ip-exclusions-vs-server-blocking

Because the money left your account before the request ever reached your server. Nothing is misconfigured. You added rules that correctly block page loads for visitors you had already paid for, so the invoice looks the same. To affect spend, the block has to happen at auction time inside Google Ads, not at your edge.

It denies the clicker anything useful, but it sits on the wrong side of the billing timeline just like a firewall rule. The charge already happened. It also adds a risk blocking does not: if you misjudge a genuine buyer, you have shown a real customer a page with no phone number and no form, and nothing in your reporting will ever tell you.

Yes, but for security rather than ad spend. Firewalls are the correct tool against scraping, brute force attempts and crawlers hammering your infrastructure, and they have no entry limit or campaign scoping. Just do not count them as click fraud protection. Run both layers for different jobs and judge each on the problem it was actually built for.

The charge lands when the click registers, which is before the browser requests your landing page. The order runs: auction, ad served, click registered, charge applied, then the page request arrives at your server. Anything you control on your own infrastructure sits at the end of that sequence, which is why server-side measures cannot prevent the cost.

No. By the time a request reaches your firewall, the auction has run, the ad has been served, the click has been registered and you have been charged. Your rule stops the page load, which costs you nothing to serve anyway. Firewall blocking is the right tool for scrapers and abusive crawlers. It does not reduce ad spend.