How to Block Spam Traffic from a Referral Website Using Cloudflare?

This is a competitive world and you will have a heavy competition regardless of whether you are doing an online or offline business. Online businesses have additional problem that your competitors can easily analyze and find your strategic position in market using traffic analytics tools like Semrush. The first thing people do to destroy your online business is to spam your site links all over the internet especially on pornography and malicious sites. This will directly impact your backlink profile and you will start losing ranking in Google and other search engines. If you notice thousands of referral traffic come from a single spam site, then you should act and block the traffic to safeguard your server and ranking. In this article, we will explain how to block traffic from a referral website using Cloudflare WAF rules.

Blocking Traffic from a Website

It is super easy to block a country level traffic or a specific IP address. Especially, you have lot of plugins to do this when using content management platforms like WordPress. However, there are not many tools available to block a specific website from which you get targeted attacks. Here are things you need to block spam traffic from a referral website.

1. Finding Referral Traffic from a Site

First thing you need is to find the website from which you are getting spam or automated traffic. This needs a bit of understanding of how referral traffic is identified by analytics tools. There are four ways to get traffic to your website.

• Organic from search engines.
• Paid advertisements.
• Social traffic from Facebook, Twitter, etc.
• Referral traffic from other websites having links pointing to your site.

Our target here is to find the referral traffic details and understand which sites are sending more users to your site. When someone clicks your site’s link from another website, the site will send a request to your server for fetching the linked page’s content. Fortunately, this request contains HTTP referrer details which will have the website’s domain name from where the request was received. When HTTP referrer is available in the request, the traffic is classified as a referral traffic. You can find the referral traffic details using Google Analytics account.

• Login to your Google Analytics account. We show here with Universal Analytics setup and you can use GA4 also for this purpose.
• Navigate to “Acquisition > All Traffic > Referrals” section.
• Here you can find the list of domains with the number of times referred. By default, the report shows for a week duration which you can change to a month or longer. This will give you the correct analysis of which domain is referring your site more for a longer time duration.
• Click on the domain name to view the list of individual pages it referred on your site.

You can analyze the site and the linked pages to find whether it is natural or your competitors using this purposely.

2. Disavow Referring Domain

Once you are suspicious about a domain, next steps is to disavow the domain using Google disavow links tool. This will inform Google to demote the domain. Google will NOT consider the links coming from that domain to your site when calculating the search result ranking positions. You can learn more on how to use Google disavow link tool for domains, subdomains and individual URLs.

3. Setup Free Cloudflare Account

Go to cloudflare.com and create a free account. You need to add your site in the account and change the DNS nameservers to Cloudflare to use the free CDN and firewall. You can learn more about setting up Cloudflare account with WordPress site and the process is same for any other platform.

4. Blocking Referral Website in Cloudflare

Cloudflare offers various security features to block automated bots, protect hotlinking images, block IP address, block a country, etc. Follow the below steps to block the spam referral site you found from Google Analytics account.

• Open your Cloudflare account and select the site from the list.
• Go to “Security” section and click on “WAF” option.
• Navigate to “Firewall rules” section where you can create up to 5 rules for a free account.
• Click on “Create firewall rule” button.

• On the next screen, provide the name for your firewall rule. You can provide any name like “Block Competitor Spam Referral”.
• Click the “Field” dropdown and select “Referrer” from the list of available options.
• Next click the “Operator” dropdown and select “contains” option.
• Finally, enter the referral website you found from Google Analytics in the “Value” text box. You can add multiple domains by clicking the “Or” button. It is also possible to add a specific URL from your site using “And” to only block referral domain to that URL.
• After filling the details, click the dropdown showing below “Choose an action (Required)” and select “Block” option. You can also choose “Managed Challenge” option to automatically trigger a CAPTCHA check when Cloudflare detects the suspicious request from that domain.
• Click “Deploy firewall rule” button to apply your changes.

Make sure not to select “equals” for operator as you may make mistake in entering the domain name in the “Value” field. For example, if the referring domain name is www.example.com, using equals with example.com will not block that domain. So, safely use “contains” and the domain name like example.com to perfectly apply the blocking rule.

5. Testing Firewall Rule

After applying the firewall rule, you should not see the referral traffic from the domain in Google Analytics account. Since you use Cloudflare’s nameservers, the request will be blocked by Cloudflare before it reaches your server. This will not only help to block the referral domain but also save lot of server bandwidth.

You can also open the referral website and click your link to check if the Cloudflare’s rule is working fine. You should see an access denied page from Cloudflare (if you have blocked the domain) with a message mentioning the website owner denied access from that referral domain.

6. Finding Blocked Statistics Details

Cloudflare will record complete statistics of each URL blocked from the referral as part of the firewall rule.

• Go to “Security > WAF > Firewall rules” section in your Cloudflare account.
• You will see the created firewall rule name with number of attempts blocked in past 24 hours (in our case, it is 105 as you can see in the screenshot). You can anytime pause or delete the rule from here. Click on the number of attempts to check the details for each attempt.

• This will take you to “Security > Events” sections where you can find the complete list of all 105 blocked attempts. Click any of the item to find further details like which URL was requested. You can find the “Expression” value where it will show the firewall rule you have created.

Note: If you have selected “Managed Challenge” instead of “Block” option, then you will see CSR % in “Security > WAF > Firewall rules” section. CSR stands for Challenge Solved Rate which is the ratio of challenges solved and challenges issued. The value will be less if Cloudflare did not suspect traffic from the domain. As you can see in the above screenshot, CSR is 80.95% which is a clear indication that the traffic is suspicious. In this case, you can safely change the firewall rule from managed challenge option to block.