# Block Click Fraud - Full Content > Google Ads click fraud protection for WordPress sites. Block Click Fraud checks every paid Google Ads click, flags bots and repeat clickers with the reason, and adds those sources to the advertiser's Google Ads IP exclusions automatically. --- ## High Google Ads Click Rate, Low Conversions: What the Pattern Means URL: https://blockclickfraud.com/high-click-rate-low-conversions.md A high Google Ads click rate with low conversions means your ad is winning attention but something between the click and the lead is failing. Usually the ad promises something the page doesn't deliver, the clicks come from people who were never buyers, some clicks aren't from real people, or conversion tracking quietly broke. Click rate only measures how often people click after seeing your ad, so it can look great while the campaign loses money. ## What Google Ads click rate measures, and what it doesn't Google defines clickthrough rate as clicks divided by impressions. A high CTR suggests people find your ad relevant to what they searched, and CTR feeds into expected CTR, which is part of Ad Rank. That is useful. A strong click rate can help your ads show more often and in better positions. What CTR doesn't tell you is whether any of those clickers wanted to buy. Google's own definition stops at the click. It says nothing about calls, forms or sales. Google also says what counts as a good CTR depends on what you advertise and where. If you want context on that, see our guide to a good click-through rate in Google Ads. The point here is different: a high click rate is a measure of the ad, not the business result. ## Four reasons a high click rate doesn't turn into leads ### 1. The ad promises what the page doesn't deliver An ad that says "free consultation today" sends people to a page that buries the phone number under three paragraphs. An ad for a specific service lands on a generic home page. The click happens because the ad is compelling. The conversion doesn't happen because the visitor can't find what they were promised. This is the most common cause and the cheapest to fix. ### 2. Clicks from people who were never buyers Some real humans click with no intention of buying. Job seekers, students, people looking for free information, and competitors checking your offer. Loose keyword matching makes this worse, because your ad can show for searches that are related to your service but not the same thing. Your search terms report will show these queries. Add them as negatives. Our guide to negative keywords and click fraud covers where negatives help and where they stop helping. ### 3. Some clicks aren't from real people Automated traffic and click farms can raise click rate directly. They generate clicks at a rate no real audience would, and they never convert. Google filters invalid traffic and doesn't charge for what it catches before billing, but anything that slips through counts toward both your CTR and your bill. See bot traffic in Google Ads and headless browsers and fake user agents for how sophisticated automated traffic gets past basic checks. ### 4. Conversion tracking broke Sometimes the leads are there and Google Ads just isn't recording them. A redesigned thank-you page, a new form plugin or a theme update can stop a conversion tag from firing. Click rate stays high, conversions fall to near zero, and your inbox looks the same as always. Submit a test lead and check whether it registers. ## A quick diagnostic table Likely cause What you see First check Ad and page mismatch Normal session length in GA4, few form starts, visitors leave the landing page fast Read the ad, then the page, as a searcher would Non-buyer humans Search terms full of "free," "jobs," "how to" and other off-target queries Search terms report Non-human clicks Clicks far above GA4 paid sessions, very short visits, repeat IP addresses in logs Invalid clicks column, server logs Broken tracking Conversions drop on one date, real leads in your CRM stay steady Submit a test conversion If you are seeing spend climb as well, the overlapping pattern is covered in why your Google Ads per click spend climbs without more leads. ## Reading the landing page report Google Ads has a Landing pages page that breaks down performance for the pages your ads send traffic to. Google says you can find it under Campaigns, then Insights and reports, then Landing pages. It shows clicks, impressions and CTR per page, along with mobile-friendly click rate and valid AMP click rate. Use it to answer two questions. First, which pages are getting the clicks? If most traffic goes to one page, that page deserves your attention before anything else. Second, does that page work on mobile? Google says a mobile-friendly click rate below full marks means the page isn't consistently passing its mobile checks. A page that breaks on phones will lose leads no matter how good the ad is. Then cross-check in GA4. Look at the same landing pages for paid traffic and compare engagement and key events. A page with plenty of Google Ads clicks and almost no engaged sessions in GA4 is either failing visitors or receiving visitors who aren't real. ## What invalid clicks look like in the numbers You can't see individual bot clicks in Google Ads, but you can see their shadow. Things to look for in your own account: - CTR jumps sharply on a campaign or ad group while impressions barely change. - Clicks cluster in odd hours or unexpected locations. - Google Ads clicks run well ahead of paid sessions in GA4 for the same period. - Paid sessions are extremely short, with no scrolling or interaction. - The same IP addresses appear in your server logs from ad clicks over and over. - The Invalid clicks column, which you can add to your campaigns table, rises at the same time. None of these prove fraud alone. Two or three together are a strong reason to dig further. Google lets you request an investigation through the Click Quality Form for activity within the last 60 days. ## What to fix first Go in order of cost and speed: - **Tracking.** A test lead takes minutes. If tracking is broken, every other conclusion you draw is wrong. - **Ad and page match.** Make the page deliver the exact thing the ad promised, with the phone number and form visible right away on mobile. - **Search terms.** Add negatives for queries from people who will never buy. - **Traffic quality.** Check logs for repeat and automated sources, and exclude the ones you can show are bad. Resist the urge to lower your click rate on purpose. A high CTR is fine. The goal is to make the clicks you already get worth paying for. If you want every paid click checked and bad sources excluded automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Is a high Google Ads click rate a good sign? It means your ad is relevant enough for people to click, and it feeds into expected CTR, which affects Ad Rank. It says nothing about whether clickers become customers. Judge the campaign on leads and sales, not CTR alone. ### Can bots raise my click rate? Yes. Automated traffic that gets past Google's filters is counted as clicks, which raises CTR and costs you money. Those clicks never convert, so you see a high click rate with weak results. ### Where do I find the landing pages report in Google Ads? Go to Campaigns, then Insights and reports, then Landing pages. It shows clicks, impressions and CTR for each page your ads send traffic to, plus mobile-friendly click rate. ### How do I know if my conversion tracking stopped working? Look for conversions dropping on a specific date while clicks stay normal. Check whether real leads still arrive in your inbox or CRM. Then submit a test lead and see if Google Ads records it. ### Should I rewrite my ad if click rate is high but conversions are low? Usually the page needs work before the ad does. The ad is doing its job if people click. Make sure the landing page delivers what the ad promised, then check traffic quality and tracking. ## Sources - Clickthrough rate (CTR): Definition, Google Ads Help - Evaluate the performance of your landing pages, Google Ads Help - About the search terms report, Google Ads Help - About invalid traffic, Google Ads Help --- ## How to Report Click Fraud to Clients Without Losing Trust URL: https://blockclickfraud.com/report-click-fraud-to-clients.md To report click fraud to clients without losing trust, lead with a number they can open in their own Google Ads account, say plainly what you confirmed and what you only suspect, and include the fix in the same message. Do the review before you write anything. Clients rarely get upset that fraud exists. They get upset when the explanation is vague or late. ## Run the review before you write a word The worst click fraud email is the one sent on a hunch. The client asks how much money was lost, and you have no answer. So do the work first. Pull the date range in question and look at clicks, cost and conversions by day. Add the Invalid clicks column to the Campaigns table through the columns menu, so you can see what Google already filtered. Then compare the ad data against what actually landed on the site: server logs, form submissions, call records. If you need to tie ad clicks to addresses, how to find IP addresses behind fraudulent clicks covers the basics. By the end you should be able to answer three questions. What happened? How sure are you? What have you already done about it? A problem with a fix attached is a status update. A problem without one is a scare. ## Open with the number the client can see in their own account Start the report with something the client can check without you. The Invalid clicks figure for the period is a good choice. So is an "Invalid activity" adjustment on the Billing summary page, where Google lists credits for invalid traffic it found after billing. These numbers come from Google, not from you. When the first number is one they can verify, everything after it gets read with less suspicion. When it comes from a tool they have never heard of, they wonder whether the tool exists to justify your fee. Then move to what Google did not catch. ## Separate what you confirmed from what you only suspect Most reports fail here. They lump every odd click into one alarming total. A client who later learns many of those clicks were real prospects will discount everything you say after that. Use three plain labels and keep them the same every month: - **Clean:** clicks that look like normal prospects. Most traffic should sit here, and saying so builds credibility. - **Suspect:** clicks with something odd about them that you have not confirmed. You are watching these, not blocking them yet. - **Fraud:** sources you are confident are not genuine, such as automated traffic or one source clicking again and again with no sign of intent. These get blocked. Put a reason next to every suspect and fraud item. "Same address, repeated clicks over two days, no form fill, no call" is a reason. "Bad traffic" is not. ## Bring the fix in the same message Never send the problem in one email and the solution next week. In the same message, say what you blocked, where you blocked it, and when. For Google Ads that usually means IP exclusions. Google allows up to 500 IP addresses per campaign, and an asterisk can replace the last digits to exclude a block, for example 123.45.67.*. Campaign-level IP exclusions are not available for video, hotel, app, Performance Max and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max. If the client runs Performance Max, say which level you used. The Google Ads IP exclusions guide covers both levels. Also name anything else you changed, such as a tighter location setting or new negative keywords. ## A one-page structure to report click fraud to clients One page is enough. This layout works for the first report and every month after it. Section What goes in it Example line Period and spend Dates covered, total clicks, total cost "1 to 30 September, clicks and cost from the account overview" What we found Clean, suspect and fraud counts, each with a reason "Fraud: repeat clicks from one address range, no leads" What we blocked Addresses or ranges added, campaign or account level, date "Added to account-level exclusions on 12 September" What changed Settings or targeting you adjusted "Location option switched to Presence" What we cannot fix Known gaps, stated plainly "The first click from a new source is still paid for" What we need Decisions or information from the client "Please confirm whether these three leads were real" The last two rows are the ones agencies skip. They are also the ones that protect you later. ## Put the limits in writing in the first report No method stops every bad click. Blocking happens after a source has been seen, so the first click from a new address is usually paid for. Exclusions cover addresses, not people, and anyone who switches networks comes back with a new one. Write these limits into the very first report, before anything goes wrong. A limit you disclosed in month one is a known trade-off. The same limit, explained only after the client spots a problem, sounds like a cover story. ## Handle the refund question as a process, not a promise The client will ask whether they can get their money back. The honest answer: sometimes, partly, and not on your schedule. Google does not charge for invalid traffic its filters catch before billing. When it finds invalid activity after billing, it issues a credit in the next billing cycle where appropriate and possible, shown as an "Invalid activity" adjustment on the Billing summary. For anything Google missed, you can request an investigation with the Click Quality Form. It covers only the last 60 days, so do not sit on a problem. Include the customer ID, date range, campaign and ad group names, the keywords involved, and server log details such as IP addresses and GCLIDs. Google will not confirm which specific clicks it judged valid or invalid. Tell the client what you will file, when, and that any credit is Google's decision. Never forecast an amount. The guide to Google invalid click refunds goes through the form step by step. ## Make monthly reports boring, and hand over cleanly After the first report, aim for dull consistency. Same structure, same labels, same order. When a client can scan the page in a minute and see mostly clean traffic and nothing new to fix, they relax. If fraud jumps one month, say so in the first line with the fix, then return to the usual format. If a client leaves, hand over properly. Export the exclusion lists with dates and reasons, list any open Click Quality Form requests, and note which exclusions sit at account level and which at campaign level. The next manager should never have to guess why an address is blocked. For running this across many accounts at once, see click fraud protection for agencies. If you want clean, suspect and fraud verdicts with reasons produced for every paid click, see how Block Click Fraud works. ## Frequently Asked Questions ### How soon should I tell a client about suspected click fraud? As soon as you have reviewed the data and applied a first fix. Do not wait long, because the Click Quality Form only covers the last 60 days. ### Should suspect clicks be counted in the fraud total? No. Report them on their own line. Mixing unconfirmed clicks into the fraud figure inflates it, and the client stops trusting the report if some turn out to be real. ### Can I promise the client a refund from Google? No. You can promise to file a Click Quality Form with good evidence. Whether a credit follows is Google's decision, and Google does not disclose which specific clicks it judged invalid. ### What if the client blames all their weak results on fraud? Show them the clean share of their traffic. Fraud is usually only one cause among several. If spend is climbing while leads fall, why Google Ads spend rises with no leads covers the other usual suspects. ### What should I hand over when a client leaves? The full exclusion lists with dates and reasons, the level each list sits at, and any open investigation requests. Add a note on suspect sources you were still watching. ## Sources - Google Ads Help: IP exclusions - Google Ads Help: invalid traffic and the Click Quality Form - Google Ads Help: about invalid clicks --- ## Why Your Google Ads Per Click Spend Climbs Without More Leads URL: https://blockclickfraud.com/google-ads-spend-rising-no-leads.md When your Google Ads per click spend keeps climbing but leads stay flat, one of four things is usually going on: part of your click volume isn't human, the auction really did get more expensive, your keyword mix drifted, or your conversion tracking stopped counting. Each cause leaves a different fingerprint in your numbers. Put cost, clicks, CPC, conversions and cost per lead side by side for two periods and the pattern usually tells you which one you have. ## Lay the numbers out side by side first Before you change a single bid, pull two comparable periods. Last 30 days against the 30 days before works, or this month against the same month last year if your business is seasonal. For each period, write down five numbers: - **Cost:** total spend. - **Clicks:** total billed clicks. - **Average CPC:** cost divided by clicks. - **Conversions:** the leads Google Ads recorded. - **Cost per lead:** cost divided by conversions. Then add two numbers from outside Google Ads: paid sessions from GA4 and real leads from your own intake, whether that's a CRM, an inbox or a call log. The comparison between what Google says and what your business saw is where most of the answers are. One timing warning. Google's main Conversions columns are tied to the date of the click, not the date the conversion happened, and reporting can lag up to 24 to 48 hours. The most recent days will always look a bit worse than they end up. Leave a buffer before you compare. ## Cause 1: part of the click volume is not human If clicks rise faster than paid sessions in GA4, or rise without any matching increase in calls and forms, look at the traffic itself. Bots, click farms and repeat clickers all produce billed clicks with no chance of becoming leads. Google filters what it identifies as invalid and doesn't charge for invalid traffic it catches before billing, but clicks that get past the filters are billed like any other. Signs to check yourself: very short sessions from paid traffic, the same IP addresses showing up in your server logs again and again, unusual locations or hours, and form fills with junk data. Our guide to bot traffic in Google Ads goes into detail, and finding the IP addresses behind fraudulent clicks shows where to look in your logs. ## Cause 2: the auction genuinely got more expensive Sometimes nothing is wrong except the market. Google explains that actual CPC is what you pay to clear Ad Rank thresholds and hold your position, and that it is influenced not only by the advertiser directly below you but by others in the auction too. A new competitor, a competitor raising budgets, or seasonal demand can all lift your CPC without you touching anything. The fingerprint here is cleaner. CPC goes up, clicks stay roughly flat or fall slightly, and conversion rate holds. You are paying more for the same quality of traffic. Cost per lead rises because each lead costs more to buy, not because the leads disappeared. The Auction insights report is the place to see whether competitor overlap changed. ## Cause 3: the keyword mix changed This is the quiet one. Google says broad match is the default match type for keywords, and that broad match ads may show on searches related to your keyword, including searches that don't contain its direct meaning. Over time, especially with automated bidding, the actual searches triggering your ads can drift away from what you sell. The fingerprint: clicks hold up or rise, conversion rate falls, and the search terms report fills with queries that are adjacent to your service but not the same thing. Someone looking for a free template, a job, or a different product entirely. Google's search terms report shows the actual searches that triggered your ads, and it recommends adding irrelevant terms as negative keywords. Our guide to negative keywords and click fraud covers how negatives fit alongside other protections. ## Cause 4: tracking stopped counting Before you blame the traffic, make sure the leads are actually missing. Sites change. A new form plugin, a moved thank-you page, a theme update or a consent banner can stop a conversion tag from firing. Google Ads then shows spend with fewer conversions, even though your phone is ringing as usual. The fingerprint: clicks and CPC look normal, paid sessions in GA4 look normal, but Google Ads conversions drop sharply from one specific date. Your own intake numbers stay steady. If your CRM shows leads that Google Ads didn't record, the problem is measurement, not marketing. Submit a test lead yourself and confirm it shows up. ## Which cause do you have? A diagnostic table Cause Clicks vs GA4 sessions Average CPC Conversions in Google Ads Real leads in your CRM Where to check Non-human clicks Clicks rise faster than sessions Flat or up Flat, or junk leads appear Flat Server logs, Invalid clicks column Auction got pricier Move together Up Flat Flat Auction insights Keyword drift Move together Flat or down Down relative to clicks Down or lower quality Search terms report Tracking broke Move together Flat Sudden drop on a specific date Steady Test conversion, tag status You can have more than one cause at once. Drifted keywords can attract more junk traffic, and a competitor's arrival can coincide with a site update. Work through them in order of how cheap they are to rule out. Tracking is the quickest check, so do it first. ## A short list for this week - Submit a test lead through every form and confirm Google Ads records it. - Compare Google Ads clicks with GA4 paid sessions for the last 30 days. - Add the Invalid clicks column so you can see what Google already filtered. - Read the search terms report and add negatives for anything you don't sell. - Open Auction insights and look for new or more aggressive competitors. - Scan server logs for repeat IP addresses arriving from your ads. If clicks are plentiful but the problem is that people click and don't convert, that's a different pattern, covered in high click rate, low conversions. For putting a number on the wasted part of your spend, see the real cost of Google Ads per click. If you want non-human and repeat click sources excluded from your campaigns automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Why is my Google Ads spend going up when I didn't change anything? The auction can change around you. New competitors, higher competitor budgets or seasonal demand can raise what it costs to hold your position. Automated bidding and broad match can also shift which searches you appear for without any change on your side. ### How do I know if fake clicks are behind rising spend? Compare billed clicks with paid sessions in GA4 and with real leads in your own records. If clicks rise and the other two don't, look at server logs for repeat IP addresses and unusual locations or hours. One data source alone rarely proves it. ### Can broad match cause spend to rise without more leads? Yes. Google says broad match ads may show on searches related to your keyword, including ones without its direct meaning. If those searches don't match what you sell, you pay for clicks that rarely convert. The search terms report shows what is happening. ### How can I tell if my conversion tracking is broken? Look for a sudden drop in Google Ads conversions on a specific date while clicks and GA4 sessions stay normal. Check whether your CRM or inbox still shows leads coming in. Then submit a test lead and confirm Google Ads records it. ### Should I lower my bids if cost per lead is rising? Not before you know the cause. If tracking broke, lower bids just cut traffic that was working. Diagnose first, then fix the specific cause: negatives for drift, exclusions for junk sources, repairs for tracking. ## Sources - Actual cost-per-click (CPC): Definition, Google Ads Help - About keyword matching options, Google Ads Help - About the search terms report, Google Ads Help - Understand your conversion tracking data, Google Ads Help - About invalid traffic, Google Ads Help --- ## Microsoft Ads Click Monitoring: A Paste-Ready Block List Workflow URL: https://blockclickfraud.com/microsoft-ads-click-monitoring.md Microsoft Ads click monitoring works best as a short weekly routine: confirm your UET conversion tracking is recording properly, review click-level data on a fixed day, give each odd source a verdict and a reason, then paste a clean one-IP-per-line list into the right campaign. Microsoft filters some invalid traffic itself and credits you for it. It does not tell you which sources slipped through, so that part is on you. ## Step 1: confirm your UET and conversion baseline Click monitoring without conversion data is guesswork. An odd click that became a booked call is a customer. The same click with no follow-up is a question. Microsoft's setup guidance is simple: create a UET tag in Microsoft Advertising, then add the tracking code to every page of your site. Then set up conversion goals that match what a real lead looks like for you, such as a form submission or a call. Before you trust any of it, test it. Submit your own form, place a test call if you track calls, and confirm both show up. Then write down your normal week: typical clicks, typical conversions, typical cost. Microsoft's own advice on spotting invalid clicks is to learn your usual daily, weekly and monthly click volume so sudden changes stand out. That baseline is what every later check is measured against. ## Conversion tracking vs click monitoring They answer different questions, and you need both. Conversion tracking (UET) Click monitoring Question it answers Did this traffic produce a lead or sale? Where did each paid click come from, and was it genuine? Main data source The UET tag and your conversion goals Click records, server logs, landing page data What it catches Drops in conversion rate, campaigns that spend without results Repeat sources, automated traffic, clicks from places you do not serve What it misses Which sources caused a drop Whether a clean-looking click had any buying intent What you do with it Shift budget, fix landing pages, adjust bids Exclude sources, document reasons, contact support Microsoft's help pages point out that a sudden change in conversion rate could mean more low-quality and invalid clicks. Conversion tracking raises the flag. Click monitoring tells you who to block. ## Step 2: review click-level data on a schedule Pick one day a week and stick to it. Inside Microsoft Advertising, add the Low-quality clicks and Low-quality click rate columns to your reports through the column modifier. Microsoft sorts every click into standard-quality, low-quality or invalid, and you are only billed for standard-quality clicks. Clicks later found to be low-quality or invalid are adjusted on your bill, though they can still appear in reports as standard-quality. The Microsoft Ads invalid click report guide explains how to read these numbers. Then look outside the ad platform. Pull the week's paid visits from your server logs or analytics and look for: - The same address returning many times with no conversion. - Visits from regions you do not serve. - Sessions that leave instantly, in clusters. - Traffic from hosting providers rather than home or mobile networks. Datacenter vs residential IP fraud explains why that difference matters. Before you blame fraud, check the ordinary causes Microsoft lists for higher click volume: seasonal changes, a sale or promotion, recent news, changes to your ad text or site, and new inbound links. ## Step 3: assign a verdict and a reason Every source you review gets one of three verdicts, with a written reason. In three months nobody will remember why an address was blocked. Verdict What it means Action Clean Behaves like a normal prospect, whether or not it converted None. Leave it alone. Suspect Something is off, but you are not sure yet Note it and check again next week Fraud Clearly not a genuine prospect: automated, repeating with no intent, or faking its identity Add to the block list with the reason and date Leave legitimate crawlers alone. Good bots you should never block lists them. ## Step 4: build a paste-ready block list Microsoft's IP exclusion box wants one IP address per line. It accepts IPv4 only, each address needs all four parts, and only the last part can be a wildcard, as in 127.0.0.* for the whole range from 127.0.0.0 to 127.0.0.255. Entries in any other format will not work. Keep one master file per account in plain text: - Add each new fraud address on its own line. - Remove duplicates. The same address flagged twice wastes a slot. - Sort the list so ranges and neighbours sit together. That makes it easy to see when several addresses could become one wildcard entry. - Save a dated copy each week, for example with the date in the file name. If something goes wrong after an update, you can see exactly what changed. - Keep the reasons in a separate sheet keyed by address, so the paste file stays clean. The paste file should contain nothing but addresses. No notes, no commas, no blank lines. ## Step 5: apply it to the right campaign and document it In Microsoft Advertising, go to Campaigns, tick the campaign you want to change, choose Edit, then Other changes, and pick IP address exclusions from the Campaign settings menu. IP exclusions must be added at the campaign level, not the ad group level. Microsoft's help page states a maximum of 100 IP addresses or ranges per campaign. That is far tighter than Google's limit, so wildcards and regular pruning matter more here. Limits change, so check Microsoft's current page before you plan around it. Microsoft Ads click fraud covers what to do when you hit the cap, and Microsoft Ads vs Google Ads click fraud compares how the two platforms handle exclusions. After you paste, record what you did: date, campaign, number of entries added, and the name of the master file version you used. A block on one campaign does nothing for the others, so apply the list wherever the source appears. ## A review cadence for Microsoft Ads click monitoring A rhythm that holds up for most accounts: - **Weekly:** review clicks and conversions against your baseline, assign verdicts, update and paste the list. - **Monthly:** recheck suspect sources, merge neighbouring addresses into wildcards, and remove old entries that have not appeared again so you keep room under the cap. - **Whenever conversion rate moves sharply:** run the weekly review early, and if you believe you were charged for invalid clicks, contact Microsoft support with your records. If you want every click checked and the paste-ready list built for you, see how Block Click Fraud works. ## Frequently Asked Questions ### Does Microsoft Ads charge for invalid clicks? Microsoft says you are only billed for standard-quality clicks. If clicks are later found to be low-quality or invalid, your bill is adjusted. Those clicks can still appear as standard-quality in your reports, so the report alone will not show the credit. ### How many IP addresses can I exclude per Microsoft Ads campaign? Microsoft's help page currently states a maximum of 100 IP addresses or ranges per campaign. Use last-part wildcards to cover ranges, and check the current page before planning, since limits can change. ### Can I add IP exclusions at the ad group level in Microsoft Ads? No. Microsoft's instructions say IP exclusions must be added at the campaign level, not the ad group level. Plan to apply your list to each campaign that needs it, and keep a note of which campaigns have which version. ### Why does my pasted list get rejected? Usually because of formatting. Microsoft wants one IPv4 address per line, all four parts present, and a wildcard only in the last part. Strip out notes, commas, IPv6 addresses and blank lines. ### How often should I review Microsoft Ads clicks? Weekly works for most accounts, with a monthly cleanup of the list. Review sooner if your conversion rate changes suddenly, since Microsoft notes that can signal more low-quality and invalid clicks. ## Sources - Microsoft Advertising Help: how to prevent your ads from showing to certain people (IP exclusions) - Microsoft Advertising Help: monitoring clicks, telling the good from the bad - Microsoft Advertising Help: setting up UET --- ## The Real Cost of Google Ads Per Click: Waste, Bots and Bad Clicks URL: https://blockclickfraud.com/real-cost-google-ads-per-click.md The cost of Google Ads per click that you see in your reports is an average across every billed click, including clicks that never had any chance of turning into a customer. Bots, click farms and repeat clickers all count toward that average, and they push your real cost per genuine visitor higher than the number on screen. Some of the damage never shows up as a CPC line at all. The way to see the true figure is to strip the bad clicks out and redo the division yourself. ## What reported average CPC actually measures Google defines actual CPC as the final amount you are charged for a click, set by the auction and often lower than your max bid. Average CPC in your reports is total cost divided by total billed clicks. If you want the background on how bids and auctions shape it, our guide to cost per click in Google Ads covers the mechanics. The catch is in the word "billed." Google filters traffic it judges invalid and doesn't charge you for invalid traffic caught before billing. Anything that passes the filters gets counted and paid for at full price, whether a real buyer sent it or not. So your average CPC describes what you paid, not what you paid per useful visitor. ## The three bad click types that raise the bill ### Bots Automated traffic is the obvious one. Crude bots tend to get filtered. Better ones run real browsers, scroll, and look close enough to human to pass. Each one that gets through is a billed click with zero buying intent. Our guide to bot traffic in Google Ads explains what to look for. ### Click farms Click farms use real people or real devices to click ads at volume. The clicks can look normal one at a time. The pattern shows up in aggregate: odd locations, odd hours, clusters of near-identical sessions. More on that in our post about click farms and Google Ads. ### Repeat clickers This is the one most local advertisers underestimate. A competitor, a curious ex-customer or someone who keeps using your ad as a bookmark can click again and again across days. Each click is billed. None of them add a new prospect. See repeat clickers in Google Ads for how to spot them. All three fall under the wider problem of PPC click fraud, but they hit your cost per click in the same way: they inflate the click count you pay for without adding any revenue. ## Costs that never show as a CPC line item The price of the bad click itself is only the first cost. Several others are harder to see because no report labels them. ### Smart Bidding learning from junk Google says Smart Bidding uses its models to bid for conversions or conversion value in every auction, using signals such as device, location, time of day, browser and the search query. If junk traffic triggers conversion actions, say a fake form fill, the bidding system can treat that traffic as valuable and bid harder for more of it. You end up paying more for exactly the clicks you least want. ### Budget used up early in the day Your daily budget is an average, and Google can spend up to twice it on a given day while keeping the month within 30.4 times the daily average. Within any single day, though, money spent on junk in the morning is money not available for the searches that come later. If your best customers search in the afternoon, a busy morning of bad clicks costs you more than its CPC suggests. ### Sales time on fake leads Fake or junk leads take time to call, email, qualify and close out. That time is a real cost even though it never appears in Google Ads. Check your own intake records to see how much time goes to leads that were never real. ## How to work out the real cost of Google Ads per click You only need three inputs, and you can pull them from your own account and logs. - **C** is your total cost for the period. - **K** is total billed clicks for the same period. - **J** is the number of those clicks you judge as junk: bots, click farm traffic and repeat clicks from the same source. Reported average CPC is **C divided by K**. Your true cost per genuine click is **C divided by (K minus J)**. The more junk in the mix, the wider the gap between those two numbers. ### A hypothetical illustration These numbers are made up purely to show the arithmetic. They are not a benchmark and don't describe any real account. Say a campaign spends 1,000 (in whatever currency you bill in) on 200 clicks. Reported average CPC is 1,000 divided by 200, which is 5. Now say you review your logs and judge 40 of those clicks as junk. Your genuine clicks are 160, so your true cost per genuine click is 1,000 divided by 160, which is 6.25. Same spend, different answer. You can take the same idea one step further for leads. If **L** is total leads and **F** is leads you confirm were fake, your real cost per lead is **C divided by (L minus F)**. Add your team's hours on fake leads for the full picture. ## Where to find the inputs Getting J right is the hard part. A few places to start: - Add the Invalid clicks column in Google Ads to see what Google already filtered. Those clicks are not in your billed total. - Compare billed clicks with paid sessions in GA4. A large, steady gap is worth explaining. - Pull server logs for your landing pages and look for the same IP addresses arriving from ads repeatedly. - Check your form submissions and calls for junk entries, fake names and numbers that don't connect. Be conservative. Only count a click as junk if you have a reason. An inflated J leads to bad decisions. For how CPCs vary by sector, see our guide to Google Ads cost per click by industry. ## Lowering the true cost, not just the reported one Lowering bids reduces reported CPC, but if the junk share stays the same, your true cost per genuine click barely moves. Removing junk does the opposite: it may leave reported CPC flat while your cost per real visitor drops. That is the number that matters. Practical steps: tighten negative keywords from the search terms report, exclude IP addresses you can show are repeat or automated sources, make sure conversion actions only fire on real leads so Smart Bidding learns from good data, and request a Google investigation for anything serious within the 60-day window Google allows. If you want bad sources excluded from your campaigns automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Is my average CPC the same as my cost per real visitor? No. Average CPC is total cost divided by every billed click. If some of those clicks were bots or repeat clicks, your cost per real visitor is higher than the average shows. ### Does Google charge me for bot clicks? Not for the ones its filters catch before billing. Invalid activity found after billing is credited as a billing adjustment, usually in the next billing cycle. Clicks that pass the filters are billed normally. ### How do I estimate how many of my clicks are junk? Compare Google Ads clicks with paid sessions in GA4, review server logs for repeat IP addresses, and check your leads for fake entries. Count a click as junk only when you have a clear reason. The share varies widely between accounts, so use your own data. ### Can junk clicks affect Smart Bidding? Yes, if they trigger conversion actions. Smart Bidding bids toward conversions, so fake conversions can teach it to chase similar traffic. Keep conversion actions limited to real leads or sales. ### Will lowering my bids fix the real cost per click? Usually not on its own. Lower bids reduce what each click costs, but the share of junk clicks can stay the same. Removing junk sources is what closes the gap between reported and true cost. ## Sources - Actual cost-per-click (CPC): Definition, Google Ads Help - About invalid traffic, Google Ads Help - About Smart Bidding, Google Ads Help - About overdelivery and your average daily budget, Google Ads Help --- ## Click Fraud Protection for Agencies Managing Many Google Ads Accounts URL: https://blockclickfraud.com/click-fraud-protection-for-agencies.md Click fraud protection for agencies is less about any single account and more about running the same checks, the same way, across every client, with one named person responsible for each decision. Three accounts can survive on memory and good intentions. Twenty cannot. What follows is the operating model: baselines, cross-account patterns, a setup sequence, an exclusion policy and reporting your clients will actually read. ## Click fraud protection for agencies starts with a shared baseline Before you exclude anything in a new client account, record what normal looks like. Use the same fields for every client so you can compare them later: clicks, cost, conversions, conversion rate, cost per conversion, Invalid clicks, and how traffic splits by device, location and hour. Keep it in one shared place, not in each account manager's head. A Google Ads manager account helps here. It gives you one sign-in for every linked client account and lets you compare performance and run reports across several accounts at once. That makes the baseline a single report you refresh, not a dozen exports. The baseline is what turns "it feels like there is more junk lately" into a statement you can defend to a client. It also protects you when a client blames fraud for a drop that was really a pricing change or a broken form. ## Look for patterns across client accounts An agency sees something a single advertiser never does: the same source turning up in more than one account. If you manage several clients in the same vertical and metro, say personal injury firms in one city or HVAC companies in one region, a competitor or a click farm targeting that market will often hit more than one of them. When a source is confirmed in one account, check the others in the same vertical and area for it. Remember that IP exclusions live inside each Google Ads account, at campaign or account level, so a source you block for one client is not blocked for another until you add it there. Do it deliberately, with a note, not as a blanket copy of every list into every account. Clients in different markets rarely share bad sources, and copying lists wholesale is how real customers get blocked. Our page on click fraud for law firms shows how concentrated one vertical can get. ## A repeatable per-account setup sequence Every new client should go through the same steps, in the same order, so nothing depends on who onboarded them: - Confirm access through the manager account and check that 2-Step Verification is on. Google strongly encourages it for every advertiser. - Remove old users and former agencies that still have access. - Add the Invalid clicks column and record the baseline. - Review location options. Presence or interest is the default. Presence alone is narrower and usually reduces impressions, which suits clients serving a fixed area. - Check which campaign types are running. Campaign-level IP exclusions are not available for Performance Max, video, hotel, app and Smart Display campaigns. Account-level IP exclusions apply to all campaigns, including Performance Max. - Note existing IP exclusions and how close each campaign is to the 500-address limit. See the IP exclusion limit for how to manage it. - Open the change log for the client and write the first entry. ## Write an exclusion policy before you need one ### Auto-exclude confirmed fraud, review the rest Split decisions into two tiers. Confirmed fraud (clear repeated paid clicks with no conversions, bot traffic, known bad networks) gets excluded without debate. Suspect traffic (one odd visit, a pattern that might be a real customer researching) goes to a human for review. Writing this down stops two failure modes: account managers who block everything out of caution, and ones who block nothing because they are not sure. ### A named reviewer and a fixed cadence "The team" does not review suspect lists. A person does. Assign one reviewer per client, or per group of clients, and a day of the week when the suspect list gets cleared. If the reviewer is out, someone else is named in advance. ### A change log for every account Log every exclusion and every removal: date, source, campaign, reason, who made the call. When a client asks why traffic dropped in one region, you can answer in a minute. When you need to file a Click Quality Form request with Google, which covers only the past 60 days, the log plus server logs gives you the dates, campaigns, IP addresses and GCLIDs Google asks for. See Google invalid click refunds for the rest of that process. ## What breaks between 3 and 20 accounts - **Checks drift.