Affiliate Click Fraud: How Bots Pad Your Click Counts

Click fraud on an affiliate site rarely looks like a heist. It looks like a link with 900 clicks and no orders. Because you are not paying per click, fake clicks cost you clarity before they cost you money: they inflate your totals, flatten your conversion rate, and quietly hide which placement is actually earning. Most of them are not even malicious, just automation doing what automation does.

Here is what forged clicks look like in real reports, who is generating them, why the usual click counter believes them, and how to get a number you can make decisions on.

What Click Fraud Looks Like on an Affiliate Site

The symptoms are consistent enough to recognise. Clicks climb week over week while earnings sit still. One link collects hundreds of clicks and zero orders while a similar link converts normally. Clicks cluster at hours when your audience is asleep, or arrive from countries you have no readership in.

The clearest tell of all is arithmetic: more clicks than pageviews on the page holding the link. A person has to load the page before they can press the button, so when the click count outruns the view count, something is reaching the link directly.

Who Is Actually Clicking

Usually nobody, in the human sense. Search crawlers and AI harvesters follow every link they find. Chat apps and social platforms fetch URLs to build preview cards, sometimes several times per share. Uptime monitors and security scanners walk your site on a schedule. Content scrapers copy your posts and drag every link along with them. On top of that sit residential-proxy floods, which are the hardest to spot because each individual request looks ordinary.

Cloaked affiliate links attract a disproportionate share of this. If your links live under one predictable folder, that folder is an obvious thing to crawl exhaustively. It is also the one case in redirect management where a pattern rule earns its keep, which we cover in regex redirects in WordPress.

Why Your Click Counter Believes Them

Most click counting runs in the browser: a script listens for the click and reports it. That design gets it wrong in both directions. A crawler that fetches your affiliate URL directly never runs the script, so it slips past unrecorded, while a headless browser executes the page perfectly and gets counted as a person. Meanwhile a real reader with an ad blocker has the script stripped and their genuine click vanishes, which is why ad blockers break click tracking.

Counting on the server fixes the visibility half of the problem, because every hit on the redirect is recorded whatever the client is. It does not fix the judgement half. A server-side counter with no classification simply records more of everything, including all the automation.

The Damage Is Mostly Decisions

Start with the decisions, because that is where the loss compounds. Padded clicks tell you a placement works, so you build more like it. A comparison table looks like your best performer, so it gets more of your writing time. Your click-through rate becomes uncomparable between pages, because each page carries a different amount of automation.

The numbers can be extreme on quiet sites. On a small store we run, the last 30 days brought 11 human visitors and 2,770 bot hits, and the bots produced 1,510 click events while humans produced none at all. A counter with no human and bot split would have reported 1,510 clicks on a site with 11 visitors. On a busier affiliate site of ours the ratio is less dramatic but more expensive to misread: about 58% of all hits were automated.

Then there is program risk, which is smaller but real. Affiliate programs look at clicks against conversions, and Amazon’s own operating agreement and policies set out what counts as artificially generated activity. Crawlers finding your links is not that. Auto-firing links on page load, prefetching them, or asking people to click is, so keep your own setup clean and the rest is explainable.

The Signals That Give a Forged Click Away

No single check is enough, so classification stacks several. A verified crawler signature identifies known search, SEO and AI bots outright. An insufficient device profile, where the request cannot even report a coherent browser, operating system and device type, marks the stripped server-shaped hits. Automation flags catch headless browsers that otherwise look perfect. Scripting-tool signatures catch curl, wget and the scraping libraries. A datacenter network is a strong signal against a server-to-server hop, though never on its own, because a real person on a VPN is still a real person. Scanner probe paths mark the vulnerability sweeps.

For affiliate links specifically, one more check does most of the work: a click with no prior human pageview from that visitor. A cloaked link only exists as a button inside a page, so a click that never followed a page view did not come from a person pressing it. The honest limitation is that a reader who blocks the tracker entirely and then clicks can land in the bot column, a deliberate trade to keep forged clicks out. Telling bot traffic from real visitors walks through the wider signal set.

What to Do About It

Filter, do not block. Blocking is tempting and usually backfires: aggressive rules catch search crawlers you want, and eventually a real buyer on an unusual network. Classifying every hit and keeping both columns visible costs you nothing and leaves the decision with you. It also means a spike becomes information rather than a mystery, since you can see whether last Tuesday was readers or a scraper.

That is the model DevDome Analytics is built on. Clicks on tracked links are captured server-side so an ad blocker cannot delete them, every hit is classified with the six signals above, humans and bots are reported separately rather than blended, and plans are metered on human pageviews only, so automated traffic never costs you allowance. If you want the wider context first, what percentage of website traffic is bots sets the baseline, and our plans include a free tier to check your own split.

A Clean Click Count Changes What You Optimize

Once the split is visible, the numbers start behaving like numbers again. Click-through rates become comparable between pages. A placement that looked strong on raw clicks can turn out to be mostly crawler traffic, and a quiet one can turn out to convert. Earnings per human click becomes a figure you can actually track over time.

None of this stops the automation, and nothing will. What it does is stop the automation from voting on your content strategy, which is the part of affiliate click fraud that costs real publishers the most.