Invalid traffic is the quiet tax on every ad-funded site. It inflates your pageview counts, pollutes your analytics, wastes the impressions your advertisers pay for, and — the part that actually ends businesses — puts your ad-network account at risk of suspension. This guide explains what invalid traffic (IVT) really is, the two classes you need to understand, and where it leaks money out of a publisher's P&L.
The definition that matters
Invalid traffic is any ad request or interaction that doesn't come from a genuine, interested human. The IAB and the Media Rating Council formalize it as GIVT (General Invalid Traffic) and SIVT (Sophisticated Invalid Traffic) — and the distinction is not academic. It dictates how hard the traffic is to catch and what you can safely do about it.
GIVT — General Invalid Traffic. The obvious stuff. Declared bots and crawlers, headless browsers driving automation frameworks, data-center IP ranges, known-bot user agents, traffic with no rendering and no interaction, and requests that leave a clear technical tell (a webdriver flag, a tampered native function, an automation global, a honeypot hit). GIVT is mechanical. It doesn't try to look human, so it can be identified with high confidence and zero collateral damage.
SIVT — Sophisticated Invalid Traffic. The expensive stuff. Bots that egress through residential or mobile proxies so the IP looks like a real consumer on home broadband or 4G, scrub every hard tell, present a fully coherent browser fingerprint and user agent, inject a synthetic mouse-move or scroll to defeat the "no interaction" rule, and rotate identities to stay anonymous. Per request, SIVT can look identical to a real human. That's the whole point of it.
Why it drains revenue — four leaks
1. Wasted impressions and a corrupted RPM
Every invalid pageview that gets an ad consumes inventory that should have gone to a real reader. Your fill rate and impression count look healthy, but a chunk of them never had a human on the other end. Over time this depresses your true RPM and trains your own optimization (header bidding floors, A/B tests, content decisions) on noise.
2. Clawbacks and advertiser trust
Advertisers and DSPs run their own IVT detection downstream. When they flag invalid impressions sourced from your inventory, the result is clawbacks, lower bids, or quiet de-prioritization in the auction. You don't get an email — your eCPM just sags and you never see the reason.
3. The account-ban risk (the one that ends sites)
This is the failure mode that keeps publishers awake. Ad networks — AdSense above all — monitor your traffic for invalid activity, and they don't issue warnings proportional to severity. A spike of invalid clicks or impressions, especially click fraud aimed at your own ads (or aimed by a competitor at your account), can trigger a suspension. For a site whose revenue is 100% ad-funded, an account ban isn't a dip. It's the business, gone, often with the final payout withheld. Protecting the account is frequently worth more than the few dollars of blocked invalid impressions.
4. Polluted analytics → bad decisions
Bots don't bounce like humans, don't convert like humans, and don't read like humans. When 10-30% of your "audience" is invalid, every downstream number — session duration, top content, geo mix, funnel rates — is contaminated. You end up optimizing for an audience that was never going to buy anything.
Why the usual defenses fall short
Counting traffic after the ad has already served is too late — the impression is spent and the invalid click is already on your account's record. Pure IP blocklists go stale within days and miss residential-proxy traffic entirely. And the most dangerous mistake is over-blocking: a filter aggressive enough to catch sophisticated bots will inevitably block real humans on a VPN, on mobile carrier NAT, or in a privacy browser. Blocking a real reader is the worst outcome there is — it's lost revenue and lost trust, with no upside.
How PubSentry approaches it
PubSentry is built around one move: block-before-serve. A single async JavaScript tag scores each visitor locally in under 5 milliseconds and suppresses the ad call before it fires when the request is invalid — across GPT, AdSense Auto Ads, Amazon apstag, and Prebid, with a universal fallback for everything else. Nothing reaches the auction, so there's no wasted impression and no invalid click to defend.
Server-side, the request is enriched (datacenter/ASN/geo from an offline IP dataset), scored by the same shared engine, and persisted to power your dashboard. Raw IP and user-agent are hashed with HMAC-SHA256 and then dropped — never stored in the clear. The engine reads 28+ live browser signals, runs a high-value subset of ad-setup and content-policy checks, and classifies suspicious clicks, all explained per event so you can see why a verdict landed.
The honest part
We hold to a hard principle: a false-positive rate of zero comes first. We will not block a real human to catch a bot. Because of that, here is the honest detection boundary:
- Obvious / GIVT invalid traffic: caught at near-100% recall with zero false positives. Anything that leaves a tell, we stop, and we don't touch real readers doing so.
- Sophisticated / SIVT mimicry: only partially caught by deterministic rules today — by design, because the per-request signals are genuinely indistinguishable from a human's. This is where the cross-site reputation network, velocity-and-anomaly detection at scale, and the ML layer close the gap as the network grows.
We will never tell you we stop 100% of fraud. Anyone who does is either over-blocking real humans or not measuring honestly. What we will do is stop the obvious invalid traffic cleanly, protect your account from the clicks that get sites banned, and get sharper at the sophisticated stuff over time.
Where to start
You don't need to take the claim on faith — you can watch it run on your own traffic. PubSentry installs as one tag, with no SDK and no WordPress plugin:
<script async src="https://pubsentry.com/t.js" data-site="st_xxxx"></script>Start free — 500 pageviews, every detection and AI feature included, no card required. Drop in the tag, watch the verdicts land in real time, and see exactly what your site has been quietly paying for. Start free at app.pubsentry.com.