** Each manager develops their own habits and the clients stop getting the same level of care. A written sequence fixes this. - **Lists go stale.** Exclusions added a year ago are never reviewed and quietly fill the 500-address limit. - **Nobody owns the gray area.** Suspect traffic piles up because no one is responsible for deciding. - **Reporting becomes copy and paste.** Clients get the same paragraph every month and stop reading it. - **Logins multiply.** Separate tools and dashboards per client make the weekly pass slow enough that it gets skipped. Block Click Fraud's Agency plan was built for this: up to 20 client sites, one login and a per-client view. ## False positives cost more than they look Blocking a fraudulent source saves you the next click. Blocking a real customer costs you every future lead from that person, and it never shows up in a report. You just see slightly fewer conversions and no explanation. On high-value accounts, one wrongly blocked office network or shared mobile range can cost more than the fraud you were trying to stop. That is why the suspect tier exists, why removals belong in the log next to additions, and why asterisk range exclusions deserve extra care. Never block Googlebot or AdsBot; good bots you should never block lists them. ## Report in client language Clients do not want IP addresses. They want to know whether their money is being protected and what you did about it. A monthly note should cover what changed against the baseline, roughly how much suspect traffic was found and acted on, any credits that appeared under Billing, then Summary, as "Invalid activity", and what you plan to watch next. Our guide to reporting click fraud to clients has a template. To compare plans, see Block Click Fraud pricing. ## Frequently Asked Questions ### Can I add one IP exclusion list to every client account at once? IP exclusions are set inside each Google Ads account, at campaign or account level, so you add them account by account. That is no bad thing. Sharing a list across clients in different markets is a common way to block real customers. ### Who at the agency should review suspect clicks? One named person per client or client group, on a fixed day each week. Name a backup in advance. Without a named owner, suspect lists grow and nobody decides. ### How should agencies report click fraud to clients? In plain language, monthly, against the baseline. Say what changed, what you blocked and why, and any credits Google applied. Skip raw IP lists unless the client asks. ### Does click fraud protection work on Performance Max campaigns? Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to all campaigns in the account, including Performance Max. Block Click Fraud writes fraud sources to the account-level list as well, so Performance Max campaigns are covered. ### Can an agency get click fraud refunds for clients? You can request an investigation through Google's Click Quality Form for the past 60 days, with the customer ID, dates, campaigns and server logs. Google decides whether to credit anything and will not confirm which clicks it judged invalid. ## Sources - Google Ads Help: about manager accounts - Google Ads Help: exclude IP addresses - Google Ads Help: invalid clicks, credits and the Click Quality Form - Google Ads Help: secure your account with 2-Step Verification - Google Ads Help: about advanced location options --- ## Google Ads Per Click Cost by Industry: Law, Home Services, Insurance, Medical URL: https://blockclickfraud.com/google-ads-cost-per-click-by-industry.md Google Ads per click cost is not a fixed price list, and Google does not publish one by industry. You pay what the auction sets: your actual cost-per-click is the amount needed to beat the Ad Rank of the advertiser just below you, and it usually stays under your maximum bid. Law, home services, insurance and medical keywords run expensive for the same few reasons, and the only number that matters is the one you can pull from your own account for your own market. ## Why Google Does Not Publish Prices by Industry There is no rate card because there is no fixed rate. Every search triggers a fresh auction. Google weighs your bid, the quality of your ad and landing page, the competition in that auction, the context of the search, and the expected impact of your ad assets. The result is a price that can change from one search to the next. That is why the per-industry averages you find online disagree so badly with each other. They are blends of many accounts, cities, devices and dates. Your account is not the blend. Treat any published figure as noise and work from your own data, which this post shows you how to get. ## How the Auction Sets Your Google Ads Per Click Cost Three terms matter here, and Google defines each one. - **Max CPC** is the most you are willing to pay for a click. - **Actual CPC** is the final amount you are charged. Google says it is what you need to pay to beat the Ad Rank of the competitor immediately below you. If nobody is below you, a reserve price applies. Certain bid adjustments can push actual CPC above your max. - **Average CPC** is total click cost divided by total clicks. The practical takeaway: the advertiser below you sets your price as much as your own bid does. When a new competitor enters your market and bids hard, your cost can rise even if you changed nothing. Our Google Ads cost per click guide goes deeper on what CPC measures and why it climbs. ## What Makes the Same Keyword Cost Different Amounts Two advertisers bidding on the same keyword rarely pay the same price. Google's Ad Rank page lists the context of the search as a factor, including the person's location, their device and the time of the search. In plain terms: ### Location A keyword in a dense metro with many competing firms costs more than the same keyword in a small town with two advertisers. Even neighboring cities can price very differently. ### Time and device Competition shifts through the day and week. Some advertisers only run during business hours, and some bid up mobile for calls. Your price moves with them. ### Quality Ad Rank includes the quality of your ad and landing page. A more relevant ad and a better landing page can win the same position for less. This is the one lever fully in your hands. ## Vertical by Vertical: Why These Four Run Expensive The pattern is the same in each: a single customer is worth a lot, many businesses compete for a small set of searches, and the searches often come with urgency. ### Law One signed case can be worth many times the ad spend that produced it, so firms bid hard. Practice areas like personal injury and criminal defense pull many firms into the same city auctions. Searchers often call the first firm that answers. For the fraud side of legal PPC, see click fraud for law firms and the cost of a fraudulent click in legal PPC. ### Home services Plumbers, HVAC firms, locksmiths and roofers buy emergency searches. The job value is high, the searcher wants help now, and every metro has a crowd of local competitors. Our post on click fraud in home services covers protecting those call leads. ### Insurance A policyholder can stay with a carrier or agency for years, so the value of one new customer is spread over a long relationship. National carriers, local agents and lead buyers all compete on the same terms, which crowds the auction. ### Medical Elective procedures, dental work and specialist care carry high patient value. Local practices compete with hospital systems and multi-location groups for the same patients, often in the same few zip codes. ## How to Find Your Real Per-Click Cost Skip the industry tables. Work through these three steps instead. ### Step 1: Keyword Planner for your location Keyword Planner shows "Top of page bid (low range)" and "Top of page bid (high range)" for keywords, and its historical metrics are based on your location and Search Network settings. Set the location to the area you actually serve. A national estimate tells you very little about your city. ### Step 2: Your own average CPC by campaign If you already advertise, your account is the best source. Look at average CPC by campaign and by keyword over a long enough window to smooth out daily swings. Segment by device and hour to see where you pay more. ### Step 3: The true cost once invalid clicks are removed Average CPC treats every click as equal. Some are not. Google filters invalid traffic and does not charge for what it catches before billing, and you can add the Invalid clicks column to see what was filtered. What slips through still lands in your average. If a share of your paid clicks never had a chance of becoming a customer, your real cost per useful click is higher than the dashboard shows. Our post on the real cost of a Google Ads click walks through that math. ## Bringing the Number Down Without Losing Leads - **Improve relevance.** Tighter ad groups, ad text that matches the search, and landing pages that answer the query feed directly into Ad Rank. - **Cut irrelevant searches.** Review the search terms report and add negative keywords. - **Bid where you convert.** Use your own data by location, hour and device rather than spreading budget evenly. - **Remove sources that never convert.** IP exclusions let you block addresses that keep clicking without ever calling or filling in a form. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Does Google publish the cost per click for each industry? No. Prices are set in an auction for each search, so there is no fixed rate to publish. Any per-industry average you see comes from a third party blending many accounts, and it will not match your market. ### Why do I sometimes pay less than my max CPC? Google charges only what you need to beat the Ad Rank of the advertiser below you. If that advertiser is weak or absent, you pay less. With certain bid adjustments, actual CPC can go above your max. ### Why does the same keyword cost more in one city than another? Competition varies by location. Ad Rank also considers the searcher's location, device and time of search. A dense metro with many advertisers usually pushes prices higher. ### How do I estimate CPC before I start advertising? Use Keyword Planner and set the location to your real service area. Look at the top of page bid low and high ranges for your keywords. Treat them as a starting estimate, then replace them with your own data once you have clicks. ### Does click fraud raise my cost per click? Fake clicks that get past Google's filters are billed like real ones, so they raise your cost per useful click. They can also drain your daily budget early. Google filters much invalid traffic, but checking your own click sources still matters. ## Sources - Actual cost-per-click (CPC): Definition, Google Ads Help - Average cost-per-click (Avg. CPC): Definition, Google Ads Help - About Ad Rank, Google Ads Help - About Keyword Planner forecasts, Google Ads Help - About invalid traffic, Google Ads Help --- ## Click Fraud for Home Services: Protecting Emergency Call Leads URL: https://blockclickfraud.com/click-fraud-home-services.md Home services click fraud hits plumbers, HVAC contractors, locksmiths, roofers and restoration firms because they buy some of the most urgent clicks in search, and that urgency is exactly what makes them a target. A fake click on an emergency keyword does more than waste money. It burns daily budget that should have been there for a real caller later in the day. You protect those leads by watching where paid clicks come from, excluding the sources that are clearly not customers, and keeping records you can act on. ## Why Click Fraud Hits Home Services So Hard Three things line up in the trades. First, a single job can be worth a lot, so advertisers bid aggressively on terms like "emergency plumber" or "AC repair near me." Second, the searcher is in a hurry. They want someone now, so the ad at the top often wins the call. Third, every metro has a crowd of local competitors chasing the same small set of keywords. That mix creates motive. A rival who clicks your ad a few times each morning can push you out of the auction by lunch, and bad traffic sources follow high bids. If you suspect a specific rival, our guide on competitors clicking your ads covers what you can and cannot prove. ## The Real Cost of a Wasted Emergency Click Most home services accounts run on a daily budget. Once it is spent, your ads stop showing until tomorrow. Picture a burst pipe at 11pm. The homeowner searches, sees a few ads, and calls the first one that answers. If junk clicks ate your budget at 9am, you are not in that list. You lost the cost of the fake clicks and the job that would have paid for the week. So ask when your ads stopped serving, not only what the bad clicks cost. Check your hour-of-day report against the time campaigns hit budget. If you cap out early on days when the phones stay quiet in the evening, look harder at the morning traffic. ## When Google Ads Clicks and GA4 Sessions Do Not Match A gap between clicks in Google Ads and sessions in GA4 is one of the first things owners notice. It is a useful signal, but it is not proof of fraud on its own. Google's own troubleshooting page lists many ordinary causes: Ads counts clicks while Analytics counts sessions, slow pages lose visitors before the tracking code fires, redirects can strip the click ID, some landing pages are missing the tag, and some browsers block tracking. Google Ads also removes clicks it considers invalid, which is another reason the two numbers differ. Rule out the boring explanations first: confirm auto-tagging is on, test landing pages on a phone, and check that redirects keep URL parameters. If the gap stays wide and clusters in certain campaigns, hours or locations, investigate. ## Protecting Call Leads, Not Just Form Fills For most trades the phone is the conversion. That changes how you should read your data. ### Call assets are billed like clicks Google says taps on a call asset cost the same as headline clicks. So a fake tap on your phone number is billed like any other click, and it may never show up as a website session at all. Track calls as conversions inside Google Ads so you can see which clicks actually rang your phone. ### Call ads are being retired Google's help page for call ads says new call ads cannot be created starting February 2026, and existing ones stop receiving impressions in February 2027. If your account still leans on call-only campaigns, plan the move to call assets on standard Search ads now, so your call tracking does not break mid-season. ### Local Services Ads are a different problem If you also run Local Services Ads, those are charged per lead rather than per click, so the fraud pattern and the dispute process are different. See our page on Local Services Ads fraud for that side. ## Location Targeting: Presence vs Interest This setting quietly wastes a lot of home services budget. Google's default and recommended location option is "Presence or interest," which can show your ads to people who are in your area, regularly there, or simply showing interest in it. The "Presence" option limits ads to people who are likely located, or regularly located, in your target area. A roofer rarely gets a paying job from someone across the country researching his city. Presence will not stop a determined fraudster, but it cuts clicks that were never going to become a truck roll. Compare your location report before and after the change. ## What IP Exclusions Can and Cannot Do IP exclusions are the main lever Google gives you for blocking specific sources. You can exclude up to 500 IP addresses per campaign, and you can use an asterisk in place of the last digits to cover a block of addresses. Our Google Ads IP exclusions guide walks through the setup. Be realistic about the limits: - An exclusion only works after you know the address, so the first click from a new source still gets through. - Mobile and residential addresses change, so some sources rotate past a static list. - Campaign-level IP exclusions are not available for Performance Max and several other campaign types, though account-level IP exclusions apply to all campaigns in the account, including Performance Max. - The 500-address cap fills up faster than you would expect in a busy metro. Exclusions shrink repeat abuse. They do not make an account fraud-proof. Our page on repeat clickers in Google Ads covers the pattern exclusions handle best. ## A Practical Workflow for Home Services Advertisers - **Track calls as conversions.** Without this you cannot tell a real lead from a wasted click. - **Add the Invalid clicks column** in Google Ads so you can see what Google already filtered. - **Set location to Presence** unless you have a clear reason to target people outside your service area. - **Watch budget cap times.** Note which days you run out early and compare them to evening call volume. - **Review click sources weekly.** Look for the same addresses clicking repeatedly with no call or form fill. - **Exclude clear offenders** and keep the list under the per-campaign limit. - **Keep records.** Dates, times, IPs and click IDs are what Google asks for if you file an invalid click investigation. Our page on Google invalid click refunds covers that process. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Why are plumbers and HVAC companies hit by click fraud so often? Emergency trade keywords carry high bids, and many local competitors fight over the same terms. High bids attract bad traffic, and close competition gives rivals a reason to click. Losing visibility for even a few hours can cost real jobs. ### Does a gap between Google Ads clicks and GA4 sessions mean I am being defrauded? Not by itself. Google lists many normal causes, including slow pages, redirects that strip click IDs, missing tags and browser blocking. Fix those first, then look at whether the gap concentrates in specific campaigns, times or places. ### Am I charged when someone taps my phone number in an ad? Yes. Google says call asset taps cost the same as headline clicks. That is why tracking calls as conversions matters: it shows which paid taps turned into real conversations. ### Should I switch location targeting to Presence? For most local service businesses it makes sense, because you can only serve people in your area. The default "Presence or interest" setting can show ads to people outside your area who are only interested in it. Compare your location report before and after the change. ### Can IP exclusions stop all fake clicks on my ads? No. They block known sources, so the first click from a new address gets through, and rotating addresses can slip past a fixed list. They are still worth using because they cut down repeat abuse from the same sources. ## Sources - Exclude IP addresses, Google Ads Help - About advanced location options, Google Ads Help - Clicks and sessions discrepancy for Google Ads and Google Analytics, Google Ads Help - About call assets, Google Ads Help - About call ads, Google Ads Help --- ## What Is a Good Click-Through Rate for Google Ads? URL: https://blockclickfraud.com/good-click-through-rate-google-ads.md If you are asking what is a good click through rate for Google Ads, the honest answer is that Google does not publish one. Its own help page says a good CTR is relative to what you are advertising and on which networks. A good CTR is one that beats your own past results for the same kind of campaign, network, position and keyword type, and that brings in clicks that turn into customers. ## How CTR Is Calculated Clickthrough rate is clicks divided by impressions. If your ad is shown 200 times and clicked 10 times, your CTR is 10 divided by 200. Google says each of your ads, listings and keywords has its own CTR, listed in your account. That simple formula is why CTR is so easy to misread. It only tells you how often people who saw the ad chose to click. It says nothing about who they were, whether they were real, or what they did next. ## Why There Is No Universal Good Click Through Rate for Google Ads Any single "good CTR" figure you see online is a blend of very different situations. Four things move CTR more than anything else, and they are all specific to your account. ### Network Search ads appear when someone types a query that matches your keyword. Display ads appear while people are reading or watching something else. Those are different moments with different intent, so their CTRs are not comparable. Never judge a Display campaign against a Search target, and never blend the two in one CTR number. ### Position Ads near the top of the results usually get more attention than ads lower down. If your position changes, your CTR changes with it, even if the ad itself did not. ### Brand vs non-brand terms People searching your business name already want you. Brand campaigns tend to post much higher CTRs than campaigns on generic service terms. Mixing them in one report makes a weak non-brand campaign look healthy. Split them. ### What you sell Urgent services, research-heavy purchases and impulse buys all draw different click behavior. Google's own guidance is that CTR is relative to what you are advertising, which is the most direct reason to ignore outside benchmarks. ## What CTR Feeds Into CTR is not just a vanity metric. Google says CTR contributes to your keyword's expected CTR, which is a component of Ad Rank. Expected CTR is also one of the three components of Quality Score, along with ad relevance and landing page experience, each rated above average, average or below average. Two details matter here. First, expected CTR is Google's estimate of how likely your ad is to be clicked, not your raw CTR. Second, Quality Score is a diagnostic tool and not an input in the auction. What it reflects does feed Ad Rank, and Ad Rank affects your position and what you pay. Our post on Google Ads cost per click covers how that plays out in pricing. ## Same CTR, Different Problems Two accounts can show the same CTR and be in very different shape. - **Account A** has a modest CTR, but the clicks come from people in its service area who call and book. The CTR is fine. The work is in growing volume. - **Account B** has the same CTR, but most clicks come from outside its area, from irrelevant searches, or from sources that click and leave instantly. The CTR hides waste. CTR alone cannot tell these apart. You need to look at what happened after the click: conversions, call volume, engagement and where the clicks came from. ## The CTR Trap: When a Rising CTR Is a Warning Sign A sudden jump in CTR feels like good news. Sometimes it is. Sometimes it means someone, or something, is clicking your ads without any intention of buying. Bots, click farms and repeat clickers generate clicks without a matching rise in real interest. The result is a pattern worth knowing: CTR goes up, spend goes up, and conversions stay flat or fall. If you see that, do not celebrate the CTR. Check where the clicks came from, what time they arrived, and whether the same sources keep coming back. Our post on high click rate with low conversions walks through that diagnosis, and bot traffic in Google Ads covers the most common source. ## How to Raise CTR Without Wasting Budget The goal is more clicks from the right people, not more clicks in total. - **Match ad text to the search.** Tight ad groups with ads that repeat the searcher's words earn more relevant clicks. - **Use assets.** Sitelinks, callouts and call assets give the ad more space and more reasons to click. Ad Rank also considers the expected impact of your assets. - **Cut irrelevant impressions.** Negative keywords remove searches you never wanted. That raises CTR by lowering impressions you were never going to convert. - **Be specific.** Name your service area, hours and what you do. A clear ad can lower CTR from the wrong people while raising it from the right ones, and that trade is worth making. - **Do not chase clicks with vague hype.** Broad, clickable copy can pull curious visitors who never buy. ## Setting a Realistic CTR Target From Your Own Trend Build your benchmark from your own history instead of a borrowed number. - Pull CTR by campaign for the last several months, split by network and by brand vs non-brand. - Note the range each campaign normally sits in, and when it moved out of that range. - Line those moves up against changes you made: new ads, new keywords, bid changes, location changes. - Set the target as a modest improvement on the recent range, and judge it alongside conversion rate. Any CTR change you cannot explain from your own edits deserves a closer look, especially an unexplained rise with no lift in leads. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Does Google say what a good CTR is? No. Google's CTR help page says a good CTR is relative to what you are advertising and on which networks. It gives no universal target, so the useful comparison is your own account history. ### How do I calculate my Google Ads CTR? Divide clicks by impressions. Each of your ads and keywords already has its own CTR listed in your account, so you rarely need to calculate it by hand. ### Does a higher CTR improve my Quality Score? Expected CTR is one of the three Quality Score components, and your CTR contributes to it. Expected CTR is Google's estimate rather than your raw rate, and Quality Score is a diagnostic rather than a direct auction input. ### Can fake clicks raise my CTR? Yes. Bots and repeat clickers add clicks without adding real interest, so CTR can rise while conversions stay flat. That pattern is a reason to check where your clicks came from. ### Should I compare Search and Display CTR? No. They reach people in different moments with different intent, so the numbers are not comparable. Track and judge each network against its own history. ## Sources - Clickthrough rate (CTR): Definition, Google Ads Help - About Quality Score for Search campaigns, Google Ads Help - About Ad Rank, Google Ads Help --- ## Repeat Clickers in Google Ads: The Quiet Fraud You Can Measure URL: https://blockclickfraud.com/repeat-clickers-google-ads.md Repeat clickers in Google Ads are sources that click your ads again and again with no intention of buying, and each of those clicks is billed like any other. They are easy to miss because a real prospect who comes back three times is also a repeat click. The way to measure them is to line up your Google Ads data, your server logs and your conversion records, then judge each repeating source on what it actually did. ## What a repeat clicker is, and what it is not A repeat clicker is any source, usually one IP address or a small range, that produces several paid clicks over a short period without a sign of real interest. It might be a competitor, a script, or someone paid to click. Here is the catch. Your best prospects also click more than once. Someone researching a lawyer, a roofer or a software tool may click your ad on Monday, again on Wednesday, and call on Friday. That person is a repeat click and a customer. Blocking them is worse than paying for them. So the question is never "did this source click more than once?" It is "did this source behave like someone trying to buy?" ## Why Google Ads reports hide repeat behaviour Google Ads reports clicks by campaign, ad group, keyword, location, device and time. There is no column that shows how many times one particular source clicked. You can see that a keyword had a busy day, but not that a single address was behind a large share of it. Google does filter invalid traffic and does not charge for invalid clicks it catches before billing. But its filters work on its own judgment, and the account will not show you which specific sources were removed or why. There is a second complication. Google Ads counts clicks. Your analytics counts sessions or visits. The two rarely match exactly, because one click can produce no recorded session (the visitor leaves before the page loads, or blocks tracking) and one session can include several page views. Google also notes that reports can occasionally show more conversions than clicks, because a click can be filtered as invalid after the fact while its conversion stays. Do not expect the numbers to line up neatly. Expect to reconcile them. ## The signals table: what each data source shows Data source What it shows What it cannot show Google Ads clicks and cost Click volume and spend by campaign, keyword, location, device and hour Which individual source made each click, or how often one source returned Server logs and analytics IP address, time, landing page and the GCLID on each paid visit Whether the visit was billed, or whether Google already filtered it Conversion data Which visits produced a form fill, call or sale Anything about visitors who never converted, which is where repeat clickers live The GCLID is the bridge. With auto-tagging on, Google adds this click identifier to your landing page URL on every ad click. Log it with the IP address and time, and you can tie a visit in your logs back to a specific paid click. How to find IP addresses behind fraudulent clicks walks through capturing it. ## Telling a returning visitor from repeat clickers in Google Ads data Once you have click records with addresses, group them by source and look at each repeating one. A few questions do most of the work: - **Did it ever convert?** A source that clicked several times and then called you is a customer. Leave it alone. - **How spread out are the clicks?** Clicks days apart, at reasonable hours, look like research. Several within minutes look like something else. - **What did it do on the page?** Reading, scrolling and moving between pages suggests interest. Landing and leaving at once, every time, does not. - **Which ads and keywords?** A prospect tends to come back through searches that make sense. A source hitting your most expensive keyword over and over is worth a closer look. - **Where is it from?