Our multi-layered approach ensures that every click counted by Linkaway comes from a human visit. Here is how we do it.
In the performance marketing ecosystem, non-human traffic is an unavoidable reality. Bots crawling the web, automated scripts, ad verification tools: at any given time, part of the traffic moving across the internet is not generated by real people.
Every platform on the market faces this challenge. No solution, including ours, can honestly claim 100% filtering. Anyone saying otherwise is misleading you.
What we aim for instead is the highest possible level of filtering by combining several complementary layers of protection. The result: estimated residual bot traffic of under 1% on counted clicks.
We prefer to be honest about the limits inherent to bot filtering rather than promise the impossible. What we can promise instead: constant vigilance, proven mechanisms, and data that is consistently cleaner than what most tracking tools on the market provide.
Each filtering layer is independent and complementary. Overall effectiveness comes from their combined action: what one layer lets through, the next one catches.
The first line of defense relies on a continuously updated database containing all IPs and User Agents known to belong to bots. This blacklist covers major crawlers such as search engines, monitoring tools, security scanners, SEO audit platforms, as well as a broad range of listed malicious bots. On its own, this layer removes around 90% of bot traffic before a click is even recorded.
For bots that are not yet present in known lists, we apply behavioral analysis through fingerprinting. This technique measures technical signals, browser characteristics, browsing behavior, click sequences, interaction speed, and execution environment properties to detect unnatural patterns typical of automated activity. This lets us identify bots we have never seen before by looking at what they do rather than just what they are.
Even when a bot gets past the first two layers, its automated nature usually shows up through hyperactive behavior: multiple clicks on different URLs within a very short time. Our IP deduplication mechanism handles this: during a defined time window, the same IP address can only generate one counted click. In practice, even if a bot clicks dozens of times, it is counted only once, which represents a tiny fraction, estimated at under 1%, of total human click volume.
The vast majority of bots are removed at the first layer. The few sophisticated bots that get past the blacklist are caught by fingerprinting. And the few residual clicks that neither blacklist nor fingerprinting detect are still counted only once thanks to deduplication. The risk of a bot click being counted is therefore reduced to a negligible proportion, far below what standard tracking tools typically allow.
Our filtering approach did not come out of nowhere. It has been built, refined, and validated against real-world data: hundreds of millions of processed clicks, dozens of atypical situations analyzed, and continuous improvement of our detection models.
It is a battle-tested infrastructure, validated at scale every day by more than 200 publishers and 150 advertisers who trust Linkaway to measure performance accurately.
We have compared Linkaway data with internal tracking tools used by some of our publishers. The finding is always the same.
When a publisher has its own internal click-tracking tool and we compare its numbers with Linkaway over the same period, the result is consistent:
One question comes up often: why do Linkaway numbers not match Google Analytics 4 sessions? The answer is simple: they do not measure the same thing.
Linkaway measures clicks: every time a visitor clicks a partnership link and lands on the advertiser's site, Linkaway records a click. It is a unit-level measurement taken on the source side, meaning the publisher side.
Google Analytics 4 measures sessions: a more complex concept calculated on the destination side, meaning the advertiser's site, according to GA4's own logic. GA4 can group several interactions into one session, expire sessions based on timeout rules, or create new ones when the traffic source changes. These two metrics are therefore not comparable and should not be used to validate each other.
One click = one unique visitor who clicked a partnership link and triggered the tracker. A source-side measurement taken on the publisher side, instant, unit-based, and filtered for bots.
One session = a period of user activity on a site that can group several interactions together. GA4 can create several sessions for the same user, or none at all if attribution is lost. It is a destination-side measurement on the advertiser side, influenced by configuration, blockers, consent, and GA4 attribution logic.
Cookie blockers, private browsing, consent refusal, and attribution loss during redirects all mean that GA4 only captures part of real visitor traffic. That is normal, and one more reason not to use GA4 as a comparison baseline for paid or partnership traffic.
Our team can walk you through our technical approach in detail and answer all your questions about Linkaway traffic quality.
Contact us