Click fraud protection
Find the addresses that click your ads repeatedly and never buy, then exclude them at campaign level. It takes one tracking tag on your site, installed once.
Why a tag is needed
Google Ads reports tell you a click happened; they do not tell you which visitor it was. To recognise the same visitor clicking eleven times in an afternoon, something has to observe the arrivals on your own site. That is what the tag does: it records the ad clicks that land on your pages, and nothing else.
Until the tag is installed there is no traffic to analyse, so a scan comes back empty. An empty result at this stage means the tag is missing, not that your traffic is clean.
Setup
- Get your tag. Ask your assistant to set up click fraud protection and give it your domain. You get a site key, a one-line script and Tag Manager instructions.
- Bind it to your domain. The domain you pass is part of the tag, which is what stops anyone else pushing fake clicks into your data.
- Install it once on every page, either directly in your template or through Tag Manager.
- Let it collect. A day or two of normal traffic gives the scan something to judge; a handful of clicks does not.
- Scan, then block. The scan is read-only and scores each address from 0 to 100 with reasons. Blocking is a separate, approval-gated step.
How addresses are scored
Scoring combines several signals rather than trusting any single one: repeat clicks and their speed from one address, whether it belongs to a datacenter or hosting provider rather than a home connection, Tor exit nodes, known-malicious lists, bot-like user agents, and high click volume with zero conversions. A high score is a reason to look, not a verdict, which is why nothing is blocked automatically.
Blocking and unblocking
Blocking adds the addresses as campaign-level IP exclusions in Google Ads, exactly as you would by hand. Google allows up to 500 exclusions per campaign. Every block is previewed before it is applied and can be lifted later, so a mistake costs you nothing but a minute.
Troubleshooting
The scan returns nothing. Is my traffic clean?
Probably it just has nothing to look at. Check that the tag is really on the page and that ad clicks have arrived since you installed it. Organic visits are not counted: the tag records ad clicks, so a period with no ad traffic produces no data by design.
Will blocking an address hurt my reach?
Excluding a handful of addresses out of a campaign's audience is not a targeting change and does not shrink your reach in any meaningful way. What it does do is stop that particular source from consuming budget. Blocking wide ranges is a different matter and worth thinking about first.
Does Google refund the fraudulent clicks?
Google runs its own invalid-click filtering and credits what it detects, and that is separate from this. What you get here is the ability to see the pattern yourself and to shut the door, rather than waiting to find out whether an automated filter agreed with you.
Can I use this on platforms other than Google Ads?
The exclusions are written to Google Ads campaigns today. The tag itself records ad clicks arriving at your site whatever brought them, so the analysis is useful more broadly even where the blocking step is not yet available.