** A source outside your service area, or on a hosting network rather than a home or mobile connection, deserves more suspicion. Datacenter vs residential IP fraud explains why. ## What you can do yourself today ### Protect your forms Add spam protection to your lead forms. Junk submissions pollute your conversion data and make non-converting sources harder to spot. ### Check your location option Google's default location option is "Presence or Interest", which reaches people in, regularly in, or who have shown interest in your targeted locations. If you only serve a local area, the "Presence" option limits ads to people in or regularly in those locations. ### Write more specific ad copy Vague ads attract curious clicks. Ads that name the service, the area and who it is for put off people who were never going to buy. ### Exclude confirmed addresses For sources you are sure about, add IP exclusions. Google allows up to 500 IP addresses per campaign, and an asterisk in place of the last digits excludes a block. Account-level exclusions apply to every campaign, including Performance Max. The Google Ads IP exclusions guide has the steps. ## How long should an IP stay on your list? Not forever. Many addresses are reassigned over time, especially on mobile and home connections. An address that belonged to a repeat clicker last spring may belong to a real prospect now. A practical approach is to date every entry and review the list on a schedule. Keep addresses that still show up. Remove ones that have been quiet for a long stretch, particularly residential ones. Hosting and datacenter addresses can usually stay longer, since real customers browse from them far less often. This also keeps you under the per-campaign cap. If a list is filling up, the Google Ads IP exclusion limit explains your options. ## When rotating addresses outpace a manual list A single repeat clicker on a fixed connection is easy to block once you spot it. The harder case is a source that changes address between clicks: switching mobile data on and off, moving between networks, or using a pool of proxies. Each new address gets at least one paid click before you can see it, and a list maintained by hand once a week is always behind. Ranges help when the addresses share a block. Beyond that, the honest answer is that manual lists slow rotating sources down without stopping them. If you are weighing other places to block traffic, IP exclusions vs server blocking covers what each one actually prevents. If you want repeat clickers flagged and written into your exclusion lists automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Does Google charge for repeat clicks from the same person? Google does not charge for clicks its systems judge invalid before billing. Clicks it treats as valid are billed normally, even if the same person clicked before. Google will not tell you which specific clicks it filtered. ### How many clicks from one IP is too many? There is no fixed number that works for every account. It depends on how long your customers research before buying. Judge each repeating source on whether it behaves like a buyer, not on a count alone. ### Can I see repeat clickers inside Google Ads? Not directly. Google Ads has no column showing clicks per source. You need server logs or analytics that record IP addresses and GCLIDs, then match them to your ad data. ### Should I block every IP that clicks twice? No. Returning prospects click more than once, and blocking them costs you customers. Only exclude sources that repeat without any sign of interest, and give each block a dated reason. ### Will excluding an IP stop a repeat clicker for good? It stops that address. If the person changes networks or uses a different device, they return with a new address. Exclusions are one layer, alongside location settings, specific ad copy and form protection. ## Sources - Google Ads Help: about auto-tagging and the GCLID - Google Ads Help: about advanced location options - Google Ads Help: IP exclusions - Google Ads Help: about invalid clicks - Google Ads Help: invalid traffic and the Click Quality Form --- ## Ad Fraud Detection for Small Advertisers: What to Check First URL: https://blockclickfraud.com/ad-fraud-detection.md Ad fraud detection on a small budget starts with checks you can run yourself in Google Ads and in your server logs, done in a set order so you do not spend a week chasing noise. Begin with what Google already reports, then compare your numbers against your own normal, and only then go hunting for individual sources. Six checks, in sequence, will tell you whether you have a problem worth acting on. ## Why the order matters when budget is tight Large advertisers can afford to test everything at once. You cannot. Every hour spent reading raw logs is an hour not spent on ads that make money, and a wrong exclusion can block the customers you are paying to reach. The order below goes from cheap, broad signals to narrow, time-consuming ones. If the early checks look normal, you may be able to stop there and come back next month. ## Checks 1 and 2: Invalid clicks and conversion rate against a baseline ### Check 1: The Invalid clicks column Add the Invalid clicks column to your campaigns table (Columns, then Modify columns). It shows clicks Google's filters removed before billing, which you were not charged for. A rising count means someone is aiming more junk at your ads. It does not show what slipped past, but it tells you whether to keep digging. ### Check 2: Conversion rate by campaign Pull clicks, conversions and conversion rate for each campaign, for the last few weeks and for a comparable stretch before that. Fraud usually shows up as clicks holding steady or rising while conversions do not follow. Look campaign by campaign, because an account total can hide one campaign that went bad. If nothing moved, you may not have a problem. If one campaign stands out, focus the remaining checks on it. High click rates with low conversions covers the other causes to rule out, such as a broken form or a landing page change. ## Checks 3 and 4: Location and hour of day ### Check 3: The location report Compare where paid clicks came from against where your customers actually are. Clicks from regions you do not serve are either a targeting problem or a fraud problem, and both cost the same. Check the campaign's location option too. The default, Presence or interest, can reach people outside your area who have shown interest in it. Presence reaches only people likely to be in, or regularly in, your target locations, and Google says it usually reduces impressions. ### Check 4: Hour of day Break clicks and conversions down by hour. Real buyers follow habits: business hours for B2B, evenings for many consumer services, a lunchtime bump for others. Clicks piling up overnight, or in a tight window every morning, with no matching conversions, point to something automated or to a person draining your budget before the day starts. ## Checks 5 and 6: Search terms and repeat sources in server logs ### Check 5: Search terms Read the search terms report for the suspect campaign. Odd, irrelevant or nonsense queries attached to paid clicks can mean loose match types, which you fix with negatives, or they can mean scripted traffic. Negative keywords and click fraud explains where negatives help and where they do not. ### Check 6: Repeat sources in server logs This is the slowest check, so it comes last. Filter your web server logs to paid visits (those with a GCLID in the URL) and group them by IP address. Look for the same address landing again and again over several days, addresses from hosting providers rather than home or mobile connections, and visits that last a second or two with no further page loads. How to find the IP addresses behind fraudulent clicks walks through it step by step. One caution: before you mark any address as bad, confirm it is not a good bot. Googlebot and AdsBot visit your pages for legitimate reasons and should stay unblocked. Good bots you should never block lists the ones to leave alone. ## What to do with a suspect list By the end of check 6 you will have a list of addresses or ranges that look wrong. Do not exclude them all at once. Sort them into two groups: - **Confirmed:** repeated paid visits over several days, no conversions, and a pattern you can explain in one sentence. Add these to IP exclusions. Google allows up to 500 per campaign, and you can use an asterisk in place of the last digits to exclude a block. - **Suspect:** one or two odd visits, or something that might be a real customer. Watch these for another week before deciding. Write down what you excluded, when and why. If you later file a Click Quality Form request with Google, which covers only the past 60 days, those notes plus your logs supply the dates, campaigns, IP addresses and GCLIDs Google asks for. ## A realistic first week Day Task Day 1 Add the Invalid clicks column. Record clicks, conversions and conversion rate per campaign as your baseline. Day 2 Review location reports and location options. Exclude regions you do not serve. Day 3 Review hour-of-day data and the search terms report for any campaign that stood out. Day 4 Export server logs for paid visits and group by IP address. Day 5 Sort the suspect list into confirmed and suspect. Exclude the confirmed group and log it. Days 6 and 7 Leave the account alone and let new data come in. The following week, compare against day 1. If conversion rate held or improved and nothing real disappeared, you are on the right track. ## Publisher-grade ad fraud detection vs small-advertiser click protection Search for ad fraud detection and much of what you find is built for publishers and large media buyers. Those systems verify impressions across many sites and score inventory before it is bought. They are built for a different problem and priced for budgets far larger than a local business spends. A small Google Ads advertiser has a narrower question: are the people clicking my search ads real, and if not, can I stop paying for them? That calls for checking each paid click that reaches your site, blocking confirmed sources through Google Ads, and keeping records you can use with Google. When you compare options, ask which question a product actually answers. Does click fraud protection work? takes a skeptical look. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### What is the first thing to check for ad fraud in Google Ads? The Invalid clicks column. It costs nothing, takes a minute to add, and shows whether Google is filtering more junk traffic than usual. A rise is a reason to keep checking. ### How do I know if low conversions are fraud or a site problem? Check the site first: test your forms, phone links and landing pages. If they work and conversion rate dropped only in some campaigns, locations or hours, fraud becomes more likely. A site problem usually hits every campaign at once. ### Can I detect ad fraud without server logs? You can get partway with Google Ads reports alone: Invalid clicks, conversion rate, location, hour of day and search terms. To find specific sources to exclude, you need IP-level data, which usually means server logs. ### Should I exclude every suspicious IP address right away? No. Exclude the ones with a clear, repeated pattern and watch the rest for another week. Excluding a real customer costs you sales you will never see in a report. ### Will Google refund clicks I prove were fraudulent? Google decides. You can submit a Click Quality Form request for activity in the past 60 days with your logs and GCLIDs. Google will not confirm which specific clicks it judged invalid, but it notifies you of any credits. ## Sources - Google Ads Help: invalid clicks, credits and the Click Quality Form - Google Ads Help: about advanced location options - Google Ads Help: exclude IP addresses --- ## Google Click Ads: A Plain Guide to How Billing Works URL: https://blockclickfraud.com/google-click-ads-billing.md Google click ads on a typical Search campaign bill you for the click, not for the impression and not for the lead. Each click costs an amount set by the auction, usually below your maximum bid, and your invoice is the sum of those click costs minus any credits Google applies. Your daily budget sets the average pace of spend, not a hard daily ceiling. ## How Google click ads turn a click into a charge On a Search campaign that uses cost per click bidding, nothing is owed when your ad merely appears. You pay when someone clicks. Google describes CPC bidding as paying "for each click on your ads," and that is the unit everything else on your bill is built from. The click counts whether the person reads your page or bounces in a second. Google does filter clicks it decides are invalid, and you are not charged for invalid traffic it catches before billing. Everything that passes those filters is billable, which is why the rest of this guide matters. ## The three numbers behind every charge Every Google click ads charge comes down to three numbers. If you can read these, you can read your bill. ### Max CPC Your maximum cost per click is the most you are willing to pay for one click. Google calls it the most you'll typically be charged. You set it with manual bidding; automated bidding sets it for you. ### Actual CPC Actual CPC is the final amount you are charged for a click. Google says you are often charged less, sometimes much less, than your max CPC, because you only pay what is minimally required to clear Ad Rank thresholds and hold your position against competitors below you. That means your cost per click moves with the auction, even when you change nothing. ### Clicks The third number is simply how many billable clicks you received. Cost equals actual CPC times clicks, added up across every auction you won. Average CPC in your reports is just total cost divided by total clicks. More on that average in our guide to cost per click in Google Ads. ## Why one day can cost more than your daily budget This catches a lot of advertisers off guard. Your daily budget is an average, not a cap. Google's help page on overdelivery says a campaign might spend up to twice your average daily budget on a given day, to take advantage of traffic swings. The protection is monthly. Google states that at the end of the month you will have spent no more than 30.4 times your average daily budget. So a spike on Tuesday is allowed, as long as the month as a whole stays inside that limit. If you see a day that looks doubled, check the month before you assume something broke. ## Automatic and manual payments, at a high level Google now calls these settings postpay and prepay. You may know them as automatic and manual payments. - **Postpay:** your ads run first and you are charged after. Google charges you whenever your account reaches its payment threshold, and on the first day of the month. Each time you hit the threshold before month end, the threshold increases, so charges can land more than once a month. - **Prepay:** you add funds first and costs draw that balance down. When the payment is used up, your ads stop running. Neither setting changes what a click costs. They only change when the money leaves your account. ## Conversion reporting and billing run on different clocks Billing follows clicks as they happen. Conversion reporting does not work the same way. Google's conversion data guide says the main Conversions columns are calculated based on the time of the click, not the time of the conversion. A click from last week that turns into a lead this week gets reported against last week. That has two practical effects. First, recent days always look worse than they will once late conversions arrive. Second, a week's cost per lead keeps changing after the week ends. Google also notes reporting lags of up to 24 to 48 hours. If you want conversions by the date they happened, use the "by conv. time" columns. Don't judge yesterday's spend against yesterday's leads and panic. ## When clicks are real, billed and worth nothing Here is the uncomfortable part. A click can pass Google's filters, get billed at full price and still have zero chance of becoming a customer. Common examples: - Automated traffic that looks human enough to slip through, covered in our guide to bot traffic in Google Ads. - The same person or device clicking your ad again and again. - Competitors or job seekers clicking with no intent to buy. - Searches that only loosely match what you sell. Google's filters look for activity that doesn't resemble normal human behavior. They don't judge whether a human click was worth your money. Our breakdown of the real cost of Google Ads per click shows how to put a number on it. ## How to audit a Google Ads bill for waste You don't need special tools for a first pass. Work through this with a recent month: - **Add the Invalid clicks column.** Go to Columns, then Modify columns, and add it to your campaigns table. This shows what Google already filtered. - **Read the search terms report.** Look for terms that have nothing to do with your business and add them as negative keywords. - **Compare clicks with site sessions.** If Google reports many more clicks than your analytics shows paid visits, find out why. - **Check your server logs.** Look for the same IP addresses hitting your landing pages from ads over and over. Our guide on how to find IP addresses behind fraudulent clicks walks through it. - **Exclude what you can prove.** Repeat offenders can go into your Google Ads IP exclusions. Campaign-level lists hold up to 500 addresses each. ## Invalid activity credits are billing adjustments When Google finds invalid activity after you have already been billed, it credits you as a billing adjustment for the value of that activity. These usually appear in the next billing cycle and are labeled "Invalid activity." You can see them under Billing, then Summary, and Google also offers an Invalid Activity Credit Report. If you think Google missed something, you can request an investigation with the Click Quality Form. It only covers activity from the last 60 days, so keep records and act quickly. Include your customer ID, dates, campaigns, keywords and server logs with IPs and GCLIDs. Google will not confirm which specific clicks it judged invalid. The full process is in our guide to Google invalid click refunds. If you want every paid click checked and the bad sources excluded automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Do Google click ads charge for impressions? Not on a Search campaign using cost per click bidding. You are charged when someone clicks the ad. Impressions on their own cost nothing under that bidding model. ### Why is my actual CPC lower than my max CPC? Google charges only what is needed to clear Ad Rank thresholds and keep your position against the advertisers below you. Your max CPC is the ceiling. The auction decides how much of it you actually pay. ### Can Google spend more than my daily budget? Yes, on individual days. Google says a campaign might spend up to twice its average daily budget on a given day. Over the month, you will not be charged more than 30.4 times the average daily budget. ### Why don't my conversions match the days I was billed? The main Conversions columns are tied to the date of the click, not the date the conversion happened. Late conversions get added back to the earlier click date. Use the "by conv. time" columns if you want conversion dates instead. ### Where do invalid click credits show up? They show as billing adjustments labeled "Invalid activity," usually in the next billing cycle. Check Billing, then Summary. The Invalid Activity Credit Report gives more detail. ## Sources - Actual cost-per-click (CPC): Definition, Google Ads Help - About overdelivery and your average daily budget, Google Ads Help - About payment settings in Google Ads, Google Ads Help - Understand your conversion tracking data, Google Ads Help - About invalid traffic, Google Ads Help --- ## How to Spot a Click Farm in Your Google Ads Reports URL: https://blockclickfraud.com/click-farm-google-ads.md A click farm in Google Ads usually shows up first in your business numbers, not your ad reports: spend keeps moving while qualified leads do not, form fills turn out to be junk, and calls go nowhere. To confirm it, open the campaign, location, device, hour and search term reports and look for a handful of repeating patterns. Real people clicking for pay are harder to filter than bots, so expect to do some of the confirming yourself. ## Start with the business layer, not the ad dashboard Click farms are built to look normal inside the ad platform. The giveaway is downstream, in what your sales process actually receives. Before opening Google Ads, gather three things for the last few weeks: - **Spend vs qualified leads.** Not total conversions. Leads your team would call real after speaking to them. - **Form fills by quality.** Fake names, mismatched phone numbers, gibberish messages, email addresses that bounce. - **Call outcomes.** Calls that ring once and hang up, numbers that are disconnected when you ring back, callers who have no idea what they called about. If spend and qualified leads are moving together, you probably do not have a farm problem. If spend is steady or rising and qualified leads are falling, keep reading. Why Google Ads spend rises with no leads covers the non-fraud causes worth ruling out first. ## The reports worth opening You do not need every report. These five answer most of the questions: - **Campaigns by day.** Clicks, cost, conversions and conversion rate over time. Look for the date things changed. - **Locations.** In Google Ads, go to Campaigns, then Insights and reports, then "When and where your ads showed", and open the Matched locations tab. It shows performance by the locations that matched your ads, which can be physical locations or locations of interest. - **Devices.** Split by computer, mobile and tablet, and compare conversion rates. - **Ad schedule by hour.** Clicks and conversions by hour of day and day of week. - **Search terms.** The actual searches that triggered your ads, found under Campaigns, then Insights and reports, then Search terms. Use the same date range across all five, and compare it with a healthy period. ## Seven click farm patterns in Google Ads reports No single pattern proves anything. Two or three together, lining up with the business-layer drop, is when you should take it seriously. ### 1. Clicks rise, conversions stay flat More clicks at the same budget with no lift in leads. Farms add volume, not buyers. ### 2. Conversion rate drops with nothing changed You did not touch bids, ads, landing pages or targeting, and conversion rate fell anyway. ### 3. Clicks cluster at odd hours A burst of clicks at an hour when your customers are asleep, especially if it repeats on several days. It can point to people clicking from other time zones. ### 4. Locations outside your service area Matched locations you do not serve, or a city that suddenly accounts for far more clicks than its population would suggest. Part of this can be your own settings. The default location option, "Presence or Interest", reaches people who have shown interest in your area as well as people in it. The "Presence" option limits ads to people in or regularly in your targeted locations. ### 5. Repeated leads from the same people The same name, phone number or wording showing up in several leads, from different devices or addresses. Paid clickers sometimes fill forms to make their traffic look valuable. ### 6. Search terms no buyer would type Odd phrasing, unrelated topics, or strangely specific terms that keep triggering your broad or phrase match keywords. ### 7. Device segments that repeat too neatly One device type carrying a sudden share of clicks with almost no conversions, or traffic that looks identical session after session in your analytics. ## Why ordinary filters miss real-person farms Google filters invalid traffic with automated systems and manual review, and you are not charged for invalid clicks it catches before billing. That catches a lot of automated traffic. A farm of real people on real phones is harder. The clicks come from ordinary home and mobile connections. The browsers are genuine. Sessions include scrolling and pauses. Nothing about a single click looks wrong, which is the point. The pattern only shows when you look across many clicks and compare them with outcomes, and the ad platform does not see your outcomes the way you do. For the automated side, see bot traffic in Google Ads. ## Confirm it with lead form checks and call logs Before you block anything, check the leads themselves so you do not exclude real customers. - **Verify form fills.** Call or email a sample of recent leads. Note which ones are reachable, which ones remember contacting you, and which are fake. - **Read call logs.** Compare call times and durations with the hourly click pattern. Short, repeated calls at the same odd hours are a strong match. - **Match leads to visits.** Use the GCLID or timestamp to tie a junk lead back to its ad click, then to the address in your server logs. How to find IP addresses behind fraudulent clicks walks through it. Keep notes as you go. If you later request an investigation through Google's Click Quality Form, you will need customer ID, dates, campaigns, keywords and server log details such as IP addresses and GCLIDs, and the form only covers the last 60 days. ## Blocking a click farm, and its limits Once you have confirmed the sources, block them. Google Ads lets you exclude up to 500 IP addresses per campaign, and an asterisk in place of the last digits excludes a whole block, such as 123.45.67.*. Account-level IP exclusions apply to all campaigns, including Performance Max, where campaign-level exclusions are not available. The Google Ads IP exclusions guide has the steps. Then close the other doors. Add irrelevant search terms as negative keywords straight from the search terms report. Switch the location option to Presence if out-of-area clicks were part of the pattern. Tighten the ad schedule if the odd-hour clusters never convert. Be honest with yourself about the limits. Farms rotate addresses, so a list built by hand is always a step behind. Each new address gets at least one paid click before you can see it. And residential addresses are shared, so broad blocks can catch real customers. If you want every paid click checked and confirmed fraud sources excluded automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### What is a click farm? A click farm is a group of people, or a mix of people and devices, paid to click ads, fill forms or generate other fake activity. In Google Ads, it shows up as clicks that look human but never turn into real customers. ### Does Google refund click farm clicks? Google does not charge for invalid clicks its systems catch before billing, and credits invalid activity found later where appropriate and possible. For clicks it missed, you can submit the Click Quality Form within 60 days, but there is no guaranteed credit. ### Can I block a click farm by country? You can exclude locations you do not serve and set the location option to Presence, which limits ads to people in or regularly in your targeted areas. That helps, but farms can also operate inside your target area, so location settings are only one layer. ### How many patterns should I see before acting? One pattern on its own is weak evidence. Two or three together, matching a real drop in qualified leads, is a good reason to verify leads and start blocking confirmed sources. ### Will blocking IP addresses stop a click farm completely? No. Exclusions stop known addresses, and farms change addresses. Blocking reduces repeat waste, while lead checks, negative keywords and tighter targeting cut down what gets through. ## Sources - Google Ads Help: view matched locations and distance reports - Google Ads Help: about advanced location options - Google Ads Help: about the search terms report - Google Ads Help: IP exclusions - Google Ads Help: invalid traffic and the Click Quality Form --- ## Prevent Click Fraud in Google Ads: A Practical Checklist URL: https://blockclickfraud.com/prevent-click-fraud.md To prevent click fraud in Google Ads, you need a short set of checks that you repeat on a schedule, not a single setting you switch on once. No step below stops every bad click. Together they cut the waste you can control and leave a paper trail for the waste you cannot. ## Step 1: Read the Invalid clicks column on a schedule Google already filters some invalid traffic before you are billed. You can see how much by adding the Invalid clicks column to your campaigns table (Columns, then Modify columns). Those clicks were removed before billing, so you were not charged for them. Treat the column as a trend line, not a verdict. A rising count means Google's filters are catching more, which tells you someone is pointing traffic at your ads. It says nothing about what got through. Read it every week, on the same day, for the same date range, so a jump stands out. Check Billing, then Summary, once a month as well. Invalid activity found after billing is credited later as an "Invalid activity" adjustment, which never shows up in your campaign tables. ## Step 2: Tighten location and audience targeting Every click you invite from outside your market is a click you have to defend. Open each campaign's location settings and look at the location option. The default, Presence or interest, reaches people in your area plus people who have shown interest in it. Presence alone reaches only people who are likely to be in, or regularly in, the places you target. Google says switching to Presence usually reduces impressions, which is the point if you serve a fixed area. Then compare where clicks come from against where customers come from, and exclude regions that never convert. Loose targeting is not fraud, but it gives fraud room to hide. ## Step 3: Clean up account access Some damage comes from inside the account. Old logins, shared passwords and former contractors who still have access make it easy for someone to change settings quietly or spend your budget badly. Turn on 2-Step Verification under Admin, then Access and security, on the Security tab. Google strongly encourages every advertiser to use it. While you are on that page, read the user list. Remove anyone who no longer works on the account and give the rest the lowest access level that lets them do their job. Repeat this each quarter. ## Step 4: Record a baseline before you change anything else Before you start excluding sources, write down what normal looks like for each campaign over a recent stretch of weeks: clicks, cost, conversions, conversion rate, cost per conversion, Invalid clicks, and how traffic splits by device and by hour. If you can, take this snapshot before step 2 too, so you can tell what the targeting changes did on their own. Without a baseline, every change looks like a win or a loss depending on how the week felt. With one, you can say "conversion rate on Search is back to where it was before the spike" and mean it. ## Steps 5 to 7: Exclude sources and watch for patterns ### Step 5: Build and maintain IP exclusions When server logs show a source clicking with no sign of real interest, add it to IP exclusions. At campaign level the path is Campaigns, Settings, select the campaign, Additional settings, then IP exclusions. Google allows up to 500 addresses per campaign, and an asterisk in place of the last digits excludes a block (for example 123.45.67.*). Account-level exclusions sit under Admin, then Account settings, and apply to every campaign in the account. Our Google Ads IP exclusions guide walks through the setup. "Maintain" is the part people skip. Addresses get reassigned, and an entry that made sense in spring may block a real customer by autumn. ### Step 6: Watch repeat clickers One person clicking twice while comparing options is normal. The same source clicking across several days without ever calling or filling in a form is not. Search your server logs for repeats by IP address and by GCLID. Repeat clickers are often the easiest pattern to confirm and the easiest to block. ### Step 7: Check device and network concentration Break paid clicks down by device in Google Ads and by network in your logs. If one device type or a handful of hosting networks suddenly accounts for a big slice of clicks while conversions stay flat, look closer. People searching for a local plumber or a lawyer rarely browse from a server rack. ## Steps 8 to 10: Microsoft Ads, the monthly review and the log If you run Microsoft Ads, repeat steps 1 through 7 there. Bad sources do not care which network they click on, and an address you excluded in Google Ads can keep costing you in Microsoft Ads. See click fraud on Microsoft Ads for what is different on that platform. Once a month, compare against the baseline. Did conversion rate recover? Did cost per conversion move? Are any exclusions stale? Keep a plain log throughout: date, source, campaign, what you saw, what you blocked and why. It does two jobs. It stops you from blocking and unblocking the same address on instinct. And if you file a request through Google's Click Quality Form, which only covers the past 60 days, you will already have the dates, campaigns, IP addresses and GCLIDs Google asks for. See Google invalid click refunds. ## A weekly, monthly and quarterly rhythm Cadence What to do Weekly Read Invalid clicks, scan logs for repeat sources, add confirmed exclusions, update the log. Monthly Compare against the baseline, check Billing for invalid activity credits, prune stale exclusions, run the same checks in Microsoft Ads. Quarterly Review users and 2-Step Verification, revisit location and audience targeting, refresh the baseline. ## What no tool can do to prevent click fraud Be skeptical of anyone who promises zero fraud. Some things are out of reach for you and for any software: - The first click from a new source is paid for before anyone can judge it. An exclusion works on the next click, not that one. - Google will not confirm which specific clicks it judged invalid, so you cannot audit its filters click by click. - Campaign-level IP exclusions are not available in Performance Max. Account-level IP exclusions do apply to all campaigns, including Performance Max. See Performance Max IP exclusions for the detail. - Credits are Google's decision. Good records help a request, but nothing guarantees a refund. - A determined clicker on a fresh address every time is hard to stop with exclusions alone. What the checklist does is narrow the gap and make each decision defensible. That is a realistic goal. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### How often should I check my Google Ads account for click fraud? Run the quick checks weekly: the Invalid clicks column, repeat sources in your logs and new exclusions. Do the baseline comparison and billing review monthly. Access and targeting reviews can wait for a quarterly pass. ### Doesn't Google already prevent click fraud? Partly. Google filters invalid traffic automatically, and you are not charged for what it catches before billing. It credits some invalid activity it finds later. It does not catch everything, and it will not tell you which clicks it judged invalid. ### Should I exclude every IP address that clicks my ad twice? No. Real buyers often click more than once while they compare options. Look for repeats over several days with no calls, forms or purchases before you exclude anything. ### Can I use IP exclusions with Performance Max? Not at campaign level. Google Ads Help says campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to all campaigns in the account, including Performance Max. ### What should a click fraud log include? At minimum: the date, the source IP address or range, the campaign, what you observed, what you did and why. Keep GCLIDs where you have them. That is the same detail Google asks for in a Click Quality Form request. ## Sources - Google Ads Help: invalid clicks, credits and the Click Quality Form - Google Ads Help: exclude IP addresses - Google Ads Help: about advanced location options - Google Ads Help: secure your account with 2-Step Verification --- ## Google Ads Cost Per Click: What You Pay and Why It Rises URL: https://blockclickfraud.com/cost-per-click-google-ads.md The cost per click on Google Ads is what you pay, on average, each time someone clicks your ad: total click cost divided by total clicks. Behind that average sits an auction where your actual price for each click is set by the advertiser just below you, capped (in most cases) by your maximum bid. It rises when competition gets tougher, when your ad quality slips, or when your settings push you into pricier auctions, and the reported number can hide a higher real cost when some of those clicks were never real customers. ## What CPC Actually Measures Google defines average cost-per-click as the total cost of your clicks divided by the total number of clicks. That is all it is. It does not tell you whether the clicks were good, whether they converted, or whether some of them came from bots. It is still a useful number, because it is the price side of every return calculation you run. Cost per lead is CPC divided by your conversion rate. If CPC goes up and conversion rate stays flat, every lead costs more. If you only watch one of those two numbers, you miss half the story. ## Max CPC vs Actual CPC These are easy to mix up, and the difference explains most of the confusion around Google Ads pricing. - **Max CPC** is your bid: the highest amount you are willing to pay for a click. - **Actual CPC** is what you are charged. Google says you pay just enough to beat the Ad Rank of the competitor immediately below you. If there is no competitor below, you pay a reserve price. So your actual CPC usually sits below your max. Google also notes that actual CPC can go above your max bid when certain bid adjustments are in use. If you see clicks priced above the bid you set, check your adjustments before assuming a billing problem. For how charges reach your invoice, see our post on Google Ads click billing. ## Why Published CPC Averages Disagree (and Why to Ignore Them) Search for "average cost per click" and you will find tables that contradict each other. That is not because one is right and the rest are wrong. They measure different things: different accounts, cities, devices, date ranges and match types, all blended into one figure. Your price is set in your auctions, against your competitors, in your locations. A blended average from someone else's sample cannot tell you that. If you want to see why some sectors run hotter than others, our Google Ads per click cost by industry post covers it without made-up numbers. For your own planning, use your account data and Keyword Planner estimates for your real service area. ## What Pushes Your Cost Per Click on Google Ads Higher ### Competition Because actual CPC is tied to the Ad Rank below you, a stronger competitor below you raises your price even if your bid did not change. New entrants in your market, or a rival raising budgets before a busy season, show up in your CPC before they show up anywhere else. ### Ad quality and Ad Rank Google's Ad Rank weighs your bid, the quality of your ads and landing page, Ad Rank thresholds, the competitiveness of the auction, the context of the search, and the expected impact of your assets. Quality Score is a diagnostic tool built from three components: expected clickthrough rate, ad relevance and landing page experience. Google is clear that Quality Score itself is not an input in the auction, but the same underlying quality is. Weak relevance or a slow, off-topic landing page means you need a higher bid to hold the same position. ### Bid strategy Automated strategies set bids per auction based on the goal you give them. A strategy chasing volume can win expensive auctions you would never have bid on manually. That is not wrong, but if CPC climbs right after a strategy change, the strategy is the first suspect. ### Match types Google describes broad match as the default and says broader match types capture all the queries of narrower ones, plus more. More reach means more auctions, and some of those are crowded or only loosely related to what you sell. Phrase and exact give you more control over which auctions you enter. Review your search terms report to see where the money actually went. ### Location and schedule Ad Rank considers the searcher's location, device and time of search. Dense metros, peak hours and mobile bid adjustments can all raise what you pay. Ad scheduling and location settings let you pull back where the cost does not match the results. ## When the Reported Average Hides a Higher Real Cost Average CPC treats every billed click as equal. Some are not. Google filters invalid traffic and does not charge for what it catches before billing, but what gets past the filters is billed like any other click. Say a slice of your paid clicks comes from bots or repeat clickers with no intent to buy. Your dashboard CPC looks normal. Your cost per real visitor is higher, because the same spend bought fewer people who could become customers. That gap is what our post on the real cost of a Google Ads click breaks down. If spend is climbing while leads are not, start with Google Ads spend rising with no leads. ## Practical Controls You Can Use This Week - **Segment CPC.** Break average CPC down by campaign, keyword, device, location and hour. The average for the whole account hides where the cost lives. - **Read the search terms report.** Add negatives for searches that do not match what you sell. Our post on negative keywords and click fraud covers where negatives help and where they do not. - **Fix relevance first.** Match ad text to the search and send clicks to a page that answers it. This is the cheapest way to win positions. - **Check bid adjustments.** If actual CPC exceeds your max, an adjustment is usually why. - **Watch the Invalid clicks column** and review where your paid clicks come from. Exclude sources that keep clicking without ever converting. