Czechia and Seychelles spam Google Analytics traffic blocked with Cloudflare


In August 2022, my classic Google Analytics started to show increased traffic to my kid’s activity blog. Unfortunately, the traffic was from Czechia and Seychelles with 100% or 99.72% bounce rates. Disappointingly, the bump was not from real traffic.

100% bounce rate of traffic from Czechia and 99.72% from Seychelles in Google Analytics Classic.

With some research, I found that Analytics 4 doesn’t track this fake traffic, so this appears to be another reason to move over to the new analytics before the July 2023 deadline. According to Google, “Universal Analytics will no longer process new data in standard properties beginning July 1, 2023. Prepare now by setting up and switching over to a Google Analytics 4 property.”

But, until I move over, I still wanted to stop this fake traffic. If you use Cloudflare, you’re in luck. (If you don’t, Cloudflare is free and might be worth checking out!) Thanks to the write-up by MightyGadgets, I implemented a quick solution using Cloudflare. Here’s what I did:

Managed Challenge via Cloudflare

  • Go to Cloudflare > Security > WAF
  • Create a new firewall rule. I named mine “Czechia and Seychelles Challenge”
  • Make your first rule
  • Choose Field = Country, Operator = “equals” and Czech Republic (for Czechia)
  • Next choose OR
  • Make your second rule: Choose Field = Country, Operator = “equals” and Seychelles
  • Next, choose your action from the dropdown. Choose Managed Challenge.
  • Finally, Deploy your firewall rule (blue button in the bottom right)

Here’s a screenshot of what my Security rule for this managed challenge looks like.

WAF (Web Application Firewall) rule to show managed challenge for visits from Czechia and Seychelles.


After 24 hours, I checked back to see how this managed challenge for Czechia and Seychelles was working. I had 20 challenges issued and 0 challenges solved.

Screenshot of Cloudflare's Security Managed Challenges to block spam from certain countries.
During the first day, Cloudflare’s managed challenge blocked 20 attempts to access the website from Czechia and Seychelles. No bots solved the Cloudflare challenges, confirming this traffic was not from actual users.

So, how does the Cloudflare Challenge work?

CloudFlare’s docs share the details of Cloudflare managed challenges, but in general, they are a challenge that might include:

  • A non-interactive challenge page,
  • An invisible proof of work challenge to the browser,
  • A custom interactive challenge (such as click a button), or
  • A CAPTCHA challenge.

Essentially managed challenges help to stop bots from accessing your site, but allow actual users to access your site still.

My specific managed challenge rule for Czechia and Seychelles keeps the tracking in Google Analytics from showing users from these two countries that stay 0 seconds and have a 100% bounce rate. Nice!

You might be interested in another article about “What to expect as your blog traffic grows.”

Happy Web Designing!

About the author

Kelly Barkhurst

Designer to Fullstack is my place to geek out and share tech solutions from my day-to-day as a graphic designer, programmer, and business owner (portfolio). I also write on Arts and Bricks, a parenting blog and decal shop that embraces my family’s love of Art and LEGO bricks!

Add comment

Recent Posts