How to Stop Click Fraud and Bot Traffic on Your Affiliate Links

Click fraud drains your ad budget, poisons your analytics, and can put your affiliate payouts at risk. If you run paid traffic to affiliate offers, some share of every click you pay for is a bot, a scraper, or a competitor burning your budget on purpose. ShortlyLink scores every single click 0–100 for fraud signals and automatically filters the worst of it out of your stats — so the numbers you optimize against are real.

Quick answer

ShortlyLink scores every click from 0 to 100 using bot user-agent detection (isbot), missing or inconsistent headers, scripting user agents (curl, wget, python-requests, headless browsers), rapid-fire clicking (8 clicks in 10 seconds from one fingerprint), and geographic "impossible travel." Scores map to four tiers: normal (under 40), log (40+), challenge (70+), and block (90+). Blocked clicks get a 403 page and are recorded but excluded from your stats; challenged clicks must pass a signed ~2-minute JavaScript test that non-JS bots fail. A background job every 5 minutes watches for traffic spikes and bot surges and alerts you in-app or on Slack. One gotcha: testing your own link with curl trips the block tier and returns a 403.

What is click fraud, and why does it hurt affiliates?

Click fraud is any click on your link that isn't a genuine person with genuine intent. In the affiliate world that covers a lot of ground: datacenter bots crawling your ads, scrapers harvesting destination URLs, click-farm traffic, competitors draining your daily budget, and automated scripts hammering your redirects to probe or abuse an offer.

It hurts in three specific ways:

• Wasted spend. If you're buying traffic on a CPC basis, every bot click is money you paid for a visitor who will never convert. Fraud inflates your cost per acquisition and quietly eats margin on campaigns that look fine on the surface.
• Dirty data. Bots distort every metric you use to make decisions — click counts, click-through rates, geographic breakdowns, device splits. If 30% of your clicks are non-human, your conversion rate is understated, your "best" geo might be a datacenter, and your A/B test winner might be noise. You end up optimizing toward fraud.
• Payout risk. Affiliate networks watch for invalid traffic. A flood of bot clicks with a near-zero conversion rate is exactly the pattern that triggers a manual review, a clawback, or a suspended account. Clean traffic protects your relationship with the network as much as your budget.

There's a compounding effect, too. Dirty data leads to bad decisions, bad decisions lead to more spend on fraudulent channels, and more spend attracts more fraud. A campaign that looks profitable on paper can be slowly bleeding you because a chunk of its "engagement" is automated. By the time the network flags your invalid traffic, you've already scaled the problem. The only way out is to measure clean from the start.

The fix isn't to guess. It's to score every click against known fraud signals, act on the score automatically, and keep the junk out of the data you actually report on. That's what ShortlyLink does at the redirect layer, before a click ever counts — and because it happens on the redirect itself, it protects every destination behind your links without you touching your landing pages or offer setup.

How does ShortlyLink score each click for fraud?

Every click through a go.shortlylink.com short link is scored on a 0–100 scale at redirect time. The score is built up from independent signals, so a click that trips several of them climbs fast toward the higher-risk tiers. The signals are:

• Known bot user agents. ShortlyLink uses the isbot detection library to flag user agents that identify as crawlers, monitors, and known automated clients.
• Missing or inconsistent headers. Real browsers send a predictable, consistent set of HTTP headers. Requests with absent or contradictory headers look automated and score higher.
• Scripting user agents. Requests that announce themselves as curl, wget, python-requests, or a headless browser are classic automation signatures and are scored accordingly.
• Rapid clicks. When the same visitor fingerprint fires 8 clicks within 10 seconds, that velocity is treated as a strong fraud signal — no human taps a link eight times in ten seconds.
• Geographic "impossible travel." If the same fingerprint appears in a different country within roughly 10 minutes, that's physically impossible for one person and points to a rotating proxy or bot network.

A note on how the fingerprint works, because it matters for privacy: ShortlyLink does not use cookies or localStorage for click tracking. The visitor fingerprint is a one-way, server-side hash. It's enough to spot the same source clicking eight times in ten seconds or teleporting across borders, without storing anything on the visitor's device or tracking them across the web. See our features page for more on the privacy-first tracking model.

These signals are additive rather than a single yes/no verdict. A request that merely looks slightly unusual might earn a low score and pass through as normal traffic. A request that trips several signals at once — a scripting user agent and missing headers and eight clicks in ten seconds — stacks quickly into the block tier. This layered approach is what lets ShortlyLink separate a marginally odd but genuine visitor from an obvious bot, instead of treating every anomaly as an all-or-nothing block.