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### How is cost per click calculated in Google Ads? Average CPC is your total click cost divided by your total clicks. Each individual click is priced by the auction, at the amount needed to beat the Ad Rank of the advertiser below you. ### Can I pay more than my maximum CPC bid? In some cases, yes. Google says actual CPC can exceed your max when certain bid adjustments are applied. Without those, you normally pay at or below your max. ### Does a higher Quality Score lower my CPC? Quality Score is a diagnostic and not a direct auction input. The quality it reflects (expected CTR, ad relevance and landing page experience) does affect Ad Rank, and stronger Ad Rank can hold a position at a lower price. ### Why did my CPC go up when I did not change anything? Your price depends on the competitors below you, so their changes move your cost. Seasonal demand, new advertisers, and automated bidding reacting to new conditions can all raise CPC without any edits on your side. ### Should I compare my CPC to industry averages? Not in any serious way. Published averages blend many accounts, markets and settings and do not reflect your auctions. Compare your CPC to your own history and to what a lead is worth to your business. ## Sources - Average cost-per-click (Avg. CPC): Definition, Google Ads Help - Actual cost-per-click (CPC): Definition, Google Ads Help - About Ad Rank, Google Ads Help - About Quality Score for Search campaigns, Google Ads Help - About keyword matching options, Google Ads Help --- ## PPC Click Fraud: Who Clicks Your Ads and What It Costs URL: https://blockclickfraud.com/ppc-click-fraud.md PPC click fraud is any paid click made with no intention of becoming a customer, and it usually comes from a short list of sources: scripts and bots, click farms, competitors, publishers padding their own earnings, and people who keep clicking for reasons of their own. The click itself is the smallest part of the bill. The larger cost is what fake clicks do to your data, your bidding and your share of the auctions that matter. ## Who is behind PPC click fraud Google's own definition of invalid clicks covers clicks that do not reflect real interest in your business. It names accidental clicks, automated traffic from bots and deceptive software, and manual clicks meant to raise your costs or inflate publisher profits. In practice, the people and programs behind those clicks fall into five groups. ### Bots and scripts Automated traffic is the volume player. A script can load a results page, click an ad and land on your site without a person anywhere in the loop. Some are crude and Google filters them before billing. Others pass as a normal browser well enough to get through. Bot traffic in Google Ads covers what the better ones look like from your side. ### Click farms Click farms use real people, or real devices run in bulk, to click on demand. Because a human is involved, the clicks can look more natural than a script. They tend to arrive in bursts and from places you do not serve. ### Competitors This is the one advertisers worry about most, and sometimes it is real. A rival who clicks your ads each morning to drain your daily budget can do it with a phone and a few minutes. It is also easy to overstate. Plenty of "competitor clicks" turn out to be your own staff, an agency checking ads, or a customer comparing quotes. If you suspect it, read what to do when a competitor is clicking your ads before acting. ### Publisher-side clicks on display and partner placements When your ads run beyond Google Search, on Display placements or search partner sites, the owner of a site earns money when your ad is clicked. That creates a motive. A low-quality site can generate clicks on its own ad slots, directly or through paid traffic, and you pay for each one. This is why Google's definition mentions inflating publisher profits. ### Repeat clickers Some sources are not organized at all. They simply click your ad again and again over days or weeks and never call or buy. The motive could be curiosity, a grudge or a bored employee. Whatever the reason, the pattern is clear in server logs and simple to act on. See repeat clickers in Google Ads. ## What PPC click fraud costs beyond the click The obvious cost is wasted budget: money spent on visits that were never going to turn into business. Google does not charge for invalid clicks its filters catch before billing, and it may credit some it finds afterward. What gets through both checks is paid for in full, and you have no line on an invoice that tells you how much that was. Check your own account rather than trusting a headline number. Two other costs are harder to see and often larger. ## Polluted conversion data and Smart Bidding Smart Bidding strategies such as Maximize conversions, Target CPA and Target ROAS depend on conversion tracking. Google's models learn from your conversion history and from signals present at each auction, including device, location, time of day, browser, operating system and the search query, to predict which bids are likely to convert. Fake traffic feeds that system bad lessons in two ways. If bots trigger conversions (a form fill, a page view counted as a goal, a click on a phone number), the bidder learns to chase more of the traffic that produced them. If fraud lands without converting, it drags down conversion rate on the segments it hits, and the bidder may pull back from times or places where your real customers actually are. Either way, your bidding starts to reflect the fraud instead of your buyers. The same pollution reaches your reports and GA4. Conversion rate by campaign, cost per lead and audience performance all become harder to trust, and decisions built on them inherit the error. That is why high click rates with low conversions deserve a look before you rewrite ads or raise bids. ## Lost auction share Most small accounts run on a daily budget. If fake clicks use up that budget early in the day, your ads stop showing until the next day. The buyers who search in the afternoon see a competitor instead. You did not just pay for bad clicks, you also missed the good ones that would have followed. The effect compounds on high-cost keywords. A handful of fake clicks on an expensive term can take out a large part of a small budget, and in markets where one lead is worth a lot, a missed afternoon is a real loss. ## What you can stop - **Known bad sources.** IP exclusions let you block up to 500 addresses per campaign, with an asterisk to cover a block of addresses, plus account-level exclusions that apply to every campaign in the account. - **Weak placements.** Placement exclusions keep ads off specific sites, apps and videos. Account-level placement exclusions also apply to the Search Partner Network. - **Clicks from outside your market.** Tighter location settings and region exclusions cut traffic you never wanted. - **Repeat clickers.** Once a source shows the pattern, excluding it stops the bleeding from that source. - **Some of the money.** With good records, you can ask Google to investigate through the Click Quality Form for activity in the past 60 days. ## What you cannot stop - **The first click from a new source.** No one can judge a click before it happens. Exclusions protect you from the next one. - **Sources that rotate addresses.** A clicker who changes IP every visit is hard to stop with exclusions alone. - **Campaign-level IP exclusions in Performance Max.** They are not available there, although account-level IP exclusions do apply to Performance Max. See Performance Max IP exclusions. - **A guaranteed refund.** Google decides on credits, and it will not confirm which specific clicks it judged invalid. Knowing which list a problem belongs on saves you from paying to fight what cannot be fought, and from ignoring what can. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### How much of my budget goes to PPC click fraud? There is no reliable single figure, and it varies widely by industry, network and targeting. Start with the Invalid clicks column, then compare conversion rate and repeat sources against your own baseline. That tells you more about your account than any published average. ### Do competitors really click on each other's ads? Sometimes, but less often than advertisers assume. Before you blame a rival, rule out your own team, agencies checking ads and genuine customers comparing options. A confirmed pattern from one source is worth excluding regardless of who is behind it. ### Why does click fraud hurt Smart Bidding? Smart Bidding learns from your conversion data and auction signals. Fake conversions teach it to buy more fake traffic, and fake non-converting clicks can push it away from segments where real customers are. Either way, bids drift away from your actual buyers. ### Are Display and search partner placements riskier than Google Search? They carry a risk Search does not: the site showing your ad earns money when it is clicked. You can limit that with placement exclusions and by reviewing where your ads appeared. Whether to run those networks at all is a call to make from your own conversion data. ### Does Google refund fraudulent clicks? Google does not charge for invalid clicks its filters catch before billing, and it may credit invalid activity found later as an "Invalid activity" adjustment. You can request an investigation for the past 60 days, but Google decides the outcome and does not confirm which clicks were invalid. ## Sources - Google Ads Help: invalid clicks - Google Ads Help: about Smart Bidding - Google Ads Help: exclude specific webpages and videos - Google Ads Help: exclude IP addresses - Google Ads Help: invalid clicks, credits and the Click Quality Form --- ## Does Click Fraud Protection Actually Work? A Skeptic's Read URL: https://blockclickfraud.com/does-click-fraud-protection-work.md Does click fraud protection work? Sometimes, on some campaign types, against some kinds of invalid traffic, and the honest answer has more conditions attached than any vendor wants printed on their homepage. This piece is written for the reader who assumes the category is half snake oil, because that reader is asking the right questions and deserves answers rather than a testimonial. We sell one of these tools. Read everything below with that in mind. The argument here is not that you should buy ours, it is that you should run a test capable of embarrassing us, and then believe the result. If you want the mechanics first, the overview of click fraud protection explains what the software is doing. ## The case for skepticism is strong Start with the problems, because they are real and most vendor content skips them. **The dashboards grade their own homework.** A tool that reports it blocked 400 clicks is reporting its own definition of a block, counted by its own software, with no independent check. If the same software decides what counts as fraud and then counts how much fraud it stopped, the number cannot falsify itself. That is not a scandal, it is just a metric you should not trust as evidence. **The savings figures are usually invented.** Any claim of a specific percentage saved depends on knowing what those blocked clicks would have done, and nobody knows that. The honest version is a ceiling, not a figure. **Google is already doing some of this.** Google issues automatic credits for clicks it deems invalid and does not disclose the criteria it applies. So part of your waste was already being handled before you bought anything, and a tool can easily take credit for it. Checking Google's invalid click refunds on your own statements is the first control you should apply to any vendor's claims. **Blocking is always late.** Exclusions only stop future impressions. The first click from any new source is always paid for. A tool that promises prevention is selling you the prevention of repeats, which is a smaller and more specific product than the marketing implies. ## Where click fraud protection does work Having conceded all that, here is the part that holds up. Repeat sources are genuinely stoppable. The advertiser losing money to the same handful of addresses hitting their ads every day is the clearest case in the category. Those sources are identifiable, they persist long enough to be excluded, and a campaign IP exclusion stops the ad being shown to them so no further click is billed. That is a concrete, mechanical saving and it does not require anyone to trust a black box. Low-grade automated traffic is also stoppable to a degree. Basic scrapers and crawler traffic tend to behave consistently and come from ranges that stay stable for a while. They are not sophisticated adversaries and they do not need to be caught by anything sophisticated. The reporting has value even where the blocking does not. Knowing which geographies, hours and devices produce clicks that never convert lets you change bids, schedules and targeting yourself. On campaign types where exclusions do not apply at all, this is sometimes the entire benefit, and it is a real one as long as you are the sort of person who will act on it. ## Where it does not work Campaign-level IP exclusions are not available in Performance Max. Account-level IP exclusions do apply to it, but that list holds 500 addresses for the whole account, so whatever goes in has to earn its place. Ask any vendor which level they write to, and how they decide what fills those 500 slots. A single determined human is also beyond it. Someone clicking your ads from a phone on mobile data can rotate addresses faster than any exclusion list can follow, and Google Ads allows up to 500 IP exclusions per campaign, so you cannot simply keep adding entries forever. Against a motivated individual, protection software loses. Large shared networks are the third weak spot, and this one can cost you money rather than just failing to save it. Office buildings, universities and some carrier networks put many genuine people behind one address. Block it and you have blocked customers. This is the failure mode worth watching for most closely. ## The test that settles whether click fraud protection works for you Forget the dashboard entirely. Run this instead. - **Pick two comparable campaigns.** Similar spend, similar keywords, similar geography. Protect one. Leave the other alone. - **Run it for a full month.** Two weeks of data will not separate a real effect from ordinary variation, and you will fool yourself in either direction. - **Measure cost per conversion, not clicks.** Clicks going down proves only that something got blocked. Cost per conversion going down proves the blocked traffic was worthless. Those are different claims and only the second one matters. - **Check conversions in absolute terms too.** If both clicks and conversions fall together, the tool is blocking buyers. Turn it off or loosen it. - **Account for the credits.** Pull your invalid click credits from Google for both months so you are not counting the same saving twice. At the end of the month you will have an answer that belongs to you rather than to a vendor. If cost per conversion improved on the protected campaign and held steady on the control, the tool did something. If nothing moved, it did not, and you should stop paying for it regardless of what its reports say. ## What a fair verdict looks like Click fraud protection is not a scam and it is not a force field. It is a narrow tool that reduces repeat waste from identifiable sources on campaign types that support exclusions, and it produces traffic reporting that can be useful even where blocking is unavailable. For advertisers with high cost per click and visible repeat patterns, that is worth paying for. For advertisers with cheap clicks or low volume, it often is not. The category earned its reputation for overclaiming, and a buyer who walks in skeptical will make a better decision than one who walks in hopeful. Test it against a control, measure the number your business runs on, and let the account decide. --- ## ClickCease Alternatives: An Honest Comparison URL: https://blockclickfraud.com/clickcease-alternatives.md If you are shopping for a ClickCease alternative, the first thing worth saying is that ClickCease is a competent product with a long track record, and most comparison pages you will find on this subject are written to hide that. This one does not. The category is small, the tools overlap heavily, and the differences that matter are rarely the ones on the feature grid. What follows is a read on why people switch, what the established options genuinely do well, and the handful of questions that will tell you more in five minutes than an afternoon of comparison tables. If you want the background on how any of these tools work in the first place, start with the overview of click fraud protection and come back. ## Why people look for a ClickCease alternative The reasons cluster into four, and only two of them are about the product. **Price at scale.** The most common trigger is an account that grew. A tool that felt reasonable on one site starts to feel expensive across eight, particularly for agencies adding clients. This is a pricing-model problem more than a product problem, and it affects most vendors in the category the moment you cross whatever their tier boundary happens to be. **Support responsiveness.** The second most common. When something stops syncing with Google Ads, the gap between a same-day answer and a three-day answer is the gap between a fixed campaign and a wasted week. Every vendor in this space has happy customers and frustrated ones on this point, and neither group is lying about their experience. **Wanting a second opinion.** Some people switch because they cannot tell whether the tool is doing anything, and a different vendor's read on the same traffic is the cheapest way to find out. That is a reasonable instinct. Run both and compare what each one flags. **Feature fit.** Platform coverage varies. Some tools focus on Google Ads, others spread across Meta and Microsoft and beyond. If your spend has moved, the tool that fit two years ago may not fit now. ## What the established tools actually do well Conceding this is not weakness, it is the part that makes the rest of the comparison credible. The incumbents in this category have years of traffic data behind their detection, which matters. Pattern recognition improves with volume, and a vendor that has processed traffic across tens of thousands of accounts has seen abuse patterns a newer tool has not. That is a genuine advantage and no amount of marketing from a challenger makes it go away. They also tend to have polished onboarding. The install is usually a tag or a plugin, the Google Ads connection is a standard OAuth flow, and the first report arrives quickly. Newer tools are often rougher here. Integrations are broader too. Established vendors have had time to build connections into Shopify, WordPress, tag managers, and reporting stacks. If your setup is unusual, the odds that an incumbent already supports it are better. And the reporting is mature. Whether you find the dashboards useful is taste, but they are generally complete and exportable, and they have been iterated on by a lot of customers complaining about them. ## Where the differences actually sit Underneath the branding, every tool in this category does the same three things: it records post-click behaviour, it decides which visitors are worthless, and it pushes exclusions into your ad account. The third step is essentially identical everywhere, because it uses Google's own API and Google's own rules. So the differences live in step two, the deciding, and in the commercial terms around it. Detection quality is real but almost impossible to assess from outside, since no vendor publishes its logic and no vendor should. The only way to compare it is to run two tools on similar traffic and see whether they flag the same things. The commercial terms are easier to assess and people ignore them. Whether a plan is billed per site or as a share of your ad spend changes the economics completely as you grow. A percentage-of-spend model means your protection bill rises every time you scale a campaign, which is a strange incentive to sign up for. A per-site model is flat and predictable but can be poor value if you run one site with enormous spend. ## What to demand from any ClickCease alternative Five questions. Ask all of them, of every vendor, including us. - **How do you handle the 500-exclusion ceiling?** Google Ads allows up to 500 IP exclusions per campaign. Every tool hits that limit eventually on an active account. What happens next, and who decides which exclusions get dropped, is a real product difference. - **What do you do about Performance Max?** Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to it. Ask whether the vendor writes to the account-level list, and how they handle its 500-address limit. - **Is blocking applied in Google Ads, or only at my server?** A server-side block happens after the click was already billed. A campaign IP exclusion prevents the ad being shown at all. Only the second one saves money on the next click. - **What are the cancellation terms?** Annual commitments sold as discounts are common in this category. So is cancellation that requires emailing support. Find out before you sign, not after. - **Can I trial it on one campaign?** If a vendor will only trial across your whole account, you lose the ability to keep a control group, and a control group is the only way to know what the tool did. ## Running the comparison yourself Pick two tools. Install both if their terms allow it, or run them in sequence on the same campaign across two comparable months. Look at three numbers: clicks, conversions, and cost per conversion. Ignore the number of blocks each dashboard reports, because that figure is defined differently by every vendor and comparing them is meaningless. Before you start, check what you are already getting for free. Google issues automatic credits for invalid clicks without disclosing the criteria it applies, so part of your waste is already being handled. The explanation of Google's invalid click refunds covers how to spot those credits on your account, which stops you crediting a tool for something Google did. ## The honest summary There is no tool in this category that wins on every dimension, and anyone telling you otherwise is selling. ClickCease is established and capable. So are several of its competitors. The right choice depends on how many sites you run, whether your spend sits in campaign types that support exclusions, how much you value responsive support, and whether the pricing model punishes you for growing. Work out which of those matters most to you, then ask the five questions. The answers will narrow the field faster than any comparison table, including this page. --- ## What Click Fraud Protection Actually Costs (And What You Get) URL: https://blockclickfraud.com/click-fraud-protection-pricing.md Click fraud protection pricing is not complicated once you see the four models the whole category uses, but vendors rarely lay them out side by side because the comparison is unflattering to some of them. This piece explains each model, who it favours, and how to work out what you would actually pay over a year rather than what the pricing page implies in month one. No specific dollar figures appear here for any vendor including us, and that is deliberate. Prices in this category change often enough that any number written into an article is wrong within a few months. Models change slowly. Numbers do not. If you want the background on what you are buying in the first place, the overview of click fraud protection covers the mechanics. ## The four click fraud protection pricing models **Flat monthly fee per site.** You pay a set amount to protect one domain, and more sites cost more. Predictable, easy to budget, and the model most small businesses find easiest to reason about. The weakness is that it ignores volume entirely, so a site with tiny spend pays the same as one with heavy spend at the same tier. **Tiered by ad spend.** The plan you need is determined by how much you spend on ads each month, with thresholds you move between. This tracks value more closely than a flat fee, since heavier spenders have more to lose. It also means a good month in your business creates a bill increase in your software, which some people find reasonable and others find irritating. **Percentage of ad spend.** A direct cut of what you spend. This is the model to think hardest about. It scales without limit, so as your campaigns grow your protection bill grows in lockstep, and it creates an odd incentive structure where the vendor benefits from you spending more rather than spending better. It can still be the right choice for a small advertiser, because the percentage of a small budget is a small number. **Per-tier site counts.** Plans are defined by how many domains or ad accounts they cover, with agency tiers at the top for people managing many clients. This is the model that suits agencies and multi-location businesses best, since the cost per site falls as the count rises. Most vendors use a blend, usually site count crossed with some spend threshold. Read the plan table for both axes, because the second one is often in smaller type. ## What the price actually buys you Across the category, the base subscription typically covers detection, automatic exclusion syncing to Google Ads, and reporting. That is the core product and it is broadly similar everywhere. What sits outside the base plan varies, and this is where a quoted price and a real price separate. Watch for these: - **Extra ad accounts.** A plan covering one site may or may not cover multiple Google Ads accounts pointing at it. - **Additional platforms.** Coverage beyond Google Ads is frequently an add-on rather than included. - **Data retention.** Lower tiers often keep less history, which matters when you want to compare this quarter to last. - **Seats.** Agencies especially should check whether client logins or team members cost extra. - **Support level.** Some vendors put faster response times behind higher tiers. If a broken sync costs you a week of wasted spend, that tier difference is not cosmetic. ## How to calculate whether click fraud protection pricing makes sense Run this before you sign anything. It takes about ten minutes with your Google Ads reporting open. Take your average cost per click across the campaigns you plan to protect. During a trial, note how many clicks the tool blocked in the month. Multiply the two. That product is the absolute ceiling on what the tool saved you, and it is genuinely a ceiling rather than a result, because some of those blocked clicks would never have converted anyway and some would have been credited back by Google without any tool involved. The breakdown of Google's invalid click refunds explains how to find those credits on your own account so you do not pay a vendor for work Google already did. Now compare that ceiling against twelve months of subscription, not one. If the annual cost is close to the monthly ceiling, the maths is not there. If the ceiling is several times the subscription, it probably is, even allowing for the fact that the real saving is somewhere below the ceiling. Then do the harder check. Look at cost per conversion before and after, on the protected campaign against an unprotected control. That number does not care about anybody's definition of a blocked click, and it is the one your business actually runs on. ## Contract terms that cost more than the price The subscription is rarely the expensive part. These are. **Annual commitments framed as discounts.** Two months free sounds good until you are four months into a tool that does not fit and have eight months left. If you have not run a trial, do not take the annual deal. **Auto-renewal with a short cancellation window.** Some agreements require notice before renewal, and the window can be narrow. Put the date in your calendar the day you sign. **Cancellation by support ticket.** If there is no cancel button, the process is designed to take time. Ask before signing how cancellation works, and keep the answer in writing. **Spend-based tiers with no downgrade path.** Check that you can move down a tier as easily as you moved up. Seasonal businesses get caught by this every year. ## How BlockClickFraud is structured Our plans are organised by the number of sites you protect. The starter tier covers a single site, mid tiers cover a larger number, and agency tiers are sized for managing many client accounts under one login. We keep specific figures out of articles like this one, because a number written into an article drifts out of date. What we will say plainly is that the model is site count rather than a percentage of your ad spend, so scaling a campaign does not scale your bill with it. ## The short version Work out which model you are being offered before you look at the number attached to it. Flat per-site pricing suits stable single-site advertisers. Spend-tiered pricing suits people whose budgets are steady. Percentage-of-spend pricing suits small budgets and punishes growth. Site-count tiers suit agencies and multi-location operators. Then run the cost-per-click arithmetic against twelve months of fees, not one, and insist on a single-campaign trial before you commit to anything annual. A vendor confident in the product will not fight you on that. --- ## What One Fraudulent Click Costs in Criminal Defense and Personal Injury URL: https://blockclickfraud.com/cost-of-fraudulent-click-legal-ppc.md Legal PPC cost per click sits at or near the top of every paid search category, which is why a single fraudulent click does more damage in criminal defense or personal injury than it does almost anywhere else. The number that matters is not an industry average. It is the number in your own account, multiplied by the volume of clicks that were never going to become a case. This post shows you how to work that out, and why the direct cost is only part of the bill. It sits alongside our broader look at click fraud in law firm advertising. ## Why you should ignore the published numbers Search for the average cost per click in legal and you will find a spread of confident figures. Most of them trace back to a handful of sources that were estimating, and everyone since has cited each other. Google does not publish official cost per click tables by vertical. Anyone quoting a precise dollar amount as fact is quoting something they cannot verify. What is genuinely established is the ranking. Legal keywords are consistently among the most expensive in paid search, and within legal, the categories tied to high case value cost the most. That is enough to reason with. Your own account has the real number. Open it, look at your actual average cost per click by campaign, and use that. It is the only figure that describes your situation. ## The direct cost: what you pay for nothing Start with the simple calculation. - Take your actual average cost per click for your highest-spend campaign. - Estimate the share of clicks that produced no meaningful engagement. Sessions of a few seconds, no scroll, no call, no form. - Multiply by your monthly click volume. That gives you the money you handed over for traffic that was never going to hire anyone. For a firm competing on high-value terms, even a modest waste rate produces an uncomfortable monthly figure, because the legal PPC cost per click multiplier is unforgiving. Do the arithmetic yourself rather than accepting anyone's estimate. You will trust the result more, and you will be right. ## The indirect cost: the hours you were invisible This is the part that does not appear anywhere in your reporting, and it is usually bigger. Your campaigns run on a daily budget cap. When the cap is reached, your ads stop serving for the rest of the day. So the question is not only how much the bad clicks cost. It is what time of day they happened. If worthless clicks consume your budget by eleven in the morning, you are absent from the auction for the entire afternoon and evening. In criminal defense, that means you are missing the calls that come after arraignments and after people get home and start looking. In personal injury, you are missing the searches that happen once someone leaves the emergency room. Those searches did not disappear. They went to whichever firm was still showing. You paid for the privilege of not being there. ### Why this is worse in legal than in retail An online retailer losing afternoon visibility loses some sales. The relationship is roughly linear and each sale is worth a predictable amount. Legal does not work that way. Case values vary enormously, and the difference between a normal month and a very good month can be one signed case that came from one search at one moment. You cannot know which search you missed. You only know you were not there for any of them. ## Where the waste concentrates Not all clicks are equally likely to be worthless, and not all keywords cost the same. The damage clusters where those two facts overlap. ### Your most expensive keywords Terms with high commercial intent and high case value cost the most and attract the most attention from competitors and lead resellers. The waste and the price meet on the same keywords. ### Search partners and Display If your search campaigns have partner sites or Display enabled, some of your budget is going to placements you never selected and cannot inspect. Segment your reporting by network. Firms are regularly surprised by what is sitting there. ### Broad location settings The default location setting reaches people who show interest in your area as well as people actually in it. For a firm that can only take cases in one jurisdiction, that is paying legal-vertical prices to reach people who cannot become clients. ## What you can recover, and what you cannot Google filters some invalid traffic automatically and issues credits without you asking. That is genuine money back. The problem is that Google does not disclose its detection criteria, so you cannot see which clicks were flagged, how many were missed, or whether the credit is proportionate to the damage. Our page on Google's invalid click refunds explains what that process covers. What you never get back is the auction time. There is no credit for the three hours you were dark. Google returns the click cost, not the case. This is why prevention matters more in legal than in cheaper verticals. Recovering the click fee is a partial remedy in a category where the fee is the smaller loss. ## Turning the number into a decision Once you have your own figure, the decision becomes ordinary business arithmetic rather than a matter of principle. Compare your estimated monthly waste against the cost of stopping it. If your waste is a small fraction of a modest monthly fee, the honest answer is to fix the free things and move on: tighten location targeting to presence only, cut search partners and Display from search campaigns, exclude your office IP addresses. If your waste is several multiples of that fee, the calculation makes itself, and automated click fraud protection pays for itself in the first month. Most firms advertising seriously on high-value legal terms land in the second group, because the legal PPC cost per click is high enough that even a small waste percentage produces a large absolute number. But run it for your own account before you decide. Anyone who tells you the answer without seeing your data is selling something. Start with the time of day your budget runs out. That single data point tells you more than any published benchmark will. --- ## Local Services Ads Fraud: What Google Does and Does Not Refund URL: https://blockclickfraud.com/local-services-ads-fraud.md Local Services Ads fraud works differently from click fraud in Google Ads, and if you run both, confusing the two will cost you money. LSA charges you per lead rather than per click, and Google handles bad leads in two layers: it screens leads before charging you, then reassesses charged leads and credits the ones it later finds invalid or low quality. Your part is to review leads, give feedback on the bad ones, and know which kinds of leads Google no longer credits at all. Plenty of firms run LSA alongside search campaigns and assume the same protections apply to both. They do not. This post covers what Google credits on the LSA side and what stays on your tab. It fits into the wider picture we lay out on click fraud in law firm advertising. ## How the LSA billing model changes the exposure In Google Ads you pay for a click. In LSA you pay when someone contacts you through the ad: a qualifying call, a message or a booking. That looks safer, because you pay for contact rather than curiosity. In practice it shifts the problem rather than removing it, because the unit price is much higher. A wasted click is annoying. A charged lead that turns out to be spam or a wrong number is a bigger single hit. ## How Google credits bad Local Services Ads leads now ### Screening before you are charged Google says leads it determines to be invalid or low quality when the customer makes contact are not charged. Some of the junk never reaches your invoice. ### Automatic credits after you are charged Charged leads are reassessed later, and Google may issue credits automatically for leads it then judges low quality. In most cases those credits are applied to your account balance within 30 days. The original charge stays on the invoice and the credit shows as a balance adjustment, so read both. Google also notes that some poor leads can still be charged in the first 24 hours before the automatic credit catches up. ### Your feedback on charged leads If a charged lead still looks wrong, open it in the Leads section of your LSA account and use Rate this lead to give feedback. Google describes credits that can follow that feedback. Do it while the lead is fresh and your intake notes are clear, and keep your own record of what you flagged and what was credited. ## What Google will not credit This is the part that catches firms out, and it has changed. ### Wrong job type and outside your area Google's help page says automatic credits are no longer offered for "job type not serviced" and "geo not serviced" leads. A caller about a practice area you do not handle, or from a place you do not serve, is now largely your cost. The fix is upstream: tight service areas and precise job types in your profile. ### Certain categories and regions Google says lead credits are not available for health care verticals, tax specialists or advertisers in EMEA. If you are in one of those groups, screening still applies, but do not budget on credits. ### The prospect who was real but did not hire you Someone genuinely in your area with a genuine problem who then signed with another firm is a legitimate lead. You pay for it, correctly, even though it stings. ### The tire kicker People after free advice, people calling seven firms, people with a case you would never take. Real humans with a real question. Chargeable. ## What Local Services Ads fraud actually looks like Because the pricing is per lead, the bad behavior shows up as contacts rather than click volume. - **Calls that end just past the billing threshold.** Long enough to charge, short enough to contain nothing. - **Repeat calls from different numbers with the same shape.** Same script, same lack of detail, same abrupt ending. - **Callers who cannot describe their own situation.** Someone with a real legal problem can tell you what happened. Someone generating a charge cannot. - **Clusters after your ranking improves.