Why are porn sites appearing in my Google Analytics data?

by

This is Ghost Referrer Spam, there’s no flaw in your app/site regarding this aspect. They just target random GA tracking-ID’s no matter if it’s an app or a website, it’s called Ghost because it doesn’t reach/use your app actually.

You shouldn’t worry about security issues but if you want to keep clean your google analytics is better to exclude them from your reports

The only way to stop them for now is by filtering them in Google Analytics you can add a single filter

  • Go to Admin tab in Google Analytics

  • Select the View you want to filter > Filter > New Filter

  • In Filter Type choose Custom Filter > Exclude Filter

  • Field: Campaign Source

  • Filter Pattern: Enter youporn-forum.ga or any referral spam that is hitting you

You can also use a more general approach with an Include filter based on Valid Hostnames that will stop this and most of the Referrer Spam without needing to add a new filter every time as new Spammer show up.

You have to make a regex with all your Valid hostnames something like this

example\.com|example\.es|paypal\com|translate\.googleusercontent.com

When you have the regex of all your valid hostnames create an include filter

  • In Filter Type choose Custom Filter > INCLUDE Filter

  • Field: Hosname

  • Filter Pattern: Paste the regex example.com|example.es|paypal\com|translate.googleusercontent.com

You can find more information about Referrer Spam and more detailed instructions of these solutions and others here

https://carloseo.com/removing-google-analytics-spam/ (url updated)

More Related Contents:

  1. PHP Session Security
  2. How do I create a self-signed certificate for code signing on Windows?
  3. What is token-based authentication?
  4. Non-random salt for password hashes
  5. Prevent PDF file from downloading and printing
  6. Are HTTPS headers encrypted?
  7. How secure is a HTTP POST?
  8. Best Practices: Salting & peppering passwords?
  9. What’s the right OAuth 2.0 flow for a mobile app
  10. How do I store and retrieve credentials from the Windows Vault credential manager?
  11. MVC 6 Bind Attribute disappears?
  12. What is the most secure seed for random number generation?
  13. How will a server become vulnerable with chmod 777?
  14. Moving old passwords to new hashing algorithm?
  15. Best way for a ‘forgot password’ implementation? [closed]
  16. Should JWT be stored in localStorage or cookie? [duplicate]
  17. Is it worth encrypting email addresses in the database?
  18. Is it possible to reverse a SHA-1 hash?
  19. Secure Google Cloud Functions http trigger with auth
  20. What is the appropriate way to manage API secrets within a Google Apps script?
  21. SSO with CAS or OAuth?
  22. What’s the best approach for generating a new API key?
  23. Best practices for server-side handling of JWT tokens [closed]
  24. How do I secure REST API calls?
  25. client secret in OAuth 2.0
  26. What are best practices for securing the admin section of a website? [closed]
  27. How can I hash passwords in postgresql?
  28. How is it possible to access memory of other processes?
  29. How do you protect code from leaking outside? [duplicate]
  30. Has Hardware Lock Elision gone forever due to Spectre Mitigation?

Leave a Comment