Protection guide by Mark Parfenov, published 10 November 2026
Bots fill in forms, click ads and inflate your numbers. The damage is real: wasted ad budget, a CRM full of junk, sales time spent on fake leads and, worst, ad platforms learning to find more of the same. These are the protections I set up.
Watch for sudden jumps in clicks or form fills with no matching sales, leads with made-up names or disposable email addresses, phone numbers that don’t work, many submissions from the same place in minutes, and visits that leave within a second.
Use a hidden honeypot field that people don’t see but bots fill in, a check on how fast the form was completed, and a bot check such as Cloudflare Turnstile or reCAPTCHA where spam is heavy. Prefer options that don’t make real visitors solve puzzles.
Cap how many submissions one address, device or email can send in an hour or a day, on the server, not just in the browser. I build these limits into every form, so a spam run can’t flood your inbox or your CRM.
Validate email addresses and phone numbers on submission, block disposable email domains where it makes sense, and require a real phone number for high-value inquiries.
Exclude placements and apps that send junk clicks, avoid display and search partner networks until search alone works, set location targeting to people actually in your area, and review placements and search terms weekly. Google and Microsoft refund some invalid clicks automatically; check the invalid clicks columns in your reports.
Ad platforms optimise toward whatever you count as a conversion. Count qualified leads or sales, not every form fill, and send back only real outcomes from your CRM. Otherwise the platform learns to bring you more fake leads.
Exclude known bot traffic and internal visits in GA4, compare form fills with CRM records, and judge channels on leads that became customers.
Services such as Cloudflare can block known bad bots, challenge suspicious traffic and limit request rates before they reach your site, while letting search and AI crawlers you want through.
What I’ve learned and use in practice, checked against current benchmarks and official checklists on 10 November 2026. Experience and benchmarks, not guarantees.
Not zero bots, which is impossible, but forms that stay clean, ad budgets spent on people, and numbers you can trust. Most of this costs little once it’s set up, and it saves a lot of wasted time and spend.
The first call is free. The diagnostic (€950, fixed) finds where your leads and deals are lost and gives you the fixes in priority order.