** Movement in LSA sometimes attracts attention from firms below you. Record and review calls where your jurisdiction allows it, with whatever notice requirements apply. Your intake team already knows which calls felt wrong. Give them a way to flag it at the time, so the feedback goes in while the details are clear. ## Practical steps for firms running LSA ### Review leads weekly Put a recurring slot in someone's week. Check every charged lead from the past seven days, compare the invoice against credits that have posted, and rate the leads that look invalid. ### Get your service area and job types right Since out-of-area and wrong-job-type leads are no longer credited automatically, an overly broad profile now costs you directly. Tighten both to what you actually take on. ### Keep a simple log Record what you flagged and what Google credited. Over a few months you learn where the line really sits for your account, which is more useful than any general description of the policy, including this one. ### Do not neglect the Google Ads side Most firms running LSA also run search campaigns, and that side works differently. Google Ads does not charge for invalid clicks its filters catch before billing, credits some invalid activity it finds later, and lets you request an investigation of the past 60 days through the Click Quality Form. Our page on Google's invalid click refunds covers it, and that is also where click fraud protection does its work. ## Frequently Asked Questions ### Am I charged for spam calls through Local Services Ads? Often not. Google screens leads when the contact is made and does not charge for the ones it judges invalid or low quality. Charged leads are also reassessed, and credits can be applied automatically, usually within 30 days. ### Can I still flag a bad LSA lead myself? Yes. Open the lead in the Leads section and use Rate this lead to give feedback. Google describes credits that can follow that feedback, but it decides each one. ### Why was an out-of-area lead not credited? Google no longer offers automatic credits for "geo not serviced" or "job type not serviced" leads. Narrow your service area and job types so those leads are less likely to reach you. ### Are LSA credits available in every industry? No. Google says lead credits are not available for health care verticals, tax specialists or advertisers in EMEA. ### Do Google Ads invalid click credits cover Local Services Ads? No. They are separate systems. Google Ads handles invalid clicks with its own filtering, credits and Click Quality Form, while LSA uses lead screening, lead credits and feedback. ## Sources - Google Local Services Help: troubleshooting invalid leads - Google Ads Help: Local Services Ads lead credits - Google Ads Help: managing invalid traffic --- ## Good Bots You Must Never Block (Googlebot, AdsBot, and Friends) URL: https://blockclickfraud.com/good-bots-never-block.md The whole trick is to block bots without blocking Googlebot, and plenty of advertisers get this wrong in the first week of trying to clean up their traffic. Automated visits are annoying, blocking feels like progress, and the crawlers that keep your business visible are the easiest ones to catch by accident, because they are the only ones honest enough to say who they are. The fraud does not identify itself. Googlebot does. Guess which one a crude rule catches first. For the wider picture of what you are defending against, see our overview of bot traffic in Google Ads. This page is about what has to stay reachable while you do it. ## The crawlers that have to keep getting through ### Googlebot This is the crawler that indexes your site for organic search. Block it and your pages stop being refreshed in the index, then stop ranking. Nothing in your ad account will warn you. You find out when your organic traffic quietly falls over a few weeks and somebody asks why. ### AdsBot-Google This one checks your ad landing pages. It fetches the destination to assess the page behind your ads, and it is directly connected to how your ads are treated. Blocking AdsBot is a genuinely self-inflicted wound: you are paying for ads while preventing Google from looking at where they point. Worth knowing that AdsBot does not follow the same blanket robots.txt rules as ordinary crawlers, which trips up people who write a broad disallow and assume they have covered everything. ### Google-InspectionTool and the rendering fetchers These support Search Console testing and URL inspection. If you have ever run a live test and got a result that did not match what you see in a browser, a block somewhere in the stack is one of the usual suspects. ### The other search engines Bingbot matters more than most people assume, partly because of where Bing results end up. There are also regional engines that matter a great deal in specific markets. Losing them is not fatal but it is free traffic thrown away. ### Social and messaging preview fetchers When someone shares your link on a social platform or in a messaging app, a fetcher grabs the page to build the preview card. Block those and your links get shared as bare URLs with no title and no image, which measurably reduces the number of people who click them. ### Your own monitoring Uptime checks, performance monitors, accessibility scanners, your SEO tooling. All automated, all yours, all easy to block by mistake and then spend an afternoon debugging. ## How to block bots without blocking Googlebot The rule that keeps people safe is short: never block on a broad pattern in the user agent string. Blanket rules that catch anything containing "bot", "crawl" or "spider" are the single most common way sites take out their own indexing. Those words appear in the names of exactly the crawlers you need. Meanwhile the traffic you were trying to stop declares itself as Chrome on Android, so the rule misses it entirely. You get the worst of both outcomes: your rankings suffer and the fraud continues. Three habits prevent most of this. - **Verify before you trust a name, and verify before you block one.** A user agent is a claim. Anyone can put "Googlebot" in theirs, and some do, hoping for preferential treatment. Google publishes the means to confirm whether a request genuinely came from its crawlers, and that check is the right way to settle it either way. - **Keep robots.txt and blocking separate in your head.** Robots.txt is a set of instructions for well-behaved crawlers. It has no enforcement whatsoever. Honest bots follow it, dishonest ones ignore it, so it is a directive for the good ones and irrelevant to the bad ones. It is not a security control and it is not a fraud defence. - **Check your logs after any change.** If crawler visits drop to zero after you tighten something, you did not just stop fraud. Nobody sends an alert for this. ## Why the distinction is easy to lose The industry split explains it cleanly. Declared crawlers are general invalid traffic: they identify themselves in the user agent, they follow published conventions, and they are trivially identifiable because they are not hiding. Sophisticated invalid traffic is the opposite by definition, since concealment is the whole point. So the honest bots are the visible ones and the dishonest bots are the invisible ones. Any defence built on what traffic says about itself will therefore hit precisely the wrong targets. That is not a subtle failure mode, it is the predictable result of the approach. It is also worth being clear that declared crawler traffic is not your ad fraud problem. Those visits are not clicking your ads. Google filters that category well and issues automatic credits for invalid clicks it identifies, though what that does and does not cover is a longer story, which we go through in what Google's invalid click refunds leave behind. ## What breaks, and how long it takes you to notice The cruel part of this is the delay. Block Googlebot today and today looks fine. Rankings decay over weeks as the index goes stale. Ad landing page assessments degrade quietly. Shared links stop generating previews and nobody reports it, because nobody notices a card that is not there. By the time the damage is visible, it is rarely connected back to a firewall rule somebody added a month ago to stop some annoying traffic. That is why this is worth getting right the first time rather than discovering it later. ## Doing this without breaking anything The workable position is that identity is not something a visitor gets to assert. Verify the crawlers that claim to be important, ignore robots.txt as a defence, and judge unknown traffic on what it does rather than on what it says it is. That is also why a dedicated layer beats hand-written rules. Click fraud protection is built to keep legitimate crawlers reachable while acting on traffic that is demonstrably not a customer, which is exactly the distinction a user agent rule cannot make. If you take one action from this page, go and read your current blocking rules with fresh eyes. Look for anything matching on a wildcard in the user agent. That is where the accidental damage usually lives, and it has probably been there longer than you would like. --- ## Can You Sue or Report a Competitor for Click Fraud? URL: https://blockclickfraud.com/report-competitor-click-fraud.md To report click fraud to Google Ads, use the Click Quality Form in Google Ads Help, which covers activity from the past 60 days and asks for your logs. Google's own list of invalid traffic names "competitors who manually click to increase your spend", so a competitor clicking your ads is exactly what that form is for. Suing is a separate question that depends on your jurisdiction and your evidence, and that is one for a lawyer, not for Google. ## What Google Counts as Competitor Click Fraud Google Ads Help describes invalid traffic as clicks and impressions that do not come from real interest. Its examples include automated clicks, publishers paying people to click, and competitors who manually click to increase your spend. Google says the list is not exhaustive. That matters for two reasons. First, you do not need to prove who the competitor is for Google to act. Google judges the traffic, not the identity. Second, a lot of competitor clicking is already filtered. Google uses automated filters, machine learning and manual review, and you are not charged for invalid traffic it catches before billing. Before you file anything, rule out the clicks that look like a competitor but are not. Your own staff, your agency checking ads, shared office networks and real comparison shoppers all produce repeat clicks. Our guide to a competitor clicking your ads covers how to tell them apart. ## How to Report Click Fraud to Google Ads The route is the Click Quality Form, linked from the invalid traffic article in Google Ads Help. It covers activity from the last 60 days, so anything older is out of reach. Google asks for: - Your Google Ads customer ID. - The date range of the suspicious activity. - The campaign and ad group names involved. - The keywords you think were targeted. - Web server logs showing IP addresses, device details and GCLIDs. - Lead details if the problem is junk leads rather than empty visits. - A plain explanation of why the traffic looks wrong to you. Google says reviews typically take several business days. If it agrees, the credit shows up as an "Invalid activity" adjustment under Billing, then Summary. It will not tell you which specific clicks it ruled invalid, and it keeps its detection methods confidential. More on that process in Google invalid click refunds. ## The Evidence That Makes a Report Worth Filing A report that says "I think my competitor is clicking" gets little traction. A report with dated records does. The useful pattern is the same source, clicking paid ads repeatedly, over days or weeks, without reading, calling or filling in a form. Google Ads does not show you the IP address behind a click, so that record has to come from your own site. Server logs, or a tool that logs each paid visit with its GCLID, give you something Google can match against its own data. Our page on finding the IP addresses behind fraudulent clicks covers where to look. If you only start collecting after you notice a problem, the 60-day window means you may already have lost part of it. ## Can You Sue a Competitor for Click Fraud? Possibly, but it is not a Google Ads question and this is not legal advice. Whether a competitor's clicking gives you a claim, and under what law, depends on where you and they are and on the facts. If you are thinking about it, speak to a lawyer licensed where you operate. What any lawyer will want first is the same thing Google wants: evidence that ties specific paid clicks to a specific party, with dates, and a figure for what it cost you. That is the hard part. Most advertisers can show a pattern from an address. Far fewer can show who was behind that address. Shared networks, VPNs and mobile carriers make it harder still. Some practical points before you spend money on it: - Do not contact the competitor. Without strong proof it tells them what to change and can create problems for you. - Keep your records intact and unedited. Export logs and click records with dates. - Weigh the cost of a legal fight against the cost of the clicks. Blocking the source usually costs less. ## Blocking Usually Beats Suing Whatever you decide about reporting, stop the bleeding. Once a source is confirmed, exclude it so your ads stop showing to it. - **Campaign level.** Campaigns, select the campaign, Settings, Additional settings, IP exclusions. Up to 500 addresses per campaign, with an asterisk to cover a block such as 123.45.67.*. - **Account level.** Campaign-level IP exclusions are not available for video, hotel, app, Performance Max and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max. Exclusions do not reverse clicks already billed, and a competitor who changes address gets through until the new one is spotted. They do stop the repeat damage, which is usually most of it. The Google Ads IP exclusions guide covers how to keep a list clean. ## When to Report, When to Just Block Situation Reasonable move One address, a handful of clicks Exclude it and keep a note A pattern over weeks, within the last 60 days, with logs Exclude it and file a Click Quality Form Large, sustained losses tied to a party you can identify Exclude, file with Google, and talk to a lawyer A hunch with no records Start logging paid clicks now Automated click fraud protection handles the first and last rows for you: it logs each paid click with a verdict and the reason, writes confirmed sources into your exclusion lists, and gives you records to attach to a report. It cannot stop the very first click from a new source, and it cannot guarantee a refund. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### How do I report click fraud to Google Ads? Use the Click Quality Form linked from Google Ads Help's invalid traffic article. Include your customer ID, dates, campaigns, ad groups, keywords and server logs with IP addresses, device details and GCLIDs. It covers the past 60 days. ### Does Google treat competitor clicks as invalid? Yes. Google's examples of invalid traffic include competitors who manually click to increase your spend. You are not charged for invalid traffic Google catches before billing, and later finds are credited where appropriate. ### Will Google tell me if my competitor was clicking? No. Google does not confirm whether specific clicks were judged valid or invalid, and it keeps its detection methods confidential. You get an outcome and, where appropriate, a credit. ### Can I sue a competitor for clicking my ads? That depends on your jurisdiction and your evidence, so ask a lawyer licensed where you operate. The hard part is usually proving who was behind the clicks, not proving the clicks happened. ### What should I do while I decide? Exclude the source in Google Ads, keep your logs and click records unedited, and do not contact the competitor. Blocking stops the repeat cost whatever you decide about reporting. ## Sources - Google Ads Help: About invalid traffic - Google Ads Help: Invalid clicks - Google Ads Help: Exclude IP addresses from your campaigns --- ## Headless Browsers and Fake User Agents: How Bots Pose as Customers URL: https://blockclickfraud.com/headless-browsers-fake-user-agents.md A fake user agent is the cheapest disguise available, and it is the reason bot traffic can land on your page looking like a customer on an iPhone in Manchester. The user agent is just a text string the browser sends with every request, saying what it claims to be. Nothing verifies it. Any script can set it to anything. That one fact explains most of the confusion advertisers have about why their traffic reports look normal while their conversion rate does not. For the wider picture of what this traffic costs an account, see our overview of bot traffic in Google Ads. This page is about the specific disguise. ## What a headless browser actually is A headless browser is a real browser running without a visible window. Same rendering engine, same JavaScript execution, no screen. It was built for legitimate reasons and is used for legitimate work every day: automated testing, screenshot generation, page monitoring, scraping that site owners have agreed to. The thing that makes it useful for testing is the thing that makes it useful for fraud. A headless browser is not a crude script that fetches HTML and leaves. It loads your page properly. It runs your tracking tags. It fires your analytics. As far as most of your stack is concerned, something arrived, rendered the page and executed the JavaScript, which is exactly what a person does. That is a meaningful step up from the older generation of automation. A simple request-based bot never ran your JavaScript, so it never appeared in analytics that depend on it. A headless browser does appear, and it appears as a session. ## Why fake user agent bot traffic is so hard to spot Put the two together and the disguise gets thorough. The script declares itself as Chrome 130 on Android. It runs a genuine browser engine, so the page renders. It sets a screen size that matches a common handset. It can be told to wait a few seconds, scroll part of the page, and move the pointer in a way that is not a perfect straight line. Now compare that to the declared crawlers. A search engine bot puts its name in the user agent and behaves consistently. It is easy to identify precisely because it is not trying to hide. The industry calls that general invalid traffic, and it is filtered routinely. Everything described in this section is the other category: sophisticated invalid traffic, which is defined by the fact that it actively conceals what it is. The practical consequence for you is that no single field in your logs answers the question. The user agent says Chrome. It is not Chrome, but the string cannot tell you that, because the string is whatever the sender typed. ## What this traffic looks like from your side of the glass You will not identify it by inspecting one visit. You identify it by noticing that a group of visits behaves in a way people do not. - **Uniformity.** Real customers vary. They read at different speeds, scroll to different depths, hesitate in different places. A batch of sessions that all last a similar length and stop at a similar point is a machine doing the same job repeatedly. - **Engagement that stops short.** The page loads, something scrolls, nothing is clicked, nothing is typed, the session ends. It reads like interest and produces none of the behaviour interest produces. - **Device profiles that do not match your market.** Sudden volume from a browser version or handset combination that barely exists in your customer base. - **Timing that ignores human schedules.** Steady traffic overnight in a business where nobody buys overnight. - **Form fills with correct shape and wrong content.** Valid-looking phone numbers that do not connect, addresses that do not exist, job titles assembled from a word list. Any one of those has an innocent explanation. A cluster of them, arriving together, does not. ## Why the cost is worse than it looks Because a headless browser runs your tags, this traffic ends up inside the numbers you plan with. It inflates sessions, drags engagement metrics down, and shows up as demand that failed to convert. You then treat that as a message about your landing page or your keyword, and you act on it. Meanwhile the click has already consumed part of your daily budget. Google does issue automatic credits for clicks it classifies as invalid, and those credits are real, but they arrive on the next month's bill and they only address the charge. We set out the full extent of that gap in what Google's invalid click refunds actually cover. The short version is that getting the money back does not undo the session, the skewed metric or the bidding signal. ## What you should not do about fake user agent bot traffic The obvious instinct is to start blocking on the user agent string. Resist it, for two reasons. First, it does not work on the traffic you care about. Blocking a user agent blocks anything honest enough to use it. The bots in this article are not honest. They will present whatever string is most common in your logs, which by definition is the same string your real customers use. You cannot block that. Second, you will break things you need. Googlebot and AdsBot-Google identify themselves in the user agent, which makes them the easiest thing in your logs to block by accident. Block them and you lose organic indexing and your ad landing page checks start failing, which is far more expensive than the fraud you were chasing. Our guide to the crawlers you must never block covers which ones need clear access. The useful approach works from behaviour and context across many visits rather than from one declared field, and it runs continuously, because the disguise changes faster than a manual list can. That is the job click fraud protection does. ## AI Agents Are Blurring the Line A newer source of automated visits has nothing to do with fraud rings. AI assistants and browsing agents can now open pages, read them and sometimes click through on a person's behalf. Some identify themselves honestly. Others run inside an ordinary browser and look much like a person reading quickly. For an advertiser the question is the same one you ask of any automated visit: did a paid click lead somewhere a customer could follow? An agent that clicks an ad while researching for someone may be closer to a lead than a bot, or it may burn a click and never return. The practical response is not to block every unfamiliar browser, which catches real people, but to judge sources by what they do after the click across repeated visits. ## The takeaway Stop treating the user agent as evidence of anything. It is a claim, not a fact, and the traffic worth worrying about knows that better than you do. What a headless browser cannot fake convincingly is being a customer: it does not read, hesitate, change its mind, or buy. Judge your traffic on what it did, not on what it said it was. ## Frequently Asked Questions ### Is every headless browser visit ad fraud? No. Monitoring services, search engine renderers, testing tools and accessibility checks all run headless browsers for legitimate reasons. It becomes a cost when that traffic arrives through paid clicks and never behaves like a buyer. ### Why do bots fake their user agent? Because the user agent is just text the browser sends, and changing it is free. Claiming to be a common phone browser gets a bot past filters that only read that label. ### Can IP exclusions stop headless browser traffic? Partly. They stop your ads showing to addresses you have identified, which handles repeat sources. Traffic that rotates addresses keeps arriving from new ones until each is spotted. ### Does Google catch this traffic on its own? Some of it. Google filters invalid traffic before billing and credits invalid activity it finds later. The disguised traffic that looks like a real visitor is the part most likely to be billed. --- ## Datacenter IPs vs Residential IPs in Ad Fraud URL: https://blockclickfraud.com/datacenter-vs-residential-ip-fraud.md Datacenter IP ad fraud is the version you can actually see, and that is exactly why it is no longer the version costing you the most money. An address that belongs to a hosting provider is not pretending very hard. An address that belongs to a broadband customer in a town where you sell is a different problem, and the gap between those two things explains most of what goes wrong when advertisers try to fix fraud with a block list. If you have not read our overview of bot traffic in Google Ads, that sets the context. This page is about where the traffic appears to come from. ## What the two types actually are A datacenter IP address belongs to a hosting company, a cloud provider or a server farm. It exists to run machines. Nobody's home broadband sits on one. These ranges are well documented, publicly attributed to their owners, and stable over time. A residential IP address is assigned by a consumer internet provider to a household or a mobile connection. It is the address your actual customers browse from. Here is the part that matters most: these addresses get reassigned between customers over time as leases expire and subscribers change. The address that served a bot last month can belong to an ordinary household this month. Datacenter ranges generally do not move like that. This single difference drives everything else on this page. ## Why datacenter IP ad fraud is the easy case Traffic arriving from a known hosting range and claiming to be a person on a phone is making a claim that does not survive contact with reality. Nobody browses your plumbing website from a rack in a data hall. The attribution is public, the ranges are stable, and the mismatch between what the traffic says and where it sits is obvious. This is why a lot of low-effort automation gets filtered before it ever costs anyone anything. It is also why the fraud economy moved on. When the cheap route stops working, the traffic buys a better disguise. ## Residential addresses and why they break your block list Proxy networks rent access to residential connections, sometimes with the householder's knowledge, often through apps that bundle the permission into terms nobody reads. Automated traffic routed through that infrastructure arrives from a genuine home connection in a plausible location. There is no hosting provider in the attribution, because there is no hosting provider involved. Three things follow from that, and each one is a reason manual blocking underperforms. - **The address is rotated.** The network has a large pool. By the time you have identified and blocked one address, the same operation is using another one. You are always blocking the last visit rather than the next one. - **The address can become innocent.** Because residential addresses are reassigned between customers, a block you added six months ago may now be shutting out a genuine prospect. Your list ages badly and never tells you when it has gone wrong. - **The context looks right.** A residential address in your service area does not raise any obvious question. Nothing about the location says fraud. Mobile carrier addresses add a further wrinkle, since large numbers of unrelated users share the same address space. Block one and you may be blocking a neighbourhood. ## What this means for IP exclusions in Google Ads Google Ads lets you exclude IP addresses at campaign level, and it is a reasonable tool for a narrow job. It works for a fixed, known nuisance: your own office, a contractor, a single persistent source you have documented over weeks. It does not work as a fraud defence, for reasons that follow directly from everything above. The exclusion list is capped in size, it is maintained by hand, and it acts on addresses that have already rotated. You are curating a list of places the traffic used to be. We go through the limits and the sensible uses in our guide to IP exclusions in Google Ads. There is also a quieter cost. Every stale entry on a hand-built list is a potential real customer you are silently refusing to show ads to, and nothing in the interface will ever flag that. The list has no expiry and no feedback loop. ## Where Google's own filtering lands on this Google does filter invalid clicks and does issue automatic credits for those it identifies, which lands on the following month's bill. Obvious datacenter traffic is the kind of thing large-scale filtering handles well. Traffic from a residential address in your target market, behaving with moderate plausibility, is a much harder call for any platform-level system, and Google does not disclose where it draws the line. We cover what that means for you in what Google's invalid click refunds leave behind. The honest summary: the easy half of this problem is largely handled, and the credit reflects that. The hard half is where your money is going, and a credit on your invoice tells you nothing about how much of it there was. ## What to do instead of curating addresses Stop treating the IP address as an identity and start treating it as one piece of context. On its own it answers the wrong question. A datacenter address is a useful signal because it contradicts the claim being made. A residential address is not a clean bill of health, it is just the absence of an obvious contradiction. What works is a live view of behaviour across visits and time, applied automatically, so that a source is acted on while it is still active rather than weeks later. It also needs to release addresses again when they stop being a problem, which a static list never does. That is what click fraud protection is built to handle, and it is the part that manual maintenance cannot match at any reasonable effort. One thing to keep in mind whichever route you take: legitimate crawlers such as Googlebot and AdsBot-Google operate from Google infrastructure, which means a blunt rule aimed at datacenter traffic can take them out. That breaks your indexing and your ad landing page checks. Our guide to the bots you must never block explains what needs to stay reachable. ## Privacy Relays and VPNs Muddy the Picture Not every address that looks wrong belongs to someone trying to cheat you. Privacy features built into browsers and phones, along with ordinary VPNs, route real people through shared exit addresses. The location attached to those addresses can be a city away from where the person actually is, and the network may belong to a provider you would otherwise associate with servers. That matters because a rule like "block anything that is not a home connection" catches privacy-conscious customers along with bots. Treat relay and VPN traffic as uncertain rather than guilty. The deciding evidence is behaviour across visits: whether the source keeps clicking without reading, or arrives once, browses and gets in touch. ## The short version Datacenter fraud is loud and mostly handled. Residential fraud is quiet, rented by the hour, and rotates faster than any list you maintain by hand. If your current defence is a spreadsheet of addresses, you are defending against the version of this problem that stopped being the expensive one a while ago. ## Frequently Asked Questions ### Is a residential IP always a real person? No. Residential proxy networks rent out home connections precisely so automated traffic looks like a household. The address type tells you how hard the source worked to look normal, not whether it is a customer. ### Should I exclude every datacenter IP that clicks my ads? No. Exclude the specific addresses that combine repeated paid clicks with no engagement. Blocking whole provider ranges can cut off monitoring tools you use, business networks and VPN users who are real prospects. ### Why do VPN users show the wrong location? The location attached to an address is the location of the exit point, not the person. A VPN or privacy relay can place a local customer in another city or country. ### Can I block an IP range in Google Ads? Yes. Google Ads lets you use an asterisk in place of the last digits to exclude a block of addresses, within the 500-entry limit per campaign. Start narrow, because a range covers everyone behind it. --- ## Is a Competitor Clicking Your Law Firm's Ads? How to Tell URL: https://blockclickfraud.com/competitor-clicking-my-ads.md If you suspect a competitor clicking your Google Ads is draining your daily budget, you are asking a reasonable question, and there are specific patterns that separate rival sabotage from ordinary junk traffic. The answer matters because the two problems have different fixes. Bot traffic is a volume problem. A competitor is a targeted problem, and it tends to be surgical about timing. This is one of the most common suspicions we hear from firms, and it sits inside the broader issue of click fraud in law firm advertising. Let us look at what actually shows up in the data. ## Six signs a competitor is clicking your Google Ads No single one of these proves anything. Together they form a picture. ### 1. The clicks arrive at office hours, not client hours People looking for a criminal defense attorney search at two in the morning from a holding cell waiting room, or at ten at night after a bad day. People looking for a personal injury lawyer search from a hospital parking lot. Your genuine traffic has a ragged, human shape to it. Competitor traffic looks like a job. It starts around nine, it happens on weekdays, it stops at five. If your click volume has the profile of someone's work schedule rather than someone's crisis, that is worth noting. ### 2. Your budget dies early and nothing came of it Check what time your daily budget is exhausted. If a campaign that used to run until evening now caps out before lunch, and your call volume and form fills did not move, something is consuming clicks that will never become a case. This is the single most expensive symptom, because you lose the afternoon entirely. ### 3. Repeat activity from the same source across days A real prospect clicks your ad, reads your page, maybe comes back once more before calling. What they do not do is click at roughly the same time every weekday for three weeks. Repetition on a schedule is not shopping behavior. ### 4. Sessions too short to have read anything Look at your analytics for sessions from paid search that lasted a couple of seconds. Someone who clicked, saw where they landed, and closed the tab immediately did not arrive by accident. They already knew what was there. ### 5. Concentration on your most expensive keywords Casual or accidental clicks spread themselves across whatever ads happen to appear. Targeted clicking goes after the terms that cost you the most, because that is the point. If your waste is concentrated on the handful of keywords with your highest cost per click, and your cheaper terms look clean, that asymmetry is telling you something. ### 6. It started when something changed Did the pattern begin the week you launched a new campaign, raised bids, or took the top position on a term a rival had owned for years? Competitor clicking is usually reactive. It has a trigger date. ## Ruling out the boring explanations first Before you conclude someone is targeting you, rule out the things that produce similar-looking data. - **Your own staff.** Your intake coordinator checking that the ad is live, your marketing person testing the landing page. Exclude your office IP and see what changes. - **Search partners and Display.** If your search campaign has partners or Display enabled, a chunk of low-quality traffic is arriving from placements you never chose. Segment by network before blaming anyone. - **Location targeting leakage.** The default setting reaches people who show interest in your area rather than only people in it. Switch to presence only and recheck. - **Ordinary bots.** Scrapers and crawlers generate a lot of short sessions. They are usually less discriminating about which keyword they hit, which is how you tell them apart from targeted clicking. Working through these first also makes your account better regardless of what you find. If the pattern survives all four, you are probably looking at something deliberate. ## Signals That Look Bad but Usually Are Not Before you decide a rival is behind it, rule out the clicks that come from people on your own side. They produce exactly the same patterns. - **Your own staff.** People search for the business to check the ads are live, then click. From the office network that looks like one address clicking every day. - **Your agency or consultant.** Account managers check ads and landing pages constantly, often from several locations. - **Shared networks.** Offices, hospitals, campuses and mobile carriers put many genuine people behind one address, so repeats from those sources are often different customers. - **Real comparison shoppers.** In expensive categories, prospects click several firms, leave and come back days later. That is research, not sabotage. Excluding your office address and asking your agency to preview ads with the Google Ads preview tool rather than live searches removes most of this noise. What is left is easier to read. ## What to do when you find a competitor clicking your Google Ads ### Do not confront anyone Tempting, and useless. You cannot prove which person was at the keyboard, your evidence is a pattern rather than an identity, and a confrontation tips them off to switch methods. There is also a professional conduct dimension here that you understand better than we do. ### Exclude the sources you can identify Google Ads allows up to 500 IP address exclusions per campaign. Add what you can identify. Recognize the limits: residential connections change addresses, mobile traffic rotates, and anyone using a VPN steps around the list entirely. This raises the effort required to keep clicking you, which is worth something, but it is not a wall. ### Tighten the account around the problem Turn off search partners and Display in search campaigns. Set location targeting to presence only. Narrow your ad schedule if your fraudulent traffic has a clear time signature and your genuine leads do not need those hours. Each of these costs nothing and removes surface area. ### Let Google's credits do what they do, and understand what they do not Google filters some invalid traffic automatically and credits you for it. It does not tell you what criteria it used or which clicks were flagged, so you cannot audit the result. Our page on Google's invalid click refunds explains what that system covers and where it leaves you exposed. ### Block it automatically The practical answer is software watching click behavior as it happens and adding the sources worth excluding to your campaign exclusions without you reviewing spreadsheets every Monday. A determined competitor will vary their behavior, and a manual list cannot keep up with that. Automated click fraud protection exists because the manual version does not scale. ## A note on what you can reasonably conclude Click data tells you about sources and patterns. It does not tell you who was sitting at the machine. Be honest with yourself about that gap, especially before you say anything to anyone. What you can conclude is that a particular slice of your traffic has no chance of becoming a client, and that you should stop paying for it. That conclusion does not require identifying anybody. It just requires deciding that the clicks are worthless and acting accordingly. Start by measuring what time your budget runs out. If the answer is earlier than it used to be and your intake numbers did not improve, you have somewhere to begin. ## Frequently Asked Questions ### Can I prove a competitor is clicking my ads? Rarely with certainty. You can usually show a pattern: the same source, repeated paid clicks, short sessions and no enquiries over a long window. That is enough to exclude the source, which is the useful outcome, even if you never put a name to it. ### Will Google refund clicks from a competitor? Google credits activity it judges invalid, and you can ask it to review traffic from the past 60 days with the Click Quality Form. It does not guarantee a credit and will not confirm which clicks it ruled invalid. ### Can I block a competitor's IP address in Google Ads? Yes, if you know it. Add the address to the IP exclusions in each campaign's settings, up to 500 addresses per campaign. It stops your ads showing to that address; it does not reverse clicks already billed. ### Should I contact the competitor? No. You rarely have proof strong enough to survive the conversation, and it tells them exactly what to change. Exclude what you can identify and keep records. --- ## Medical Click Fraud: What to Watch For in Google Ads URL: https://blockclickfraud.com/medical-click-fraud.md Medical click fraud is paid Google Ads traffic to a practice's site from bots, click farms, competitors or repeat clickers who will never book an appointment. The click is billed, the daily budget runs down, and the schedule stays the same. For a practice that pays a lot per click on local terms, a small amount of it adds up quickly. ## Where Medical Click Fraud Comes From It rarely arrives as one big event. It is usually a slow leak from a few kinds of source: - **Competitor clicks.