To avoid punishing traffic you trust, UA and IP allowlists short-circuit the whole thing to a score of 0. If you have a monitoring service, an internal tool, or a partner's server that legitimately hits your links, allowlist it and it skips scoring entirely. This keeps your own infrastructure and trusted partners out of the fraud counts, so a scheduled uptime check or an internal link tester never looks like an attack.

What are the risk tiers, and what happens at each one?

The 0–100 score maps to four risk tiers. Each tier decides what happens to that click in real time:

Score range	Tier	What happens
Under 40	Normal	Clean traffic. Redirects normally, counts in your stats.
40 and above	Log	Redirects normally, but the click is flagged and logged for review.
70 and above	Challenge	Served a signed, ~2-minute JavaScript challenge. Non-JS bots fail and never reach your destination.
90 and above	Block	Served a 403 page. Recorded for the record, but excluded from your stats.

A few things worth understanding about the top two tiers:

The challenge tier (70+) serves a short, signed JavaScript challenge that stays valid for about two minutes. A real browser runs the JavaScript and passes through transparently. A bot that doesn't execute JavaScript — which is most of them — simply fails and never touches your offer. It's a lightweight gate that filters out the bulk of cheap automation without blocking a genuine person.

The block tier (90+) returns a 403 page. Critically, blocked clicks are still recorded — you can see them — but they're excluded from your stats automatically. That's the whole point: the fraud is visible for auditing, but it never contaminates the click counts, conversion rates, or geo breakdowns you actually optimize against. Bot traffic is stripped out of your dashboards and your CSV/JSON exports by default.

Because each click carries its fraud score and risk tier as part of its captured data — right alongside its geo, device, referrer, UTMs, and bot flag — you can filter and review traffic by tier whenever you want to understand what's being caught.

How does ShortlyLink catch attacks in progress?

Per-click scoring handles individual bad clicks. But coordinated abuse — a botnet firing at one link, or a sudden invalid-traffic spike from a bad placement — shows up as a pattern, not a single click. ShortlyLink runs an anomaly job every 5 minutes to catch those patterns and alert you:

• Traffic-spike alert: raised when recent clicks exceed 10 and run more than 3× the trailing 5-minute average. This flags a sudden, abnormal surge — the signature of a burst attack or a placement gone wrong.
• Bot-surge alert: raised when there are more than 5 bots and bots make up more than 50% of recent traffic. This catches the case where a link is being hit primarily by automation.

When either fires, you get an alert in your in-app feed and, if you've connected it, on Slack. That's early warning: you can pause a campaign, swap a placement, or tighten an allowlist before a bad source runs up your bill or drags a report through the mud. Anomaly events are also available as webhooks, so you can wire them into your own tooling.

The one gotcha: don't test your own link with curl

This trips up almost everyone the first time. If you run something like curl https://go.shortlylink.com/yourcode to check that a link works, curl announces itself as a scripting user agent — which is exactly the signal the fraud system is built to catch. Your test request scores straight into the block tier and returns a 403. The link is fine; the protection is doing its job.

To test a real link:

• Open it in an actual browser, where it behaves like any human click.
• Or add your own IP or user agent to the allowlist, which short-circuits the score to 0 so your checks pass through.

It's counterintuitive at first, but it's a good sign — if your own scripted request gets blocked, so will a scraper's.

Putting it together: a clean-traffic workflow for affiliates

Fraud protection isn't something you configure once and forget. Here's how the pieces fit into a working affiliate setup:

1. Let scoring run by default. Every link you create is protected automatically — there's nothing to switch on. Normal traffic redirects normally.
2. Allowlist what you trust. Monitoring tools, partner servers, and your own testing IP go on the UA/IP allowlist so they don't get caught in the net.
3. Report on clean data. Because bot traffic is excluded from stats automatically, the conversion rates and geo breakdowns you optimize against — and export to your network — reflect real humans.
4. Watch the alerts. Connect Slack so traffic-spike and bot-surge alerts reach you in real time, and act on them fast.
5. Protect your payouts. Clean, defensible traffic is what keeps affiliate networks paying you. When a network questions your traffic quality, per-click fraud scores and excluded-bot records give you the audit trail to back it up.

For more on how tracking, conversions, and bot filtering work together, see our FAQ.

Click fraud is a cost of doing business in paid affiliate traffic — but it doesn't have to be your cost. ShortlyLink scores it, tiers it, blocks the worst of it, and keeps the rest out of your numbers, automatically, on every link.

Ready to run cleaner traffic? Start free at /register — no credit card, limited beta spots.