In order to register a "hit" on Google Analytics, the list of things required are:

  1. Unique API key(s) for Google Analytics
    • Public: can be gotten from the embedded JavaScript files on the pages for tracking.
  2. HTTP requests that seem to originate from the page in question.
    • Can be spoofed in a multitude of ways: which means detecting and putting a stop to it is hard enough to be not worth it.
  3. JSON data representing traffic, in a schema that Google expects.

Stop me right here if I’m wrong with the list.

If I’m not, then it’s really easy to spoof traffic on a site and make someone’s Google Analytics look really good even if they’re not getting any traffic!

How, then, does Google prevent these attacks? Doesn’t it hurt the credibility of Analytics stats?

I’m interested in this because of another question I’m still struggling to formulate involving Alice, Bob, Mary and some private keys that somehow need to be safely public. I’m hoping that Google may have solved that problem by trying to address this issue. I’ll post a link here once I have that question up.

  • Note to future self: explore using the SSL cert of your domain to verify the identity of the request & generate a private identity.
    – Aditya M P
    Mar 28, 2016 at 4:36

2 Answers 2


Ultimately separating real data from the fake is almost impossible, but in addition to the measures you listed Google employs blacklists. This problem is likely to never go away.

Review this question for more info. https://stackoverflow.com/questions/2418609/how-does-google-analytics-prevent-traffic-spoofing#2419115


As noted before, there is no real way of not allowing to send fake data. Yet, in case you have access to both servers (tracked website + tracking service), you can make it "bulletproof".

From the tracked website before displaying the page to the user, generate a random hash into his session and show the hash together with the session ID as plain JS variables, which would then be sent with the usual track object to the tracking service.

In turn, the tracking service, before writing the received object into the DB, should do an additional request back to the website with the session ID, asking what is the random hash currently in it? If the hash matches, it's a valid request and can be inserted into the DB.

The cons here is that analytics service is expected to have lots of requests and with this validation it will double them. This could also be avoided in case both services are located on the same server or have a shared directory where the session files are kept.

If this is not the case, to reduce the loading and time of the validation request, on the tracked website, create a very small .php file which would do nothing else but receiving the request with the session ID and random hash, opening the session file/storage and doing the validation. No DB connection or anything else should be needed for this purpose.

Update: Also, when generating and replacing for every page load a new random hash in the session, if the user will open more than one tab, only the last tab's hash will be valid. To solve this you could either reuse the same hash for a certain amount of time, or better, create a pool (list) of valid hashes in the session (i.e. 3-4 maximum) which will allow up to 3-4 tracked opened tabs in parallel.

  • 1
    This is not bulletproof, what if I have a selenium bot doing that all the time? I can even fake it with some piece of code. Make a request, save both the session and hash, send you the analytics, when you send me the sessionid, I can send you back the hash. Yes is a bit more difficult, but not bulletproof, far from that.
    – Totty.js
    Aug 25, 2018 at 6:44
  • @Totty.js you're right. You definitely can manipulate ANY request which goes from your client (selenium or any browser). But the question was how to prevent attacks and spoof traffic while not having any user visit. What you describe, still means you will have to visit the website (do a request) and read the new JS hash variable and use it in your manipulated request. Thus, you will generate a visit. So sending 1000 page views to the analytics while not requesting the website also 1000 times is not possible.
    – cephuo
    Aug 25, 2018 at 15:30
  • Yeah, that's correct. But not sure how useful is that because in real world, you can have somebody load the page 1000 times and send 1000 GA data points.
    – Totty.js
    Aug 25, 2018 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.