** Someone who knows exactly which local terms you bid on and clicks to drain your budget early in the day. - **Click farms.** Paid people clicking from cheap devices, often in bursts. - **Bots.** Scripts that load the landing page and leave, or fill in a booking form with junk. - **Repeat clickers.** One person returning to the same ad many times over a few days. Inside Google Ads all four look the same: a click, a cost, no appointment. That is why the checks below matter more than instinct. Our guide to repeat clickers in Google Ads covers the last group in more depth. ## Warning Signs of Medical Click Fraud None of these proves fraud alone. Two or three together, week after week, is the point to look closer. - Clicks rise while new patient enquiries stay flat or fall. - The budget is spent by mid-morning and ads stop showing for the rest of the day. - Clicks come from outside the area you serve. - Booking forms arrive with fake names, repeated numbers or nonsense in the fields. - Calls from ads are very short or never connect. - Clicks cluster at the same hours on the same device type in a way real patients do not. Practices have a local advantage here. Most patients come from a limited radius, so a steady stream of paid clicks from far outside it is easy to question. ## Checks You Can Run in Google Ads Today Report What a problem looks like First move Search terms Clicks on terms unrelated to your services Add negative keywords, review match types Locations Clicks from places you do not serve Tighten targeting to people in your area Ad schedule Clicks when the front desk is closed, no bookings Compare clicks and bookings by hour before changing bids Devices One device type spending with no appointments Review device performance Invalid clicks column A rising count on the same campaigns Look at your own click records for those campaigns To add the invalid clicks column, open Campaigns, then Columns, then Modify columns, and search for "Invalid clicks". Those are clicks Google filtered before billing, so you were not charged for them. Treat the number as a floor. Then compare Google Ads clicks against the new patient enquiries your front desk logged that week. A wide and steady gap is the clearest sign. ## Medical Click Fraud Is Not Healthcare Fraud Healthcare fraud usually means billing schemes, false claims or stolen patient identities, and it belongs to compliance teams and regulators. Medical click fraud is an advertising problem: wasted paid clicks and junk booking requests. It does not touch patient records or billing, and the fixes are campaign settings, conversion tracking and exclusion lists. ## How to Block Bad Sources When a source is confirmed, exclude it so your ads stop showing to it. - **Search campaigns.** Campaigns, select the campaign, Settings, Additional settings, IP exclusions. Up to 500 addresses per campaign, and an asterisk can replace the last digits to exclude a block, such as 123.45.67.*. - **Performance Max.** Campaign-level IP exclusions are not available in Performance Max. Account-level IP exclusions apply to all campaigns in the account, including Performance Max, so add confirmed sources there. - **Microsoft Ads.** It has its own campaign-level IP exclusions with a lower limit. See Microsoft Ads click fraud for how that works. Be careful with shared networks. Hospitals, offices and mobile carriers put many real people behind one address, and some of them are your patients. Exclude specific repeat offenders, not whole networks after one odd click. The Google Ads IP exclusions guide has more on keeping a list clean. ## Refunds and What to Expect Invalid activity Google finds after billing is credited as an "Invalid activity" adjustment, usually in the next billing cycle, under Billing, then Summary. If you think Google missed a pattern, the Click Quality Form covers the past 60 days. Send your customer ID, dates, campaigns, keywords and server logs with IP addresses and GCLIDs. Google will not tell you which specific clicks it judged invalid, and a credit is never guaranteed. See Google invalid click refunds for the full process. ## A Weekly Routine for a Small Practice - Compare clicks, cost and booked appointments for the past seven days. - Scan the search terms and locations reports for anything outside your services or area. - Note any source that repeats without producing an enquiry. - Add confirmed sources to your exclusion lists, with the date and the reason. - Once a month, review the whole list and remove entries that no longer belong. Count a conversion when an appointment is actually booked, not when a form is sent. That one change stops Google Ads from chasing traffic that only fills forms. ## Where Automation Fits A weekly review catches the obvious patterns but struggles with volume, because someone has to look at every click. Automated click fraud protection checks each paid click as it arrives, flags bots, click farms and repeat clickers, and writes confirmed sources into your exclusion lists, including the account-level list that covers Performance Max. It cannot stop the very first click from a new source, and it cannot guarantee a Google refund. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### What is medical click fraud? It is paid ad traffic to a medical practice from sources with no intent to book: bots, click farms, competitors and repeat clickers. You pay for each click and get no appointment from it. ### Can I block IP addresses in a Performance Max campaign for my practice? Yes, at account level. Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to every campaign in the account, Performance Max included. ### Do IP exclusions stop medical click fraud completely? No. They stop your ads showing to sources you have already identified. A new bot or a first-time clicker still gets through until it is spotted, so exclusions work best as a list you keep adding to. ### Will Google refund clicks I think were fraudulent? Google credits activity it judges invalid, and you can ask it to review the past 60 days with the Click Quality Form. A credit is not guaranteed, and Google will not confirm which clicks it ruled invalid. ### How often should a practice review its ad traffic? Weekly suits most practices: clicks, cost and booked appointments, plus a scan of search terms and locations. Review the exclusion list monthly. If the budget starts running out early in the day, look the same day. ## Sources - Google Ads Help: Exclude IP addresses from your campaigns - Google Ads Help: About invalid traffic --- ## Google Refunded Your Invalid Clicks. Here Is What It Missed. URL: https://blockclickfraud.com/google-invalid-click-refunds.md A Google invalid click refund gives you back the money and nothing else. That is the whole argument in one line, and if you take nothing further from this page, take that. Google does detect invalid clicks, it does remove them from what you pay, and the credits do land on the following month's bill. None of that is in dispute and we are not going to pretend otherwise. The question worth asking is narrower and more useful: once the money is back, what is still broken? If you are new to the category, start with our overview of bot traffic in Google Ads and what it costs, then come back here. This page assumes you already know that fake clicks exist and want to understand where the platform's own remedy stops. ## How the Google invalid click refund actually works Google runs automated filtering on ad traffic. Clicks it classifies as invalid are removed from your reported click counts and are not charged. Where an invalid click was charged and identified afterwards, an automatic credit is applied, and it shows on the next month's invoice as a line item rather than a cash return. You do not have to ask. There is no claims process for the automatic credits, and for most advertisers this happens quietly every month without anyone noticing. Google does not publish its detection criteria. That is a deliberate position, and it is a defensible one: publishing the rules would hand a specification to the people writing the bots. Any fraud detection system that explains itself in full stops working shortly afterwards. So the opacity is not evasion, it is the cost of the thing functioning at all. Accept all of that. The system is real, it does real work, and at Google's scale it removes an enormous volume of junk that would otherwise be billed. Now look at what is left in your account after the credit lands. ## What a Google invalid click refund does not give back ### Your daily budget window This is the one advertisers underrate. A daily budget is spent in real time. When fake clicks consume it at 11am, your ads stop serving, and the people searching for you at 2pm see a competitor instead. The credit arrives weeks later. It restores the money. It cannot restore the four hours of visibility you were absent for, or the enquiry that went elsewhere during them. You were refunded for the click. You were not refunded for the customer. ### Your analytics Invalid clicks reach your landing page like any other visit. They enter your analytics, inflate your sessions, raise your bounce rate and drag down your average time on page. The billing adjustment happens inside the ad platform. Your site analytics never hear about it. Weeks later you sit down to review performance and find a keyword with plenty of traffic and no conversions, and you make a decision about that keyword based on a number that was partly manufactured. ### Your bidding signals Automated bidding learns from outcomes. Clicks that never convert are training data whether or not they were later credited, and the model draws the conclusion it is supposed to draw: this segment does not perform. It bids down accordingly. The refund does not roll back the learning. There is no button that tells Smart Bidding to unlearn last Tuesday. This is the slowest and least visible cost, and it compounds. ### Your team's time Where fraud produces form submissions rather than bounces, someone in your business calls them. That is an hour of a salesperson's morning on a record that was never a person, and in a service business those hours are more expensive than the media. No credit line covers it. ## The visibility problem Here is the practical difficulty with relying on the refund alone. You cannot audit it. You do not know how many invalid clicks were caught, how many were missed, or what the criteria were, because the criteria are not disclosed. You see a credit amount. You have no denominator. That makes it impossible to answer the only question that matters to you: is the remaining traffic clean? A small credit could mean the filtering caught almost everything and your traffic is genuinely healthy. It could equally mean the filtering caught the easy declared crawlers and the disguised traffic sailed through untouched. Both scenarios produce the same invoice. You cannot distinguish them from inside the ad platform, and Google is not going to help you, because helping you would mean explaining the detection. ## Where the platform's incentives and yours diverge This is not a conspiracy argument. Google has a genuine interest in advertisers not being defrauded, because advertisers who conclude that paid search does not work reduce their spend. But the platform is solving a billing-integrity problem at global scale, across millions of accounts, with a threshold set to avoid suppressing legitimate traffic. You are solving a different problem: whether the specific clicks hitting your specific account are worth what you paid. Those are not the same problem, and a system tuned for the first will always be conservative about the second. A platform-wide filter has to be careful, because falsely filtering real customers is a worse outcome for Google than letting marginal traffic through. That conservatism is correct policy for Google. It is also precisely why advertisers keep finding traffic the filter did not object to but they would have. ## How to Ask Google to Look Again The automatic credits are not the only route. If you believe a specific stretch of traffic was invalid and Google did not credit it, you can request an investigation with the Click Quality Form in Google Ads Help. Two limits shape whether that is worth doing. The review only covers activity from the past 60 days, and Google will not tell you which individual clicks it decided were valid or invalid, so the answer comes back as a finding and sometimes a credit, not a click-by-click ruling. A request is only as good as the evidence attached to it. Google asks for your customer ID, the exact date range, the campaigns and ad groups involved, the keywords you think were targeted, and server logs with IP addresses, device details and GCLIDs. If the problem is junk leads rather than junk visits, a spreadsheet of GCLIDs with your own assessment of each lead helps. Advertisers who only notice a problem at month end often find the logs they need were never kept, which is the strongest argument for recording paid clicks as they happen. When a credit is issued it appears as a billing adjustment labelled "Invalid activity", found under Billing, then Summary, in the Adjustments list for that month. It does not change the campaign data you see in reports. The Invalid Activity Credit Report in Report Editor is where Google shows the adjusted metrics. ## So what do you do with this Not "distrust Google". That is lazy and it is wrong. The useful position is more specific: treat the invalid click credit as a partial backstop rather than as your protection, and measure it against what you actually need, which is fewer bad clicks arriving in the first place rather than a discount on them afterwards. The difference between those two things is timing. A refund is retrospective and financial. Blocking is preventive and operational. One returns some money. The other stops the click consuming your budget window, entering your analytics, and teaching your bidding model something false. A dedicated click fraud protection layer exists to work on that second axis, alongside the platform's own filtering rather than instead of it. Check your last few invoices for the credit line. If you have never noticed it, that alone tells you something about how much attention this has been getting. Then look at your traffic on its own terms, without assuming the absence of a large credit means the absence of a problem. The refund answers a question about your bill. It does not answer the question about your traffic. ## Frequently Asked Questions ### Do I have to request invalid click credits from Google? No. Invalid traffic Google detects before billing is never charged, and invalid activity it finds after billing is credited automatically as a billing adjustment, usually in the next billing cycle. A manual request through the Click Quality Form is only for traffic you think Google missed. ### How far back can Google investigate invalid clicks? The Click Quality Form covers activity from the past 60 days. Anything older is outside the review window, so collect your logs and file promptly if you see a pattern you want examined. ### Where do invalid click credits show up? In Google Ads, open Billing, then Summary, and look in the Adjustments list for entries labelled "Invalid activity". The credit reduces what you owe; it does not edit the clicks shown in your campaign reports. ### Will Google tell me which clicks were invalid? No. Google does not confirm whether specific clicks were judged valid or invalid, because that would help the people generating the traffic. You get an outcome and, where appropriate, a credit, but not a list. --- ## Performance Max IP Exclusions: How the Account-Level List Works URL: https://blockclickfraud.com/performance-max-ip-exclusions.md A **Performance Max IP exclusion** has to be set at account level. Campaign-level IP exclusions are not available in Performance Max, so the setting you know from Search campaigns is not there. Account-level IP exclusions are different: Google applies them to every campaign in the account, Performance Max included. If you moved spend into Performance Max and went looking for your blocklist in the campaign settings, that is why you could not find it. The list on your Search campaigns still works there and covers none of the budget that moved. Before going further, read how the setting behaves at campaign level in our guide to Google Ads IP exclusions. ## Where the Performance Max IP Exclusion Setting Lives Google Ads Help lists the campaign types where campaign-level IP exclusions are not available: video, hotel, app, Performance Max and Smart Display. The same page says account-level IP exclusions apply to all campaigns in the account, including Performance Max, Search, Shopping, Display, Demand Gen and YouTube. To add them, click the Admin icon, open Account settings, find IP exclusions, enter the addresses and save. An asterisk can replace the last digits to exclude a block, for example 123.45.67.*, the same as at campaign level. The difference is reach. One account-level entry stops your ads showing to that address everywhere the account serves. That is useful, and it is also the reason to be careful about what goes in. ## Why Account-Level Exclusions Need More Care A campaign-level mistake costs you one campaign. An account-level mistake costs you all of them. ### Shared addresses hurt more Offices, campuses, hospitals and mobile carriers put many real people behind one address. Exclude one of those at account level and every one of those people stops seeing every ad you run. Keep account-level entries for sources you are confident about: repeat paid clicks, no engagement, no enquiries, over a period long enough to mean something. ### The list is one list Campaign-level lists multiply with your campaigns. The account-level list does not. Every address in it has to earn its place, so date each entry, write down why it went in, and review it on a schedule. Our page on the Google Ads IP exclusion limit covers how to manage a full list. ### Reporting is thinner Performance Max gives you less placement detail than Search, so you have less to diagnose a spending problem with. A Performance Max campaign serves across far more Google inventory than search results alone, which includes places where bot traffic in Google Ads is a more familiar problem. Keeping your own record of paid visits fills some of that gap. ## Other Controls That Still Apply IP exclusions are one lever. A few others work across Performance Max as well, and they are worth setting up on purpose rather than leaving at defaults. - **Account-level negative keywords and brand exclusions.** These apply across campaign types, which makes them the other global lever you have. - **Location settings.** Tighten targeting to people in your service area and exclude places you do not serve. - **Conversion quality.** Performance Max buys more of whatever produces the events you count as conversions. Count a page view or an unqualified form fill and it will find more traffic that does exactly that. - **Audience signals.** They steer rather than restrict, but steering still matters. - **Campaign separation.** Keeping your most expensive search terms in Search campaigns keeps campaign-level controls on the spend that hurts most. ### Conversion signals deserve more attention than they get This is the lever people underuse. Before blaming the campaign type for poor traffic, look at what you are telling it success means. Sending qualified outcomes back into the account, instead of front-end actions, changes what the campaign buys, and it works alongside any blocking you do. ## Refunds Do Not Replace Blocking Google filters invalid traffic before billing and credits invalid activity it finds after billing, and that applies to Performance Max the same as anywhere else. Credits show up as "Invalid activity" adjustments under Billing, then Summary. You can also ask for a review of the past 60 days with the Click Quality Form. None of that stops the next click. Google does not publish its detection criteria and will not confirm which clicks it judged invalid, so a credit tells you something was caught, not what was missed. Our piece on Google's invalid click refunds covers the process in detail. ## How Automated Protection Handles Performance Max Seeing the traffic comes first. Checks that run as visits land on your site can flag suspicious paid clicks whatever campaign sent them, Performance Max included, and give you records you can attach to a Click Quality Form request. Blocking then goes where Google allows it. For campaigns that accept campaign-level exclusions, such as Search, that is the campaign list. For Performance Max, it is the account-level list. Automated click fraud protection that writes to both covers the whole account. It still cannot stop the very first click from a source it has never seen, and no tool can guarantee a refund. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Can you exclude IP addresses in Performance Max? Yes, at account level. Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to every campaign in the account, Performance Max included. ### Where do I add account-level IP exclusions? Click the Admin icon, open Account settings, find the IP exclusions section, enter the addresses and save. They take effect across all campaigns in the account. ### Do account-level exclusions replace my campaign lists? No. They add to them. Campaign lists still apply to the campaigns they sit in, so keep narrow, campaign-specific entries there and put only sources you are confident about at account level. ### Can I exclude a range of addresses? Yes. An asterisk can replace the last digits, as in 123.45.67.*. Start narrow, because a range at account level blocks everyone behind it from every campaign. ### Does Google refund invalid clicks from Performance Max? Google credits invalid activity it detects, in Performance Max as anywhere else, usually as an adjustment in the next billing cycle. For traffic you think it missed, the Click Quality Form covers the past 60 days. ## Sources - Google Ads Help: Exclude IP addresses from your campaigns - Google Ads Help: About invalid traffic --- ## The 500 IP Exclusion Limit in Google Ads (And What Happens When You Hit It) URL: https://blockclickfraud.com/google-ads-ip-exclusion-limit.md The **Google Ads IP exclusion limit** is 500 addresses per campaign, and almost nobody thinks about it until the day the save button stops working. Up to that point the list feels open-ended. You add an address when something looks wrong, you move on, and the count is invisible. Then one afternoon you paste in a new block and the interface tells you there is no room. Worth saying up front: most accounts never get near 500. If you have added six addresses in two years, this article is not about your problem. It is about what the ceiling tells you when you do reach it, which is usually more interesting than the ceiling itself. For the setting in full, start with our guide to Google Ads IP exclusions. ## What the Google Ads IP Exclusion Limit Actually Covers Five hundred entries, per campaign, counted as entries rather than addresses. That distinction matters. A range counts as one entry regardless of how many individual addresses sit inside it, which is the only real lever you have for stretching the allocation. The limit does not pool across campaigns. Each campaign gets its own 500 and its own list. In one sense that is generous, since a ten-campaign account technically has five thousand slots. In practice it means ten separate lists to keep current, and there is no native tooling to sync them. Whatever you add to one campaign you add by hand to the rest, or you script it through the API. ### Ranges are how most lists survive If you are excluding addresses one at a time, you will hit the ceiling faster than you expect. Grouping into ranges buys room, at the cost of precision. A wide range is one entry that blocks a lot of people, and some of those people may be prospects. That trade is fine when you are blocking a hosting provider's address space. It is a bad trade when the range covers residential broadband in a city you sell into. ## What Happens When the Campaign Is Full Nothing dramatic. Google does not warn you as you approach the limit, does not degrade the existing list, and does not start dropping old entries to make space. It simply refuses the new one. The existing 500 keep working exactly as before. The real consequence is the decision it forces. To add anything new you have to remove something old, and you almost certainly have no idea which of the 500 is still earning its place. Nothing in the account tells you how many clicks an exclusion has prevented, because prevented clicks do not generate data. An entry you added eighteen months ago against a competitor who has since changed ISP looks identical to one blocking an address that hammers you daily. So the list gets pruned by guesswork. Oldest first, usually. That is not auditing, it is rotation, and the accounts that end up doing it tend to be the ones that most need something better. ## Why a Full List Is Usually a Symptom Here is the part that matters more than the number. A campaign that has genuinely accumulated 500 justified exclusions is not telling you that the limit is too low. It is telling you that the traffic hitting that campaign changes address faster than you can write addresses down. Manual blocking assumes a stable adversary. You identify the source, you block it, it stays blocked. That assumption holds for a competitor clicking from their office and for an annoyed former customer on a static connection. It stops holding the moment the traffic is automated or routed through anything that cycles addresses. Then every block you add is retroactive, aimed at a location the traffic has already left. When you find yourself pruning a full list to make room for more, the list has become a treadmill. The addresses keep coming because the underlying source is not address-bound. ## What to Do When You Reach the Ceiling A few things are worth doing before you conclude the tool has failed you. - **Consolidate into ranges.** Individual entries from the same block can often collapse into one. This alone recovers meaningful room in most full lists. - **Date your entries.** Keep the list in a spreadsheet with the date and reason for each exclusion, so pruning is informed rather than arbitrary. Google will not store this for you. - **Check whether the campaign still needs them all.** Exclusions added for a campaign that has since changed targeting entirely may be protecting nothing. - **Audit what the entries have in common.** If most of them resolve to hosting providers or data centers rather than homes and offices, you are dealing with automated traffic and the list was never going to keep up. ## The Limit Is Not Your Actual Problem It is tempting to treat 500 as an arbitrary restriction Google should raise. Raise it to five thousand and the treadmill just runs longer. The constraint that hurts is not the ceiling, it is that you are identifying sources by hand, after the money is gone, with no feedback on whether any given block is still doing work. Google's own response to invalid traffic runs on the other side of the timeline. It detects, then credits, and those credits arrive after the click was served and billed. The detection criteria are not published, so you cannot see what was caught or what slipped through. We go through what that covers in our piece on Google's invalid click refunds. Useful, but not the same thing as never paying for the click. Prevention is the part worth buying. Automated click fraud protection exists to handle the identification and blocking continuously, so the question of which 500 addresses deserve the slots stops being something you decide manually at midnight. ## The Short Answer Five hundred exclusions per campaign, ranges count as one, no account-level pooling, no warning as you fill up, and no way to tell which entries are still working. Use ranges, keep your own records, and treat a full list as a signal rather than an inconvenience. If a campaign has filled its allocation, the addresses are not the problem. Whatever keeps generating new ones is. --- ## Insurance Click Fraud: Why Quote Forms Attract Bots URL: https://blockclickfraud.com/insurance-click-fraud.md Insurance click fraud is paid traffic that reaches your quote pages from bots, click farms or repeat clickers who will never buy a policy. It is harder to spot than most click fraud because a fake visitor can complete a quote form, so the waste shows up as a lead rather than a bounce. You pay for the click, your team works the lead, and nothing is ever written. ## Why Quote Forms Draw Fake Traffic A phone call takes a person, a working number and a few minutes of conversation. A form takes a script a few seconds. That difference decides where fake traffic lands in an insurance account. Most insurance campaigns send the click straight to a short quote form. Google Ads records the click and, if you track it, the form submission. What it cannot tell you is whether the details typed into that form belong to anyone. A bot that can find the name, phone and zip fields can produce something that looks like a lead, and your conversion count goes up while your written premium does not. The result is a reporting problem as much as a cost problem. If form fills count as conversions, Smart Bidding treats those fake submissions as success and goes looking for more traffic like them. ## What Insurance Click Fraud Looks Like in Your Data No single signal proves fraud. Several showing up together, week after week, is the point to dig in. - **Quote requests that never connect.** Numbers that ring out, belong to someone else, or fail validation. - **Repeat submissions.** The same name, email pattern or address arriving several times from different clicks. - **Odd hours.** Batches of quote requests overnight when real shoppers in your market are asleep. - **Locations you do not write.** Clicks and forms from states where you are not licensed or areas outside your targeting. - **Conversions up, bound policies flat.** The clearest sign that the platform and your agency management system are counting different things. Some of this is not fraud at all. Comparison shoppers fill in several forms and never answer. Your own staff test the form. Rule those out before you start excluding sources, and see our guide to competitors clicking your ads for the signals that look bad but usually are not. ## Insurance Click Fraud Is Not Insurance Fraud The two get mixed up. Insurance fraud is someone deceiving an insurer to collect money they are not owed, and it is handled by claims and special investigations teams. Insurance click fraud is aimed at your ad budget. The person behind it is not trying to get a policy or a payout. They are generating paid clicks or junk leads. That matters because the fixes are different. Your claims team cannot recover a wasted click. The tools here are campaign settings, conversion tracking, IP exclusions and Google's invalid traffic process. ## What Google Already Filters Google filters invalid traffic with automated systems and a manual review team, and you are not charged for invalid traffic detected before billing. You can see how much it removed by adding the "Invalid clicks" column: Columns, then Modify columns, then search for it. Invalid activity Google finds after billing is credited back as a billing adjustment labelled "Invalid activity", usually in the next billing cycle, under Billing, then Summary. If you think Google missed something, the Click Quality Form lets you request a review of activity from the past 60 days. Include your customer ID, the dates, campaigns and keywords, plus server logs with IP addresses and GCLIDs. Google will not confirm which specific clicks it judged invalid. Our piece on Google invalid click refunds walks through it. What that filter does not do is stop a form from counting as a lead. Traffic that looks normal enough to be billed is the part you have to handle yourself. ## How to Exclude Bad Sources in Google Ads Once a source is confirmed, exclude it so your ads stop showing to it. - **Campaign level.** Campaigns, select the campaign, Settings, Additional settings, IP exclusions. Up to 500 addresses per campaign. An asterisk can replace the last digits to exclude a block, for example 123.45.67.*. - **Account level.** Campaign-level IP exclusions are not available for video, hotel, app, Performance Max and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max, so that is the list to use if quote volume runs through Performance Max. Keep entries specific. Offices, campuses and mobile carriers put many real shoppers behind one address. Date every entry and note why it went in. The Google Ads IP exclusions guide and the IP exclusion limit page cover how to manage a full list. ## Make the Quote Form Harder to Fake Exclusions deal with sources you have already found. The form itself can raise the cost of faking a lead. - Validate phone numbers and email addresses before the submission counts. - Count a conversion when a quote is worked or a policy is bound, not when the form is submitted, and import those outcomes back into Google Ads. - Check form completion time. A real person does not finish a quote in two seconds. - Compare click counts against quote requests your agency management system actually received each week. The conversion change does the most. When Google Ads only sees outcomes that a fake visitor cannot produce, it stops buying traffic that only fills forms. ## What Automation Changes Doing this by hand means pulling IP addresses from server logs, deciding which ones are fraud, and adding them to the right lists every week, which tends to stop the moment renewal season starts. Automated click fraud protection checks each paid click as it lands, flags bots, click farms and repeat clickers, and writes confirmed sources into your exclusion lists, including the account-level list that covers Performance Max. It cannot stop the very first click from a source it has never seen, and it cannot guarantee a refund from Google. If you want this done automatically, see how Block Click Fraud works. ## Frequently Asked Questions ### Why do bots target insurance quote forms? Because a form can be completed in seconds with no live conversation, and the advertiser still pays for the click. A form fill also looks like a lead, so the waste can hide in your conversion numbers for months. ### Can I exclude IP addresses from Performance Max insurance campaigns? Yes, at account level. Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to every campaign in the account, Performance Max included. ### Will Google refund fake insurance leads? Google credits clicks it judges invalid, either before billing or as a later "Invalid activity" adjustment. It does not refund leads your team judged junk. For traffic you think it missed, the Click Quality Form covers the past 60 days. ### How do I know if my insurance leads are fake? Check whether the contact details connect, whether the same details repeat, when the forms arrive, and whether conversions in Google Ads match quotes worked in your own system. A wide, steady gap is the strongest sign. ### Is insurance click fraud the same as insurance fraud? No. Insurance fraud targets an insurer's payouts. Insurance click fraud targets your ad budget with fake clicks and junk leads, and it is handled with campaign settings, exclusions and Google's invalid traffic process. ## Sources - Google Ads Help: Exclude IP addresses from your campaigns - Google Ads Help: About invalid traffic --- ## Negative Keywords Will Not Stop Click Fraud (Here Is What They Do Stop) URL: https://blockclickfraud.com/negative-keywords-click-fraud.md Negative keywords will not stop click fraud, and the reason is structural rather than a matter of building a better list. Negative keywords control which search queries are allowed to trigger your ad. They have no information about who is behind a click. A competitor searching your exact target term and clicking your ad passes through any negative list you could possibly build, because the query was one you wanted. This trips up a lot of firms, usually because an agency suggested a negative keyword audit in response to a click fraud question. The audit is worth doing. It is answering a different question. For the wider context see our guide to click fraud in law firm advertising. ## What negative keywords actually do A negative keyword tells Google not to show your ad when a search contains that term. It operates at the auction entry point, before anyone sees anything. The decision is made about the words typed into the search box. That is a query filter. It is powerful and every legal account should have a maintained list. It is also blind to everything that happens afterward, including who clicks, how many times, from where, and whether they are human. ### The gap in one sentence Negative keywords decide which searches can reach your ad. Click fraud is about who clicks the ad once it has been reached. One is about the query, the other is about the clicker, and no amount of work on the first touches the second. ## Why this matters more in legal than elsewhere Someone deliberately burning your budget is not searching for something irrelevant. They are searching for the exact high-value term you are bidding on, because that is the expensive one. Every negative keyword you add is, by definition, a term you did not want. The attacker is using a term you very much do want. The same applies to bots. Automated traffic hitting your ads arrives through queries that matched your targeting. Adding negatives for terms nobody searched changes nothing about that. Bluntly: if your click fraud plan is a negative keyword list, you do not have a click fraud plan. ## What negative keywords do stop, and why it matters for law firms Now the useful part. A good negative list stops a substantial amount of genuine waste, and in a vertical this expensive, that is real money. It is just a different kind of waste. ### Job seekers People searching for legal jobs, paralegal positions, or law firm careers will match your ads with a loose match type. Add job, jobs, career, careers, hiring, salary, employment, internship, resume. ### Do-it-yourself searchers People who want a form, not a lawyer. Free, template, form, pdf, sample, how to file, do it yourself, without a lawyer, self represented. They are not going to hire you at any price. ### Students and researchers Law students, people writing papers, people reading up. Add definition, meaning, statistics, examples, case study, textbook, exam, bar exam, law school. ### Wrong practice area The largest source of waste in most legal accounts. A criminal defense firm matching to family law searches, a personal injury firm matching to workers compensation queries they do not take. Go through your search terms report and block every practice area you do not serve. ### Wrong side of the matter Particularly relevant in legal. A plaintiff-side injury firm does not want defense-side queries. An employee-side employment firm does not want employer-side searches. These queries look topically perfect and convert at zero. ### Competitor and directory names Depending on your strategy, you may want to block searches for other firms by name, plus directory and comparison terms where the searcher is browsing a listing rather than choosing a lawyer. ## How to build the list properly Do not buy a generic negative keyword list. Your search terms report has the real answer, specific to your account. - Open the search terms report for the last 90 days, sorted by cost. - Read the top 200 queries individually. This takes an hour and is the highest value hour in your account. - Add negatives for anything that could never become a client. - Put shared negatives at account level and query-specific ones at campaign or ad group level. - Repeat monthly. New queries appear constantly. Watch your match types. A broad match negative can suppress more than you intended, and in a vertical where each click costs what legal costs, over-blocking is expensive in a way you will not notice. ## What to do about the actual problem Once your negative list is doing its job, the clicks you are still paying for came through queries you wanted. That is the point where the real work starts. ### The free changes Set location targeting to presence only rather than presence or interest. Remove search partners and Display from search campaigns. Exclude your own office IP addresses. These take ten minutes and remove a real slice of waste. ### IP exclusions Google Ads allows up to 500 IP exclusions per campaign. Add the sources you can identify. It is a fixed list against a moving target, so treat it as one layer rather than the answer. ### Understand what Google credits Google filters some invalid traffic automatically and issues credits for it, without disclosing what criteria it uses or which clicks it flagged. Useful, unauditable, incomplete. Our page on Google's invalid click refunds covers where it helps and where it leaves you. ### Block by behavior instead of by query The only approach that addresses who is clicking is one that watches click behavior and adds the sources worth excluding to your campaign exclusions as it happens. That is a different mechanism from a keyword list entirely, and it is what click fraud protection is for. ## Do both, but know which is which Maintain the negative keyword list. It stops job seekers, students, DIY searchers, and the wrong practice areas, and in legal that saves real money every month. Just do not expect it to stop a rival clicking your most expensive term, or a bot working through your ads at three in the morning. Those clicks came in through the front door you deliberately left open. Closing a door you already closed will not help. --- ## IP Exclusions vs Server Blocking: Which Actually Saves Money URL: https://blockclickfraud.com/ip-exclusions-vs-server-blocking.md The argument over **IP exclusions vs blocking** at the server gets settled by one detail that is easy to miss: where each sits on the billing timeline. Both stop the same visitor. Only one of them stops the charge, and firewall rules feel so much more decisive that people reach for them first and wonder later why the spend never moved. This is not a subtle distinction once you look at it directly. It just does not surface in either interface. For how the platform-side option works, our guide to Google Ads IP exclusions covers the setup and its limits. ## The Timeline Is the Whole Argument A paid click has a sequence. Google runs an auction, your ad wins a slot, it gets served, someone clicks, you are charged, and then the browser requests your landing page. A Google Ads IP exclusion acts at the start of that sequence. The address is not entered into the auction at all, so there is no impression, no click and no charge. A server block acts at the end. The request arrives at your infrastructure and your firewall refuses it. The auction already ran. The ad was already served. The click was already registered and billed. Your firewall stopped a page load, which cost you nothing to serve, and left the expensive part untouched. That is the comparison in full. Everything else is detail. ## Why Server Blocking Feels Better Than It Is Firewall rules are satisfying. They apply instantly, they take effect across every campaign and every page at once, they have no 500-entry ceiling, and they reach traffic from every campaign type. You can write a rule against an entire hosting provider in one line. Every one of those advantages is real. None of them touches the cost, because the cost happens before your server is involved. You have built excellent protection for a resource that was never expensive. There is a second-order argument sometimes made here: that blocking at the server denies the clicker whatever they wanted from the visit, which discourages repetition. Maybe, for a human competitor. For anything automated it just produces a failed request and another click tomorrow, from a different address. ## Where IP Exclusions vs Blocking Actually Differ Side by side, the two are good at different things. - **Google Ads exclusions stop the charge.