Follow these easy steps to make sure you're able to rid your analytics of spam.
First, you've got your referral spam. This is just spam where someone sends hits from their domain to your domain via bots. A lot of times, it's not even a real domain.
Next, you've got your ghost spam. These deviants are firing hits on their own domain with your analytics code, making it look like you got traffic when you didn't.
In Google Analytics, you can set a filter to look for all of the campaign sources which may deliver spam traffic to your site. We’ve compiled a total list in regex, though your filter can only have 250 characters. So, you’ll need several filters to get everything.
There are other ways to write this that are shorter, but this should be easy for most people non-regex trained to copy and paste:
Feel free to add others you find to your own list. Your filter will look something like this when you enter everything:
This next one involves setting your profile to only report on traffic to your own hostname. (Replace client.com with your own site domain). Make sure you only include hostnames which you control and want to report traffic from.
The answer to this is due to the nature of what you know out of both data sets. For hostnames, you always know exactly which domains you want to track, so you use an include filter. For referrals, you only know spam by finding the domains in your reporting. You don’t want to accidentally exclude real information from affiliates or partner sites.