1

I have a website hosted by GitHub Pages, it's a statically generated website, and the deploys happen by pushing new static code to my gh-pages branch of my GitHub public repository.

I recently started to look at the Google Analytics data, and I found a lot of visits to pages that aren't part of my website.

In the screenshot below, you can see rows 24, 25, 30, 31, 32, 33, 34, 35 and 36, they are all not existing pages.

unknown pages

I can't understand how can this happen, I'm asking GA to show me the title pages, and those pages do have a title, so I would suppose those pages, at some point, existed in my website.

But there isn't any suspicious activity in my gh-pages branch commit history.

I wouldn't be alarmed if the reports were for non-existent URLs, since anyone can write a random URL in their browser and have my 404 page report it. But here we are talking about page titles.

How can this happen?

Fez Vrasta
  • 113
  • 5

1 Answers1

2

There are a few reasons why this could be happening:

Google Analytics Referrer Spam

Spammers hit Google Analytics servers with fake data for your (and lots of other people's) tracking id. They do this to try to get you to visit URLs listed in the referrer report. This fake data is known to include fake page names, probably in an attempt to make the data look more legit to Google.

Because this attack doesn't ever hit your website (they just hit inject data to Google directly), there is no blocking you can do on your own server to combat it. You have to block in in your GA settings.

One way is to create and use a new tracking ID. The spammers usually hit the default tracking ID associated with your account that ends in -1. Creating a second (or third, or fourth) property on the same GA account creates new tracking ids that end with other numbers that get spammed less. If you take this approach, you still may get some spam, but probably much less.

The other method to combat it is to create host name filter. The Google Analytics only records data that says it comes from your web site. The spammers tend not to know what website they are spamming. They usually just guess at random id codes. So a host name filter effectively stops almost all the spam. Of course, your tracking id can only ever be used on your own site then.

See: How to fight off Google Analytics referrer spammers?

Your Google Analytics code is being used on some other website

If that is the case, the solutions are the same as for the spammers

Your site was hacked

Hackers may be adding pages to your site. Usually when hackers do that they try not to have you notice the hack by having the pages tracked in your analytics.

Stephen Ostermiller
  • 98,758
  • 18
  • 137
  • 361