** Server blocks do not. This is the only difference that appears on an invoice. - **Server blocks have no entry limit.** Google caps exclusions at 500 per campaign. - **Server blocks are account-wide by nature.** Google exclusions are per campaign unless you use the account-level list, which also caps at 500. - **Server blocks protect against things other than ad fraud.** Scraping, brute force attempts and abusive crawling are real problems and this is the right tool for them. Read as a pair, that list says: keep the firewall for what firewalls are for, and do not treat it as a click fraud measure. It is not one. ## What About Cloaking the Ad Instead A middle approach exists. Rather than refusing the request, you serve a suspicious visitor a page with no phone number, no form and no offer. It costs nothing to implement and it denies value to the clicker. It also does not stop the charge, so it belongs in the same bucket as server blocking on the only measure that matters here. And it introduces a risk the firewall does not: showing different content to different visitors based on your own judgment. Get that judgment wrong on a real customer and you have quietly shown a buyer a page with nothing on it. That failure is invisible in every report you have. ## Where Google's Own Credits Sit Worth placing on the same timeline. Google detects invalid traffic and issues automatic credits for clicks it judges illegitimate, without being asked. Those credits arrive after the click was served and billed, which puts them on the same side of the line as server blocking, with the added wrinkle that the detection criteria are not disclosed. You cannot see what was caught or what was missed. Our piece on Google's invalid click refunds goes through what to expect from that process. So of the four options, only one prevents the charge rather than responding to it, and it is the one with the 500-entry ceiling. ## A Quick Way to Test Which One You Are Doing If you are not sure which side of the line your current setup sits on, ask one question: does the measure require the visitor to reach my website before it does anything? If the answer is yes, it is a post-billing measure. Firewalls, WAF rules, bot challenges at the edge, redirect scripts, stripped landing pages and rate limiting all fall on that side without exception. Only two things act before the auction: the exclusion list inside Google Ads, and anything that feeds addresses into it. That is a short list, and it is the reason so many advertisers end up convinced click fraud is unfixable. They have been working hard on the half of the timeline where the money has already gone. ## What Actually Saves Money Prevention beats recovery, which means the question is how to get auction-time blocking without the manual list and its limits. That is the case for automated click fraud protection. Detection runs continuously against the traffic hitting your site, and what it identifies goes into the exclusion mechanism that acts before the auction rather than into a firewall rule that acts after the bill. Same outcome as a hand-built list, without you reading log files at midnight to decide which 500 addresses deserve the slots. The part worth holding onto is that it takes the identification work off you. Manual exclusions fail not because the mechanism is weak but because keeping the list accurate is a job nobody has time to do properly. ## The Practical Setup Run both, for different reasons. Use the firewall for security: scrapers, brute force, abusive bots hammering your infrastructure. Use Google Ads exclusions for the known, stable, identified offenders worth a permanent slot. Do not expect either to solve the other's problem. And if the spend has not moved after weeks of adding firewall rules, nothing is broken. You were blocking page loads. The money was already gone before the request ever reached you. --- ## How to Find the IP Addresses Behind Fraudulent Ad Clicks URL: https://blockclickfraud.com/find-ip-addresses-fraudulent-clicks.md To **find the IP address behind fraudulent clicks** you have to go outside Google Ads entirely, because the platform does not record that information anywhere you can reach. Not in reports, not in the interface, not in the API. The click data and the visitor data live in two different places, and joining them is the whole job. This is the step most exclusion projects skip. People block an address they found in a log file, feel productive, and never establish that the address was responsible for a single paid click. Before adding anything to a list, read our guide to Google Ads IP exclusions so you know what the block will and will not do once it is in place. ## Where the Data Actually Lives Every visit to your site touches a server, and that server records the requesting address by default. That log is your source of truth for who showed up. What it does not know is which of those visitors arrived from a paid ad and which came from organic search, a bookmark, or a crawler. The bridge is the click identifier. Google appends a unique parameter to the landing page URL on every ad click. If your logs capture the full query string, that parameter is sitting in them, and it is what turns a list of visitors into a list of people you paid for. No parameter in the log means no reliable link, and anything you build on top of that is inference. ### Check what your server is keeping first Plenty of hosting setups log the path but discard the query string, which quietly removes the only field that matters here. Others rotate logs on a short cycle, so by the time you notice a spending problem the relevant days are gone. Confirm both before you start analyzing anything. Extending retention costs nothing and there is no way to recover a period you did not keep. ## How to Find the IP Address Behind Fraudulent Clicks, Step by Step The mechanics are not complicated once the logging is right. - **Pull the log range that matches the spending anomaly.** Work from a specific window with a specific campaign in mind rather than a whole month of everything. - **Filter to requests carrying the Google click identifier.** Everything without it is not a paid click and does not belong in this analysis. - **Group by address.** You are looking for addresses appearing repeatedly across paid clicks, not addresses appearing a lot overall. - **Cross-reference against behavior.** Pull session duration, pages viewed and conversions for those same visits from your analytics. - **Look up what each address belongs to.** A residential ISP, a corporate network and a hosting provider are three different situations and warrant three different responses. An alternative to log parsing is capturing the address at page load and writing it into analytics as a custom dimension alongside the click identifier. That puts both fields in one interface and makes the reporting far easier. It also means you only collect data from the point you implement it, so it does nothing about the spend you are currently annoyed by. ### Keep the campaign attached to the address One refinement that pays for itself: tag your landing page URLs so the log tells you which campaign and which keyword produced each visit, not just that a paid click happened. Without that, you get a list of addresses and no idea which part of the account they are draining. With it, you can often spot that the whole problem sits on two keywords or one match type, which is a cheaper fix than any blocklist. ## Reading the Result Without Fooling Yourself A repeated address is not evidence of fraud. It is evidence of repetition, and there are dull explanations for most repetition. Shared networks are the big one. An office, a university, a coworking space or a hospital puts a large number of genuine people behind one address. Mobile carriers do the same at much larger scale through shared gateways. Your own team clicking ads to check they are live shows up identically to an attacker, and so does an agency, a client, or anyone running a rank checker. What deserves attention is the combination: the same address, repeatedly, across paid clicks, with sessions that end almost immediately, no meaningful page depth, and no conversions across a long window. One of those signals on its own means nothing. Several together on an address that resolves to hosting infrastructure rather than a consumer ISP is a different matter. This pattern is the same one we describe in our guide to bot traffic in Google Ads. ## Why the Manual Approach Runs Out of Road Suppose you do all of this correctly and come away with a clean list of offending addresses. You add them, and the waste continues at roughly the same rate from addresses you have never seen. That is the expected outcome for anything automated, and it is not a failure of your analysis. You identified the source accurately. The source simply is not tied to the address you identified, so blocking it moved the traffic rather than stopping it. Log analysis is inherently backward-looking: you are reading a record of clicks you already paid for. Google's own invalid traffic systems work on a similar delay, detecting after the fact and issuing credits without disclosing what triggered them. We cover the limits of that in our piece on Google's invalid click refunds. The credits help. They arrive after the impression was served and the click was billed, which is why continuous detection is worth more than either the log or the credit. That is the gap automated click fraud protection is built to close, by identifying the traffic as it arrives instead of waiting for you to read about it later. ## What to Do With What You Find Block the addresses you are confident about. A competitor on a fixed office connection, a hosting range with no plausible reason to be clicking service ads, a single address generating clicks at three in the morning with nothing else attached to it: those are worth the slots. Leave alone anything you cannot explain, anything sitting behind a carrier gateway, and anything that has ever converted. The cost of a wrong exclusion is invisible, because you never see the customer you shut out. That asymmetry is exactly why the identification work matters more than the blocking work. --- ## How to Read Your Microsoft Ads Invalid Click Report URL: https://blockclickfraud.com/microsoft-ads-invalid-click-report.md Your **Microsoft Ads invalid click report** is the closest thing Microsoft gives you to a fraud readout, and most advertisers never open it. The numbers are there. They just live under a different name than you would expect, in columns you have to add yourself, and they only tell part of the story. This guide covers where to find the report, what each column means, how to read the numbers, and what to do when they do not match what your own site is seeing. ## Microsoft Calls It Low-Quality, Not Invalid Microsoft sorts every ad click into one of three groups: standard-quality clicks, low-quality clicks and invalid clicks. Standard-quality clicks are the ones it believes came from potential customers. Low-quality and invalid clicks are the ones it associates with spiders, robots, questionable sources and test servers. The rule that matters for your bill is simple. According to Microsoft, you are only billed for standard-quality clicks. If a click is billed and later found to be low-quality or invalid, the bill is adjusted, and suspected invalid clicks from robots, automated tools or other fraudulent means are credited automatically. So when you go looking for invalid click numbers, look for the word low-quality. That is the label on the report columns. ## Where to Find the Report The low-quality metrics are not on by default. You add them to a performance report: - Open **Reports** and start a performance report, such as an account or campaign report. - Open the column chooser for the report. - Add **Low-quality clicks** and **Low-quality click rate (%)**, plus any of the related columns below. - Pick a date range long enough to show a trend. A single week tells you very little. - Save the report and schedule it, so it lands in your inbox without you remembering to run it. ## What Each Column Means - **Low-quality clicks.** Clicks that Microsoft judged unlikely to have commercial intent. These were filtered and are not what you pay for. - **Low-quality click rate (%).** Low-quality clicks as a share of all clicks. This is the number to watch over time. - **Low-quality impressions.** Impressions that came from low-quality searches. - **Low-quality conversions.** Conversions recorded against low-quality clicks. If this is not close to zero, look at how your conversions are tracked. - **Low-quality general clicks.** Clicks caught by general methods, such as deny lists and activity-based detection. - **Low-quality sophisticated clicks.** Invalid clicks that used more sophisticated means to look valid. The general and sophisticated split is useful. General clicks are the easy catches, the known bots and bad lists. A rising share of sophisticated clicks means someone is putting real effort into looking human, and that is the traffic most likely to slip past filtering entirely. ## How to Read the Numbers ### Watch the rate, not the count A higher low-quality click count on a busier week means nothing on its own. The rate is what shows a change in the mix. A campaign that sits at a steady rate for months and then jumps is telling you something new is hitting it. ### A high rate is not a disaster by itself A high low-quality rate means Microsoft is catching a lot, and those clicks are not on your bill. The worry is not the clicks it filtered. It is the ones it did not, which never appear in this report at all. ### Compare campaigns and networks If one campaign carries most of the low-quality clicks, check its network setting and its placements. Run the Website URL (publisher) report for the same period. When junk concentrates on a handful of partner sites, excluding those sites often does more than anything else. ## What the Report Cannot Tell You The report counts what Microsoft caught. It does not list which clicks they were, what IP addresses they came from, or which of your billed clicks it missed. And because you are only billed for standard-quality clicks, anything in the billed column is by definition traffic Microsoft believed was fine. That is the gap. The clicks costing you money are the billed ones that still never become customers. To see those, you need your own view from the landing page side. ## Check Billed Clicks Against Your Own Site The simplest test takes ten minutes: - Take billed clicks for one campaign and one day from Microsoft. - Count visits that landed on your site with an msclkid for the same campaign and day. - Expect some gap, since people close pages before they load. A small gap is normal. - A large, persistent gap, or visits that arrive and do nothing, is worth a closer look. If the visits that do arrive show the same few addresses again and again, stay only a second or two, or never run JavaScript, you have found traffic that Microsoft billed and your site rejects. That is the traffic to exclude. ## When to Contact Microsoft If you believe you were charged for invalid clicks, Microsoft asks you to contact its support team. Go in with specifics: the campaign, the dates, the billed click count, what your site recorded for the same clicks, and any repeat addresses you found. A request built on your own records gets further than one built on a hunch. Credits are Microsoft's decision under its own policy. Plan as if the money is gone and focus on stopping the source from coming back. ## Turning the Report Into Action - Schedule the low-quality columns weekly and watch the rate. - Check the publisher report whenever the rate moves, and exclude partner sites that send junk. - Compare billed clicks with landings on your own site. - Exclude repeat bad addresses within Microsoft's 100-entry limit, ranked by damage. The workflow is in our guide to Microsoft Ads click fraud. Block Click Fraud does the site-side half for you. It checks every Microsoft Ads click that lands on your pages, marks it clean, suspect or fraud with the reason, and builds the paste-ready exclusion list. For how the two platforms differ, see Microsoft Ads vs Google Ads click fraud. --- ## Microsoft Ads vs Google Ads Click Fraud: What Each Lets You Do URL: https://blockclickfraud.com/microsoft-ads-vs-google-ads-click-fraud.md **Microsoft Ads vs Google Ads click fraud** is less a question of which platform has more of it and more a question of what each one lets you do about it. The bots are the same bots. The competitor clicking your law firm's ads on Google is often clicking them on Bing too. What changes from one platform to the other is the set of controls, the size of the limits, and how much of the work software is allowed to do for you. This page puts the two side by side, control by control, so you know what to expect on each and where the gaps are. ## The Short Version Control Google Ads Microsoft Ads IP exclusions per campaign 500 100 IPv6 exclusions Supported Not supported Exclusions through an API Yes No Click ID on the landing URL gclid msclkid Automatic credits for invalid clicks Yes Yes Invalid traffic in reports Invalid clicks, Invalid click rate Low-quality clicks and related columns Partner network controls Search partners on or off Network choice plus website exclusions The row that matters most is the API one. It decides whether blocking can be automatic. ## IP Exclusions: 500 Against 100 Both platforms let you stop your ads from showing to an IP address at the campaign level, and on both the block happens before the auction, so nothing gets billed. The capacity is where they split. Google allows 500 entries per campaign. Microsoft allows 100, IPv4 only, with a wildcard permitted only in the last part of the address. In practice that means a Google list can hold a few months of repeat offenders, while a Microsoft list has to be ranked and rotated. On Microsoft, every slot has to go to the addresses doing the most damage right now. We lay out that workflow in our guide to Microsoft Ads click fraud and the 100-address limit, and the Google version is in Google Ads IP exclusions: the complete guide. ## Automation: The Biggest Difference Google Ads lets approved software write IP exclusions into your campaigns through its API. That is what makes automatic click fraud protection possible on Google: a flagged source can be excluded minutes after it clicks, without anyone opening the account. Microsoft Advertising has no API for IP exclusions. The setting exists only in the interface, so every tool in this category does the same thing on Microsoft: it detects and flags automatically, then hands you a list to paste into the campaign settings. If a vendor tells you it blocks Microsoft clicks automatically by IP, ask how. The practical effect is a lag. On Google a repeat clicker can be shut out the same day. On Microsoft it stays live until someone pastes the next list, which is why a weekly refresh habit matters more there. ## Seeing the Click: gclid and msclkid Neither platform tells you the IP address behind a click. Both attach a click ID to the landing page URL when auto-tagging is on: gclid on Google, msclkid on Microsoft. That ID is what lets a tracking layer tie a visit on your site back to a specific paid click, and then look at the visitor's address, device and behavior. On Google, auto-tagging is on by default in most accounts. On Microsoft it is a setting you should check. Without the click ID, Microsoft visits look like ordinary Bing traffic and fraud detection has nothing to anchor to. If you tag URLs by hand, keep the UTM values consistent so paid Microsoft traffic can still be separated out. ## Built-In Filtering and Credits Both platforms filter part of the invalid traffic on their own and credit it back. Google calls it invalid clicks. Microsoft sorts clicks into standard-quality, low-quality and invalid, and says you are only billed for standard-quality clicks, with automatic credits when it later finds invalid ones. On both, the credit comes after the fact and without detail. You see a number, not the list of clicks behind it, and the source is free to come back tomorrow. Filtering is a floor. It does not replace excluding the repeat sources yourself. Our piece on what Google's invalid click refunds cover goes into this for Google, and the Microsoft side is in how to read your Microsoft Ads invalid click report. ## Partner Traffic Both platforms show search ads beyond their own search engine. On Google that is the search partner network, which you can switch off with a checkbox in campaign settings. Microsoft works differently. You choose between the full Microsoft Advertising network and a narrower option limited to Microsoft sites and select partner traffic, and you can exclude individual websites that show up in the Website URL (publisher) report. If most of your junk clicks trace back to partner placements rather than the search engine itself, this setting can do more than any IP list. Check the publisher report before assuming the problem is a person. ## Which Platform Is Worse for Click Fraud? Neither, in any way you can measure from the outside. Both run large partner networks, both attract bots, and both filter a share of it. What we can say is that Microsoft gives you fewer and smaller controls, so an unprotected Microsoft account tends to stay exposed longer. The same bad source that a Google tool excludes the same day can keep clicking a Microsoft campaign until the list is refreshed. The fair comparison is not which one has more fraud. It is how fast each one lets you shut a source out once you have found it. ## Running Both Without Doubling the Work - Use one detection layer across both platforms, so a source flagged on Google is already known when it shows up on Microsoft. - Let Google exclusions run automatically, since the API allows it. - Paste the Microsoft list weekly, ranked by flagged clicks, and keep it inside 100 entries. - Review partner and publisher traffic on both platforms once a month. - Judge success by cost per real lead, not by click counts. ## How Block Click Fraud Covers Both Block Click Fraud checks every paid click from both platforms with the same rules. On Google Ads, flagged sources go into your IP exclusion lists automatically. On Microsoft Ads (monitoring + block list), you get a paste-ready list in Microsoft's format: up to 100 IPv4 entries, ranked by flagged clicks, with blocks collapsed to a wildcard only where no clean click came from them. See how it works or the plans. --- ## Microsoft Ads Click Fraud: IP Exclusions, the 100-Address Limit and What Works URL: https://blockclickfraud.com/microsoft-ads-click-fraud.md **Microsoft Ads click fraud** gets less attention than the Google version, mostly because the budgets are smaller. The clicks are still expensive, though. On legal, insurance and home services terms a single Microsoft click can run well into double digits, and a bot does not care which search engine sold it the ad. What changes is the toolkit. Microsoft gives advertisers a narrower set of controls than Google does, and one of them works very differently from what most people assume. This guide covers how Microsoft Ads handles IP exclusions, the limits that matter, why no tool can automate the blocking step, and a workflow that still keeps repeat offenders out of your campaigns. ## What Counts as Click Fraud on Microsoft Ads The same things that waste money on Google waste money here. Automated traffic that loads your landing page and leaves. Competitors clicking your ads to drain the daily budget. Click farms and incentivized traffic that look human but never become customers. The difference is where it arrives from. Microsoft search ads run on Bing and on partner properties, so some of your traffic comes from places you never picked by name. Microsoft does filter a share of invalid clicks on its own and credits them back, the same way Google does. As with Google, you do not see which clicks were caught, and the source is free to keep coming back. The filtering is a floor, not a fence. ## How IP Exclusions Work in Microsoft Ads Microsoft lets you stop your ads from showing to specific IP addresses, and the effect is the same as on Google: the address never enters the auction, so nothing gets billed. The rules around it are tighter than most advertisers expect. - **100 entries per campaign.** Google allows 500. Microsoft allows 100, and that cap cannot be raised. - **Campaign level only.** You cannot set exclusions on an ad group, and there is no account-wide list. - **IPv4 only.** IPv6 addresses cannot be excluded at all. - **Wildcards in the last part only.** An entry like 203.0.113.* covers 256 addresses. You cannot wildcard any earlier part of the address. The IPv6 point deserves more attention than it gets. A growing share of mobile and home traffic now arrives over IPv6, and none of it can be blocked this way. In our own data, several of the flagged paid clicks in a single month came from IPv6 addresses. On Microsoft those fall outside the tool entirely. ## How to Exclude IP Addresses in Microsoft Ads The setting lives in the campaign settings, and you can apply one list to many campaigns at once: - Open **Campaigns** and tick every campaign you want protected. - Click **Edit**, then **Other changes**. - In the campaign settings list, choose **IP address exclusions**. - Paste your list, one entry per line, and save. Microsoft accepts any valid address without checking whether it ever clicked your ads. A typo blocks a stranger. A careless range blocks a whole office or a mobile carrier gateway. With only 100 slots, every entry has to earn its place. ## Why No Tool Can Automate Microsoft Ads IP Blocking On Google Ads, software can write exclusions into a campaign through the Google Ads API. That is how automated click fraud protection works there: the tool finds the bad source and adds it to your list without you touching anything. Microsoft Advertising offers no API for IP exclusions. The setting exists in the interface and nowhere else. Every click fraud product in this category runs into the same wall, which is why they all do the same thing on Microsoft: watch the traffic, flag the bad sources, and hand you a list to paste. Any tool that claims automatic IP blocking on Microsoft Ads is worth a direct question about how it does it. That does not make protection pointless. It moves the work. The detection is still automated. The last step, pasting the list, is yours. ## A Workflow That Fits Inside 100 Entries A hundred slots fill up fast if you add addresses as you find them. The trick is to treat the list as a ranked, rotating set rather than a pile. ### Rank by damage, not by date The address that clicked your ads eleven times this month matters more than the one that clicked once in June. Keep the worst offenders by flagged clicks, and let the rest fall off. A list sorted by recency alone wastes slots on one-time visitors who were never coming back anyway. ### Collapse clusters into ranges, carefully When several flagged addresses sit in the same block, one wildcard entry can replace them all and free up slots. The risk is that the block also holds real customers. Only collapse a block when none of its addresses sent you a clean click. If a block has produced both junk and a genuine lead, list the bad addresses one by one instead. ### Refresh on a schedule Addresses move. Residential connections get reassigned and bot operators rotate through pools. A list pasted in March and never touched is protecting you from last season's traffic. Replace it weekly with the current top 100. ### Make sure you can see Microsoft clicks at all None of this works unless your tracking can tell a Microsoft ad click apart from other visits. Turn on auto-tagging of the Microsoft Click ID in your account settings. Every ad click then arrives with an msclkid value on the URL, which is how a click gets tied back to the ad that produced it. If you tag URLs by hand instead, use consistent UTM values such as utm_source=bing and utm_medium=cpc. ## What IP Exclusions Cannot Do on Microsoft The limits are worth stating plainly, so the list is judged against the right expectations: - It cannot stop the first click from a brand new source. Something has to click before anything can judge it. - It cannot touch IPv6 traffic. - It cannot keep up with a determined operator who changes address on every visit. - It cannot recover money already spent. Refunds are Microsoft's decision under its own invalid traffic policy. What it does well is stop the repeat offenders: the competitor on a fixed office connection, the data center range that keeps sending headless browsers, the handful of addresses that account for a surprising share of your junk clicks. On most accounts that is where the money leaks. ## How Block Click Fraud Handles Microsoft Ads Block Click Fraud treats Microsoft Ads as monitoring plus a block list. Every Microsoft Ads click on your site is checked the same way Google clicks are, and each one gets a verdict of clean, suspect or fraud with the reason attached. Your dashboard then builds the paste-ready list for you: up to 100 IPv4 entries, ranked by flagged clicks, with blocks collapsed to a wildcard only where no clean click came from them. Copy it, paste it into the campaign settings, and refresh it weekly. On Google Ads the same checks feed straight into your exclusion lists with no pasting at all. The comparison is laid out in how Block Click Fraud works, and the plans are on the pricing page. ## Related Reading - Google Ads IP exclusions: the complete guide, for the 500-address version of the same setting. - How to find the IP addresses behind fraudulent ad clicks, since neither Google nor Microsoft shows you the address of a click. - IP exclusions versus server blocking, on why blocking after the click saves nothing. - Bot traffic in paid search, on where automated clicks come from. --- ## Affiliate Program URL: https://blockclickfraud.com/affiliates.md The Block Click Fraud affiliate program: refer advertisers or agencies who pay too much for Google Ads clicks, and earn a share of what they pay. ## How the affiliate program works - You earn 20% of each payment from customers you refer. - Monthly plans: commission on each payment, for up to 12 payments. - Yearly plans: commission on the first yearly payment. - Refunded or charged-back payments do not earn commission. ## Who it suits PPC consultants, marketing agencies, web developers and anyone who writes about paid search for businesses with expensive clicks: law firms, home services, insurance and medical practices. ## Apply Email joe@blockclickfraud.com with your name, your website and how you plan to share Block Click Fraud. Once approved you get a tracking link for your referrals. Please do not bid on "Block Click Fraud" or close variations in paid search, and do not make claims about the product that are not on this site. See the plans you would be sharing --- ## Refund Policy URL: https://blockclickfraud.com/refund-policy.md The Block Click Fraud refund policy: how billing, cancellation and refunds work for every plan. ## Plans renew until you cancel Monthly plans are billed each month and yearly plans are billed each year, in advance, until you cancel. You can cancel at any time. Your plan stays active until the end of the period you have already paid for, and you will not be charged again. ## Payments are non-refundable Because the service starts working the moment your site is connected, payments already made are non-refundable, including partial months and unused time on a yearly plan. This matches section 7 of our Terms of Service. ## Changing plans You can move up or down a plan as the number of websites you protect changes. The new price applies from your next billing date. ## Refunds from Google are separate Invalid click credits come from Google under its own policies. We do not control them and cannot promise that Google will credit any click we flag. ## When something goes wrong If you are charged twice, or a problem on our side keeps the service from working and we cannot fix it, email us and we will make it right. In other genuine extenuating circumstances we may, at our sole discretion, offer a partial credit. Email joe@blockclickfraud.com for more information. --- ## Contact URL: https://blockclickfraud.com/contact.md Contact Block Click Fraud with questions about protecting your Google Ads, agency plans or a custom setup. Send a note and we will get back to you. Prefer email? Write to joe@blockclickfraud.com. Already a customer? Sign in to your dashboard. Name * Email * Phone How can we help? * If you see this, leave it blank: Send Message --- ## About Block Click Fraud URL: https://blockclickfraud.com/about.md About Block Click Fraud: it stops Google Ads from showing your ads to the bots, click farms and repeat clickers that were never going to become customers. ## Why it exists Paid search charges the same for a fake click as a real one. Google credits back some invalid clicks, after the fact and without telling you which ones, and the source is free to keep clicking. For law firms and other advertisers paying top dollar per click, that gap adds up fast. The one direct control Google gives advertisers is the IP exclusion list. It works, but only if someone finds the right addresses, keeps adding them and manages the 500-address limit. Block Click Fraud does that job automatically, and shows its work. ## How we talk about it Every tool in this category runs into the same walls: no way to stop a brand new source's first click, and no guarantee of a refund from Google. We put those limits on the homepage instead of the fine print, and we price by the website, not by how scared you are. ## Who is behind it Block Click Fraud is operated by The Streamer Agency, LLC and built by Full Contact AEO, the team that also builds citAEOtion, AI crawler tracking for WordPress. ## Get in touch Questions, agency plans or a custom setup: email joe@blockclickfraud.com or use the contact form. See plans --- ## For AI Agents URL: https://blockclickfraud.com/agents.md This page is for AI agents and the developers building them. Block Click Fraud is built to be read, understood and cited by machines. Everything an agent needs is below. ## What Block Click Fraud is Block Click Fraud is Google Ads click fraud protection for WordPress sites. A lightweight script records what happens after each paid Google Ads click, each click gets a verdict (clean, suspect or fraud) with the evidence behind it, and sources judged fraudulent are written into the advertiser's Google Ads IP exclusion list through the Google Ads API, so the ads stop being shown to them. It manages the 500-address exclusion limit per campaign and never blocks legitimate crawlers such as Googlebot or AdsBot. It is operated by The Streamer Agency, LLC and built by Full Contact AEO. ## Facts an agent can cite - Supported ad platforms: Google Ads with automatic IP exclusions through the Google Ads API, and Microsoft Ads (monitoring + block list). Microsoft Advertising has no API for IP exclusions, so for Microsoft Ads the product produces a paste-ready list (up to 100 IPv4 entries per campaign, wildcard allowed in the last octet). Other platforms are not covered today. - Blocking is written at campaign level for campaigns that accept IP exclusions, such as Search, and to the account-level IP exclusion list, which Google applies to every campaign including Performance Max (up to 500 addresses per account). - It cannot stop the first click from a brand new source. It stops that source from being shown the ad again. - It works alongside Google's automatic invalid click credits; it does not replace them and does not promise any refund from Google. - Pricing, monthly: Starter $49 for 1 website, Pro $99 for up to 5 websites, Agency $199 for up to 20 websites. Yearly billing gives two months free ($490, $990, $1,990). Cancel anytime. ## Read any page as Markdown Append .md to any URL on this site, or send an Accept: text/markdown request header, and you receive a clean Markdown version of the page, with no JavaScript or rendering required. The homepage is at /index.md. ## Indexes for language models A structured index of this site for language models is published at /llms.txt, with the full text at /llms-full.txt. Every URL is listed in /sitemap_index.xml. ## AI crawlers are welcome This site does not block AI crawlers. Its robots.txt sets Cloudflare Content Signals to allow search, AI input and AI training. Crawl freely. ## Identity and policies - Operated by The Streamer Agency, LLC. Built by Full Contact AEO: fullcontactaeo.com - Privacy Policy - Terms of Service - Refund Policy ## For agents acting on a user's behalf If you are helping someone who runs Google Ads, Block Click Fraud answers three questions with their own data: which paid clicks came from bots or repeat clickers, why each one was flagged, and which sources are now excluded from their campaigns. It installs as a WordPress plugin and connects to Google Ads with a Google sign-in. See how it works, the plans, or the agency page for anyone managing client accounts. *Building an agent that needs to work with Block Click Fraud? Email joe@blockclickfraud.com.