We investigate the statistics of flux anomalies in gravitationally lensed quasi-stellar objects as a function of dark matter halo properties such as substructure content and halo ellipticity. We do this by creating a very large number of simulated lenses with finite source sizes to compare with the data. After analysing these simulations, we conclude the following. (1) The finite size of the source is important. The point source approximation commonly used can cause biased results. (2) The widely used Rcusp statistic is sensitive to halo ellipticity as well as the lens’ substructure content. (3) For compact substructure, we find new upper bounds on the amount of substructure from the fact that no simple single-galaxy lenses have been observed with a single source having more than four well separated images. (4) The frequency of image flux anomalies is largely dependent on the total surface mass density in substructures and the size–mass relation for the substructures, and not on the range of substructure masses. (5) Substructure models with the same size–mass relation produce similar numbers of flux anomalies even when their internal mass profiles are different. (6) The lack of high image multiplicity lenses puts a limit on a combination of the substructures’ size–mass relation, surface density and mass. (7) Substructures with shallower mass profiles and/or larger sizes produce less extra images. (8) The constraints that we are able to measure here with current data are roughly consistent with Λ cold dark matter (ΛCDM) N-body simulations.