ignoring the source/medium report entirely — this is where fake traffic almost always reveals itself, in a source name you don't recognise sending traffic to one page only.
• Reacting immediately instead of waiting a day or two — some spikes (and some referral spam waves) resolve themselves within 48 hours; a same-day emergency response is often unnecessary.

The four-point diagnostic checklist

Run these in order — most fake spikes get caught by point two or three, so you rarely need to go further:

Three examples worked through

Why fake traffic looks the way it does

Referral spam works by sending fake "visits" directly to Google's tracking servers with a spoofed referrer, without an actual browser or human ever loading your page — which is exactly why session duration sits at zero and every session bounces: there was never a real page-view to engage with. Bot traffic behaves similarly but can sometimes fake slightly more realistic-looking behaviour, which is why checking multiple signals together (not just one) matters — a sophisticated bot might fake a non-zero session duration, but rarely fakes a believable mix of pages, referring content, and geography all at once. The combination of checks is what catches it, not any single metric in isolation.

Mistakes to avoid when investigating a spike

• Excluding a source without checking it first — occasionally a legitimate new referral partner or press mention can look unfamiliar at first glance; check before you filter it out permanently.
• Changing budgets or strategy based on a spike under 48 hours old — give it a couple of days to confirm the pattern holds before reallocating spend or effort based on it.
• Only checking the overview report — the overview hides exactly the detail (source, duration, landing page) you need to tell real from fake; always drill into Acquisition.
• Forgetting to check historical data for the same pattern — if the same spam source spiked and vanished before, it's a known recurring pattern, not a new mystery each time.

Frequently asked questions

Can referral spam actually hurt my business, or is it just annoying?

It depends on what you do in response to it. Left alone, referral spam is mostly harmless noise. The real risk is indirect: it can inflate your numbers enough that you draw the wrong conclusion about what's working, misjudge a campaign's real performance, or panic-react to a "drop" that's actually just spam traffic disappearing as suddenly as it arrived.

Does GA4 filter out bot traffic automatically?

GA4 does exclude some known bots and spiders by default, but it doesn't catch everything, particularly newer or more sophisticated spam sources — which is why the manual checks above still matter even with automatic filtering switched on.

How fast should a genuine traffic spike show up as real business results?

There's no fixed timeline, since it depends on your typical sales cycle — a booking-based business might see enquiries within days, while a considered B2B purchase could take months to show up as a lead. The point isn't speed, it's whether the engaged-session and duration metrics look human at all, regardless of when conversions eventually follow.

Should I report referral spam to Google?

You can, but it's rarely worth the time — filtering it out of your own reporting view achieves the same practical result (clean data) much faster than waiting on a report to be actioned. 🌴

Keep reading 🤍

• What Is Google Analytics (& Do You Need It)?
• How to Reduce Your Bounce Rate
• How to Read Your Google Analytics Without a Marketing Degree