Invalid traffic is the share of your clicks that could never have become customers, and the figure everybody quotes for it comes from a company selling protection against it, using data now four years old. That does not make the problem imaginary. It makes the number worth handling carefully.
The wasted spend is the smaller half of the damage. The larger half is what happens when invalid traffic converts.
This is for you if your click volumes look healthy and your enquiries do not match them.
What counts as invalid traffic
A wider range of things than the phrase suggests.
Automated crawlers and bots make up part of it, some malicious and plenty routine. Click farms are the deliberate end. Accidental repeat clicks, particularly on mobile, contribute more than people expect.
Then there are competitors checking your adverts, which is neither fraud nor useful, and internal traffic from your own team that nobody excluded.
Lumping all of that under click fraud overstates the malice. Most invalid traffic is not somebody attacking you. It is the ordinary noise of an automated internet, plus a share of genuine abuse.
That distinction matters because the remedies differ. Filtering is cheap. Pursuing fraud is not.
The number everybody quotes, and its two problems
Lunio reports that 8.5% of online traffic is invalid, roughly one click in every 11.7, with Google Ads at 5.5% and other platforms at 17.5%.
Two caveats belong with that figure every time it is used, and they are usually missing.
The underlying data period is May 2022 to May 2023. That is three to four years stale, despite the page carrying a recent update date, and this is a fast-moving area.
And Lunio sells click fraud prevention. The company publishing the statistic sells the remedy for the problem the statistic describes. That does not mean it is wrong, and it means the incentive runs one direction.
I have looked for an independent measurement with a disclosed methodology and found none. So the honest position is that the best available figure is stale, vendor-published, and better than nothing.
Why the second-order damage is worse
Wasted clicks are annoying. Wasted clicks that convert are expensive for months.
If a bot fills in your form, that submission counts as a conversion. Your smart bidding then studies whatever conditions produced it and goes looking for more. Placements, times of day, audience characteristics, all learned from noise.
So the problem compounds rather than sitting still. You are not only miscounting, you are actively training the account to pursue the thing that is miscounting you.
That is the case for treating invalid traffic as a tracking problem rather than a security one. The click costs you once. The corrupted signal costs you every day until somebody notices.
What the platforms already do
Both major platforms filter and refund, which is worth knowing before buying anything.
Google and Meta run their own invalid click detection and credit back what they identify. That happens automatically and you can see the deductions in your billing.
The unanswerable question is what proportion they miss. Neither publishes a detection rate, and there is no independent audit of either system that I can find.
So you are left comparing a vendor’s alarming figure against a platform’s undisclosed one. Neither party has an incentive to be conservative in the direction that would inconvenience them.
Which points at measuring your own rather than adjudicating between two interested claims.
How to measure invalid traffic yourself
Look for the signature, not a percentage. Five things that show up in your own data.
Sessions with essentially zero time on site, in volume, from a consistent source. One is nothing. A pattern is a pattern.
Repeat clicks from the same source in a short window, which your analytics will show if you look at the right dimension.
Traffic at implausible hours for your market, particularly a steady overnight trickle that does not match your daytime shape.
Conversions where the details contradict each other, with a name, email domain and phone number belonging to three different countries.
And a conversion rate that jumped without any matching change in traffic or offer, which is the signal most often mistaken for good news.
The cheapest effective fix
Fire your conversion event after validation, not on form submission.
If the event fires the moment somebody presses the button, you have counted the junk before you filtered it, and the optimisation damage is already done. Firing after your checks means the platform never learns from a submission you rejected.
That single change protects the expensive half of the problem. It costs a developer an afternoon and no ongoing fees.
Beyond that, a honeypot field and a timing check catch a large share of automated submissions for similarly little. Save the heavier tools for a genuine flood, because visible challenges cost you real enquiries, particularly on mobile and for anybody with an accessibility need.
Trading real leads for tidier reporting is usually a bad deal.
Before you buy anything
Three questions, in order.
What is your own rate? Pull your last two hundred submissions and mark the junk. That percentage is worth more than any published figure and it takes an hour.
What is it actually costing you, in wasted spend and in corrupted optimisation? Those are different numbers and the second is usually larger.
And does the cheap fix close enough of the gap? For many accounts, validation before the conversion event plus basic form defences handles most of it, and the software is solving a problem you no longer have.
Buy the tool if the arithmetic supports it. Do the arithmetic first.
Why invalid traffic gets overstated and understated at once
Both errors run simultaneously in this topic, which is unusual and worth understanding.
It gets overstated by the companies selling protection, whose published figures are the only ones widely available and whose commercial interest points one way. Every alarming percentage you have read traces back to that group.
It gets understated by advertisers, because the wasted click is small and visible while the corrupted optimisation is large and invisible. People look at the refund on their bill, decide the exposure is manageable, and never account for the months of bidding trained on junk.
So the sensible position sits between two poles that are both wrong for different reasons. The spend loss is usually modest. The signal damage is usually larger than anybody has measured, including me.
That asymmetry is the argument for the cheap structural fix rather than the expensive monitoring one. Stopping junk from ever entering your conversion signal removes the large invisible cost, whatever the size of the small visible one.
What to change this week
Three steps.
Mark up your last two hundred form submissions and calculate your real junk rate. That is your number, and it replaces every benchmark in this article.
Then move your conversion event to fire after validation rather than on submission, which protects the optimisation signal.
Then recalculate your cost per lead using genuine enquiries only, and use that figure from now on, because the previous one was never real.
Lead form spam covers the form defences in detail, what conversion numbers actually measure is the counting underneath, incrementality testing is how you would establish what any of this traffic was worth, and UTM parameters is how you keep sources separable enough to spot a pattern. Fixing the firing order is usually Google Ads work and site work together. To have your traffic quality reviewed, book a teardown.