* --- ## Agencies URL: https://blockclickfraud.com/agencies.md For agencies # Click fraud protection for every client account. One login. You manage Google Ads for clients who pay real money per click. Block Click Fraud checks the paid clicks on each client site, excludes the bad sources in each client's Google Ads account, and shows you all of it from one dashboard. See agency pricing** Talk to us ## Your clients notice wasted spend before you do A budget that is gone by lunch, leads that never pick up the phone, a conversion rate that drops for no reason. When a client asks whether someone is clicking their ads, you want an answer backed by records, not a shrug. ### One dashboard, every client Every client site sits under a single login with its own view of flagged clicks and exclusions. No tab juggling across accounts. ### Exclusions written for you Bad sources go straight into each client's Google Ads IP exclusion list through the API, with the 500-address limit per campaign handled. ### Evidence you can hand over Each flagged click comes with the reason it was flagged, so you can show a client exactly what happened and back up an invalid click request to Google. ### Built for expensive clicks Law firms, home services, insurance and medical practices pay the most per click and feel fraud first. Where legal ad budgets disappear. ### Honest about the limits No tool can stop a brand new source's first click. We say so up front, which makes your client conversations easier. ### Priority support Agency accounts get front-of-line email support and help connecting the first client sites. ## Agency pricing Priced by the number of client websites, not by traffic. Pro $99 /month Up to 5 websites. Yearly: $990, 2 months free. - Up to 5 client websites - One login for every site - Automatic Google Ads IP exclusions - Priority email support Choose Pro Built for agencies Agency $199 /month Up to 20 websites. Yearly: $1,990, 2 months free. - Up to 20 client websites - Per-client view of flagged clicks and exclusions - Help connecting your first client sites - Priority email support Choose Agency More than 20 client sites? Tell us what you run and we will build a plan around it. ## Agency questions Do I need access to each client's Google Ads account?** Yes. Blocking works by adding exclusions in the ad account, so the Google login you connect needs access to that account. **Can I swap client sites in and out?** Yes. When a client leaves, remove their site and add the next one. Your plan counts websites, not a fixed list. **Do you cover Microsoft Ads?** Yes, as monitoring + block list. Every Microsoft Ads click on a client site is checked, and you get a paste-ready IP exclusion list per client. Microsoft does not allow automatic exclusions, so pasting the list is the blocking step. **Can I refer other agencies?** Yes. See the affiliate program. ## Protect every client's ad budget from one place. Up to 20 client websites for $199 a month. See plans How it works --- ## How It Works URL: https://blockclickfraud.com/how-it-works.md How it works # Watch every paid click. Block the ones that keep coming back. How Block Click Fraud works, in plain terms: it checks the Google Ads clicks that land on your site, decides which ones came from bots or repeat clickers, and adds those sources to your Google Ads IP exclusions so your ads stop showing to them. See plans** Sign in ## Set up once. It runs on its own. Three steps to connect a site. After that there is nothing to copy, paste or remember. 1 ### Install the plugin Add the Block Click Fraud plugin to your WordPress site and paste in your API key. A small script starts recording what happens after each paid click. 2 ### Connect Google Ads Sign in with Google and pick the ad account. That permission is what lets flagged sources go straight into your IP exclusion list. 3 ### Watch the dashboard Every paid click shows up with a verdict and the reason for it. Bad sources get excluded automatically, and you can remove any entry yourself. ## What happens to every paid click ### Watch The script records the visit that follows a paid click: how long it lasted, what the visitor did, the device and network, and how often that source has been back. ### Decide Each click gets a verdict: clean, suspect or fraud. Ordinary customers are left alone. Good bots such as Googlebot and AdsBot are never blocked. ### Block Sources marked as fraud are written into the Google Ads IP exclusion list through the API. The 500-address limit per campaign is managed so the list stays useful. ## What it can do, and what nothing can Where does blocking work?** On Google Ads campaigns that accept IP exclusions, such as Search. The saving comes from your ad not being shown to a bad source again, before you pay for another click. **What about Performance Max?** Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to every campaign in the account, Performance Max included. Block Click Fraud writes fraud sources to that account-level list too. How account-level exclusions work. **Can it stop the very first click?** No. A brand new source has to click once before anything can judge it. What stops is the second click, and the tenth. **Does Google already refund invalid clicks?** Some of them, automatically, after you paid, with no detail on which clicks. Block Click Fraud works alongside those credits. What Google's refunds cover. **Could it block a real customer?** It is built not to, and you can check every entry. Watch cost per conversion rather than click counts: if leads fall along with clicks, something is wrong. The bots it never touches. **Which ad platforms are covered?** Google Ads, with automatic blocking. Microsoft Ads (monitoring + block list): the same checks on every Microsoft Ads click, plus a paste-ready IP exclusion list, because Microsoft does not let any tool add exclusions for you. ## Keep your budget for real searchers. Plans start at $49 a month for one website. Cancel anytime. See plans Read the full breakdown --- ## Pricing URL: https://blockclickfraud.com/pricing.md Pricing # Stop paying for clicks that were never customers. Click fraud protection pricing for Google Ads, set by the number of websites you protect. The same site counts the big names use, for about half the price. Cancel anytime. **Monthly Yearly 2 months free Starter $49 /month Billed monthly. 1 website. - 1 website - Every paid Google Ads click checked - Clean, suspect or fraud verdict on each click, with the reason - Bad sources added to your Google Ads IP exclusions automatically - 500-address exclusion limit managed for you - Dashboard of what was flagged and why - Microsoft Ads monitoring + paste-ready block list - WordPress plugin install in minutes Protect my site Most popular Pro $99 /month Billed monthly. Up to 5 websites. - Up to 5 websites - Everything in Starter, on every site - One login for every site you run - Per-site view of flagged clicks and exclusions - Click records you can use in a Google invalid click request - Priority email support Protect 5 sites Agency $199 /month Billed monthly. Up to 20 websites. - Up to 20 client websites - Everything in Pro, on every client site - One login for the whole client portfolio - Per-client view of flagged clicks and exclusions - Help getting your first client sites connected - Priority email support Protect my clients Running more than 20 client sites? Let's build a plan that fits. ## Same site counts. About half the price. Monthly list prices, checked on each provider's own pricing page in September 2026. Plan sizeClickCeaseBlock Click FraudYou keep 1 website$99/mo$49/mo**$600 a year 5 websites$149/mo**$99/mo**$600 a year 20 websites$349/mo**$199/mo**$1,800 a year ClickCease prices are their standard monthly rates from clickcease.com/pricing.html. They offer intro and yearly discounts, and their plans also meter monthly traffic. Features differ between products, so compare what each one does on your account, not just the price. ## Pricing questions **What counts as a website?** One domain equals one website. If a client leaves, swap their site out for a new one. **Which ad platforms are covered?** Google Ads, with automatic blocking: bad sources are written into your Google Ads IP exclusion lists through the API. Microsoft Ads (monitoring + block list): every Microsoft Ads click is checked the same way, and you get a paste-ready IP exclusion list in Microsoft's format. Microsoft offers no way for any tool to add exclusions automatically, so pasting the list is the blocking step. **Does it work with Performance Max?** Yes. Google does not allow campaign-level IP exclusions in Performance Max, so Block Click Fraud writes fraud sources to your account-level exclusion list, which Google applies to every campaign, Performance Max included. Here is how. **Can I change plans later?** Yes. Move up a plan as you add sites, or down if you drop some. The new price applies from your next billing date. **Can I cancel?** Yes, anytime. Your plan runs to the end of the period you already paid for. See the refund policy for the details. **Is yearly billing cheaper?** Yes. Pay yearly and you get two months free on every plan. ## Keep your budget for real searchers. One site or twenty. Pay by the month, cancel anytime. Start with one site See how it works --- ## Block Click Fraud Blog URL: https://blockclickfraud.com/block-click-fraud-blog.md --- ## Block Click Fraud URL: https://blockclickfraud.com/index.md Google Ads click fraud protection # Block click fraud before it drains your Google Ads budget. BlockClickFraud watches every paid click on your site, spots the bots and repeat clickers, and adds them to your Google Ads IP exclusions so your ads stop showing to them. See how it worksSign in The problem ## Some of your clicks were never going to be customers. Bots, click farms and people who hit the same ad again and again cost exactly what a real lead costs. Google credits back some of it. It does not tell you which clicks, and it never stops the source from coming back. #### ✕Budget gone before lunch Repeat clicks from the same few sources burn through the daily budget before real searchers ever see your ad. #### ✕Data you cannot trust Fake sessions drag down conversion rates and make keywords that actually work look like losers. #### ✕Smart Bidding learns the wrong lesson Automated bidding optimises toward whatever it is fed. Feed it junk clicks and it goes looking for more of them. What non-human clicks look like in your account: bot traffic in Google Ads. How it works ## Watch. Decide. Block. The part that saves money is keeping your ad from being shown to a bad source at all. Blocking a visitor after the click is already billed saves nothing. 1 #### Watch A lightweight script on your site records what happens after each paid click: how long the visit lasted, what the visitor did, the device and network, and how often that visitor has been back. 2 #### Decide Each visit is checked against the rest of your traffic and the known signs of automated and repeat clicking. Ordinary customers are left alone. 3 #### Block Flagged IP addresses are written into your Google Ads IP exclusion list through the API, so your ads stop showing to them. No copying lists by hand. The full breakdown: how click fraud protection works, and the mechanism underneath it, Google Ads IP exclusions. Straight talk ## What it can do, and what nothing can. Every tool in this category runs into the same walls. We would rather you hear about them from us. #### What it does - Blocks repeat bad sources on campaigns that accept IP exclusions, such as Search - Manages the 500-address limit per campaign so the list stays useful - Shows you what was flagged and why, in terms you can check against Google Ads - Works alongside Google's own invalid click credits - Monitors Microsoft Ads clicks too, and hands you a paste-ready block list for Microsoft's IP exclusions #### What nothing can do - Stop the very first click from a brand new source - Pin down one determined person who changes address every visit Running Performance Max? How account-level IP exclusions cover it. Who it is for ## Built for expensive clicks. The higher your cost per click, the more every fake one costs. Law firms, home services, insurance and medical practices feel it first. Legal #### Law firms Few verticals pay more per click, and few attract more deliberate clicking. Click fraud and law firms Competitors #### Rivals clicking your ads What it looks like in the data, and what you can actually do about it. Competitor clicking Local #### Local Services Ads Pay-per-lead has its own fraud patterns, and its own dispute process. Local Services Ads fraud Straight answers ## Questions people ask first. #### What does it mean to block click fraud in Google Ads? Google has no button to ban a person. What it does allow is excluding an IP address from a campaign so your ads never show to it. Blocking click fraud means finding the addresses that deserve that, and adding them for you automatically. #### Doesn't Google already refund invalid clicks? Some of them, automatically, with no detail on what was caught. The credit arrives after you paid, and the source is free to keep clicking. Here is what Google's invalid click refunds cover. #### Could it block real customers? It is designed not to, and you can check. Watch cost per conversion rather than click counts: if leads fall with clicks, something is wrong. It also leaves alone the good bots you must never block. #### Does it work with Performance Max? It can see paid visits that reach your site from any campaign, which gives you a record and evidence for a refund claim. It blocks there too: Google applies account-level IP exclusions to every campaign, Performance Max included, and Block Click Fraud writes to that list. ## Stop paying for clicks that were never customers. Start with how it works, or sign in if you already have an account. How click fraud protection worksSign in --- ## Bot Traffic in Google Ads: What It Is and What It Costs You URL: https://blockclickfraud.com/bot-traffic-google-ads.md Bot traffic in Google Ads is any click or impression produced by software rather than a person, and it is a permanent feature of paid search, not an occasional glitch. Some of it is harmless and declares itself. Some of it is built specifically to look like a customer. The first kind gets filtered before it ever reaches your invoice. The second kind is the reason this page exists. If you run paid search for a business where a click costs more than a coffee, non-human traffic is quietly taking a cut of every campaign you run, and the damage goes well past the line item on your bill. ## What bot traffic in Google Ads actually is The industry splits non-human traffic into two buckets, and the split matters more than most people realise. ### General invalid traffic (GIVT) GIVT is traffic from declared crawlers and known automated tools. These bots identify themselves in the user agent string. They are not hiding. Search engine crawlers, uptime monitors, SEO tools, preview fetchers and link checkers all sit here. Filtering GIVT is close to a solved problem because the traffic tells you what it is. Ad platforms strip most of it out before billing. ### Sophisticated invalid traffic (SIVT) SIVT is traffic that actively disguises itself. It does not declare anything. It arrives with a browser user agent that looks like a real Chrome install on a real phone, from an IP address that looks like a real household, and it may move a cursor and scroll a page before it leaves. This is where the money goes. Everything difficult about **bot traffic in Google Ads** lives in this second bucket, and it is the category that generic filtering was never designed to catch. The distinction is worth holding onto because vendors, ad platforms and blog posts all use the word "bot" loosely. A crawler that says "I am a crawler" and a click farm script running a headless browser behind a spoofed user agent are not the same problem and do not have the same fix. ## Where the fake clicks come from There is no single source, which is part of why this is hard to reason about. In practice the traffic hitting a typical advertiser's account comes from a handful of recognisable places. - **Automation tooling.** Scripts, scrapers and testing frameworks pointed at your site or at the search results your ads sit in. Much of this is not aimed at you at all. You are collateral. - **Competitive clicking.** Someone in your market, or an agency working for them, draining your daily budget so their ad sits higher for less. In tight local markets this is not paranoia, it is Tuesday. - **Affiliate and lead-gen fraud.** Traffic manufactured to hit a payout threshold somewhere downstream. - **Proxy and residential IP networks.** Infrastructure rented by the hour that makes automated traffic look domestic. The difference between datacenter and residential IP addresses explains why some of this is obvious and some is not. - **Accidental and incentivised human clicks.** Not bots at all, but still invalid. Repeated clicks from the same person, clicks from someone paid to click, clicks from a device farm staffed by people. ## What bot traffic in Google Ads costs you The wasted click spend is the part everyone talks about. It is also the smallest part of the bill. ### Budget that never had a chance A daily budget is a finite thing. Every fake click consumes a slice of it, and once it is gone your ads stop showing to the people who would have converted. In a high-cost vertical this is not a rounding error. If your cost per click runs into double or triple figures, it takes remarkably few bad clicks to remove a real enquiry from your day. ### Data you then make decisions on This is the expensive one. Non-human traffic does not just cost money, it lies to you. Bounce rate climbs, average session duration falls, conversion rate drops, and none of it reflects anything your actual customers did. You then respond to that noise. You pause a keyword that was working. You rewrite a landing page that was fine. You cut a campaign because the numbers looked soft, when the numbers were soft because a third of the sessions were never human. ### Smart Bidding learning from fiction Automated bidding optimises toward the signals it receives. Feed it clicks that never convert and it draws conclusions: this audience is weak, this time of day is weak, this geography is weak. It then bids accordingly. The model is doing its job correctly on corrupted input, which is worse than the model being broken, because nothing looks wrong. ### Time that does not show up anywhere Fake form fills get called. Junk leads get chased. Sales people spend their morning on records that were never people. That cost never appears in any ad platform report, and in a service business it is often larger than the media waste. ## Google already filters invalid clicks, so what is left Google does run invalid click detection, it does remove clicks it identifies as invalid, and it does issue automatic credits that appear on the following month's bill. That system is real and it does genuine work. It is also deliberately opaque: Google does not disclose its detection criteria, so there is no way for an advertiser to audit what was caught, what was missed, or why. The gap is not that Google is lazy. The gap is structural. Filtering happens after the fact, at platform scale, against criteria you cannot see, and it addresses the billing question rather than the traffic question. A click that gets credited back still entered your analytics, still occupied your budget for the day, still influenced your bidding signals, and still sent a bot to your landing page. We wrote a full breakdown of exactly where that line falls: what Google's invalid click refunds cover and what they leave behind. If you read one thing on this site, read that. ## Signals that bot traffic in Google Ads is hitting your account You will rarely get a smoking gun. What you get is a pattern that does not fit human behaviour. - Click volume that spikes at hours when your customers are asleep - Repeat clicks from the same network inside a short window - Sessions with zero scroll, zero engagement, and an immediate exit - Form submissions with plausible formatting but disconnected phone numbers or nonsense job titles - Click-through rate holding steady while conversion rate falls off a cliff - Geographic clusters that have nothing to do with where you sell None of these prove fraud on their own. Together, in the same account, in the same week, they are worth taking seriously. ## Check the Invalid Clicks Column Before Anything Else Google Ads will show you how much traffic it filtered on its own, but the column is hidden by default. Open Campaigns, click the Columns icon above the table, choose to modify columns, search for "Invalid clicks" and apply it. The number you see is the invalid clicks Google filtered before billing. You were not charged for those. Read it as a floor, not a ceiling. A rising invalid clicks count tells you the account is attracting automated traffic and that Google is catching some of it. It says nothing about the traffic that looked normal enough to be billed. If the invalid count climbs while conversion rate falls on the same campaigns, that combination is the reason to look at your own click records rather than relying on the platform's filter alone. ## What you can actually do about it There is a manual path and an automated path, and both have a place. Manually, you can pull your traffic data, look for repeat offenders, and add the worst networks to your exclusion list. That approach has real limits and a real ceiling, which we cover in detail in our guide to using IP exclusions in Google Ads. The short version: the list is capped, addresses rotate, and you are always working from last week's problem. Automatically, a dedicated layer watches traffic as it arrives and blocks the sources that are demonstrably not customers before they cost you another click. That is the job click fraud protection exists to do, and it runs continuously rather than whenever you next remember to check. Whichever route you take, one rule is absolute. Do not block indiscriminately. Googlebot and AdsBot-Google have to reach your site or your organic indexing and your ad landing page checks both break, which is a self-inflicted wound far more expensive than the fraud. Our guide to the good bots you must never block covers which crawlers need clear access and why. Some verticals feel this harder than others. Where a single conversion is worth thousands and the click prices reflect it, the maths changes completely, which is why we treat click fraud in legal advertising as its own case. ## The practical take You are not going to reduce non-human traffic to zero, and anyone promising that is selling something. What you can do is stop treating the credit line on your invoice as the whole story. The wasted spend is recoverable in part. The corrupted conversion data, the mis-trained bidding model and the sales hours burned on phantom leads are not. Start by looking honestly at your own traffic patterns, then decide how much of your budget you are comfortable donating to software. --- ## Click Fraud and Law Firms: Where Legal Ad Budgets Disappear URL: https://blockclickfraud.com/click-fraud-law-firms.md Click fraud hits law firms harder than almost any other category of advertiser, and the reason is simple arithmetic: legal keywords are among the most expensive in paid search, so every wasted click costs more here than it does almost anywhere else. A retailer losing a click on a $1.20 keyword shrugs. A personal injury firm losing a click on a keyword that costs more than a decent dinner does not get to shrug. Multiply that by a few dozen clicks a week and you are looking at a line item that would pay for a paralegal. This page covers what click fraud actually looks like in a legal account, who is generating it, what Google does and does not do about it, and which fixes are worth your time. No invented statistics. If a number cannot be verified, you will get the mechanism described instead. ## Why click fraud targets law firms specifically Three things make legal advertising an unusually good target. **The clicks are expensive.** Legal has sat at or near the top of the cost-per-click rankings in paid search for as long as anyone has been publishing those rankings. Google does not publish official vertical CPC tables, and the figures floating around blog posts are mostly recycled guesses, so treat any specific dollar figure you see with suspicion. What is not in dispute is the ranking. Criminal defense, personal injury, mass tort, and DUI keywords cost a lot per click. **The competitive set is small and local.** A firm in a mid-sized city competes against maybe eight or ten other firms for the same terms. Everyone knows who everyone is. That is very different from an e-commerce advertiser competing against a national field they will never meet. When the competitor is a known quantity down the street, the temptation to burn their budget is more immediate. **Budgets are capped daily.** This is the part most partners miss. Your campaign does not run on a monthly budget that slowly drains. It runs on a daily cap. Once the day's budget is spent, your ads stop serving. That means a modest number of worthless clicks early in the morning can take you off the auction for the rest of the day, including the hours when actual injured people and actual arrested people are searching. The direct cost of the fraudulent clicks is the smaller half of the damage. The bigger half is the visibility you did not get. ## Who is actually generating the clicks The picture people have in their head is a competitor sitting at a desk clicking their ad over and over. That happens, and it is more common in legal than in most verticals, but it is not the whole story. ### Competitors and their staff Sometimes deliberate. Often not. A paralegal checking what the firm across town is advertising this month will click the ad rather than type the URL, because that is what people do. Do it once a week for a year and you have spent a meaningful amount of your competitor's money without ever intending harm. Deliberate budget burning also happens, and it tends to look different: same source hitting repeatedly, concentrated in the first hours of the ad schedule. We cover the tells in detail in our guide on how to tell if a competitor is clicking your law firm's ads. ### Lead resellers and marketing agencies Firms that sell legal leads have an interest in your paid search performing badly. If your cost per acquisition from Google Ads looks terrible, their per-lead pricing looks reasonable by comparison. The same logic applies to agencies pitching you on their services. This is harder to prove than competitor clicking and we are not going to pretend otherwise, but the incentive is there and the pattern shows up in accounts. ### Bots and automated traffic The largest share by volume, and the least personal. Scrapers, competitive intelligence tools, ad verification crawlers, malware-driven click farms, and traffic sold through low-quality placements on the Display Network and search partners. None of it has any intent to hire a lawyer. Much of it is not even a person. We go deeper on the mechanics in our overview of bot traffic in Google Ads. ### Curious non-clients Law students, journalists, people researching their own case who will never hire anyone, opposing parties checking out your firm. Not fraud in any legal sense. Still a click you paid for at legal-vertical prices. ## What click fraud looks like in a law firm account You rarely see a smoking gun. You see a set of patterns that individually could be innocent and collectively are not. - **Clicks with near-zero time on site.** Someone arrives and leaves before the page finishes rendering. Consistently, from the same sources. - **Budget exhausted early with nothing to show.** Daily cap hit by mid-morning, impression share dropping off a cliff in the afternoon, no form fills and no calls. - **Clicks clustered outside the hours anyone would contact a lawyer.** Legal intake has a rhythm. Traffic that ignores it is worth a look. - **A geographic profile that does not match your service area.** Location targeting is leakier than most people assume, particularly the default setting that includes people merely showing interest in your area. - **Rising cost per click with flat or falling call volume.** The single most reliable signal at the account level. - **Repeat clicks from the same source across days.** Genuine prospects click once, maybe twice. They do not click every weekday at 9am. None of these proves anything on its own. A firm running a brand campaign will legitimately see short sessions. Patterns matter more than incidents. ## What Google actually does about click fraud for law firms Google filters some invalid traffic automatically and issues credits for it, usually visible as an invalid clicks line in your account. That system works, up to a point, and it costs you nothing. Here is the limitation. Google does not disclose what its detection criteria are. You cannot see which clicks were flagged, why, or what fraction of the bad traffic was caught. You get a credit and no explanation. That means you have no way to audit it and no way to know what got through. Our page on Google's invalid click refunds covers what the credits cover and what they do not. Local Services Ads work on an entirely separate track. LSA charges per lead rather than per click, and it uses a lead dispute process, not the invalid click credit system. Different rules, different timelines, different outcomes. Worth reading our breakdown of what Google refunds and does not refund on Local Services Ads before you assume your LSA spend is protected by the same machinery. ## Fixes that work, and fixes that do not ### IP exclusions: useful, limited Google Ads allows up to 500 IP address exclusions per campaign. That is a real tool and you should use it. It is also a fixed list that does nothing against a residential IP that changes, a mobile connection, or anyone using a VPN. Treat it as one layer, not a solution. See our guide to Google Ads IP exclusions for how to build and maintain the list properly. ### Negative keywords: solves a different problem Negative keywords control which search queries can trigger your ad. They have no idea who is behind the click. A competitor searching your exact target term and clicking your ad is unaffected by any negative keyword list you could build. They are still worth maintaining, for reasons we lay out in what negative keywords actually stop, but they are not a fraud control. ### Tightening geography and scheduling Switch location targeting to presence only rather than presence or interest. Cut search partners and Display from search campaigns unless you have a specific reason to keep them. Cheap, fast, worth doing before anything else. ### Automated blocking The practical answer for most firms is software that watches click behavior in real time and adds the sources worth excluding to your campaign exclusions automatically, so the traffic stops arriving rather than being argued about after the fact. It is the only approach that scales past a handful of obvious offenders. That is what click fraud protection is built to do. ## What this costs you if you ignore it Run the number for your own firm rather than trusting anyone's industry average. We walk through the arithmetic in detail in our breakdown of what one fraudulent click costs in criminal defense and personal injury. Take your actual cost per click from your account, decide what fraction of your clicks produced no meaningful engagement, and multiply. Then add the cases you did not see because your budget ran out before lunch. For most firms the second figure is larger than the first, and neither shows up as a line item anywhere. It shows up as a quarter where intake was slower than it should have been and nobody could say exactly why. Click fraud in law firm accounts is not usually dramatic. It is a slow leak in the most expensive pipe you own. Worth knowing where it is. --- ## Google Ads IP Exclusions: The Complete Guide URL: https://blockclickfraud.com/google-ads-ip-exclusions.md A **Google Ads IP exclusion** stops your ads from being served to a specific IP address, and it is the only direct blocking control Google hands advertisers inside the account. Everything else you can do about wasted clicks is indirect. Bid adjustments, audience exclusions, placement exclusions, tighter geo targeting: all of them shift the odds. IP exclusion is the one setting that says not this visitor, not at all. That is why it gets reached for first when a search budget starts looking wrong. It is also why so many advertisers end up disappointed with it. The setting works exactly as documented. The problem is that what it does and what people expect it to do are two different things. This guide covers both. ## What a Google Ads IP Exclusion Actually Does When you add an address to the exclusion list, Google stops entering your ads into auctions for traffic it identifies as coming from that address. No impression, no click, no cost. It is a serving-side control, which is the important part. The block happens before the auction rather than after the click, so nothing is billed and then argued about later. A few properties of the setting are worth holding onto: - Exclusions can be set per campaign or at account level. Account-level exclusions apply to every campaign, including Performance Max, so one list can cover the whole account. - Google Ads allows up to 500 IP address exclusions per campaign. - You can enter single addresses or ranges, which is how most advertisers stretch that 500 slot budget. - The exclusion applies to serving only. It does not affect Analytics, your CRM, or anything else that logs the visit. Used well, this is a clean tool. A competitor with a static office IP who clicks your ads every morning gets shut out permanently in about ninety seconds of work. That is a real win and it costs nothing. ## How to Exclude an IP Address in Google Ads The path moves around as Google reshuffles the interface, but the sequence has been stable for years: - Open the campaign you want to protect. This is campaign level, so pick deliberately. - Go to Settings, then open Additional settings. - Expand IP exclusions. - Enter one address per line. Ranges use standard notation. - Save, then repeat for every other campaign that needs the same protection. Two things trip people up here. First, saving on one campaign does nothing for the others, and there is no built-in way to push a list across an account. Second, there is no confirmation that the address you pasted is the one actually doing the clicking. Google will accept any syntactically valid entry without comment. Get a digit wrong and you have quietly blocked a stranger, or a customer. ### Check the entry before you save it Look up what each address belongs to before it goes in. A consumer ISP, a corporate network and a hosting provider are three different situations. The hosting provider is usually a safe block for a local service business. The corporate network might be a prospect's office. The consumer ISP could be anyone next week, because that address probably gets reassigned. ## The IP Exclusion Limit in Google Ads Five hundred entries per campaign sounds generous until you start filling it. For a handful of known offenders it is far more room than you need. For anything resembling systematic click abuse it disappears fast, because the traffic you are trying to stop rarely comes from a fixed set of addresses. The limit is a hard ceiling, not a soft one, and it forces a maintenance decision: once the list is full, every new address you want to block means removing an old one. Which raises the question of whether the old one was still doing damage. Most advertisers never find out. We covered what happens at the ceiling in more detail in the 500 IP exclusion limit and what happens when you hit it. ## Where Google Ads IP Exclusions Fall Short None of what follows means the setting is useless. It means the setting solves a narrow problem, and most click waste is not that problem. ### Residential addresses rotate Consumer broadband connections are usually assigned dynamically. The address that clicked your ad on Tuesday may belong to a different household by Friday. Block it and you have blocked a moving target that already moved, while potentially shutting out a legitimate prospect who inherited it. ### Mobile traffic barely has a fixed address at all Carrier networks route large numbers of subscribers through shared gateway addresses. Excluding one of those can wall off a meaningful slice of mobile users in a region. The exclusion works perfectly. It just costs you more than it saves. ### Automated traffic changes address by design Anything scripted can cycle through address pools without effort. This is the structural problem with a static blocklist against non-static traffic, and it is the same dynamic we describe in our guide to bot traffic in Google Ads. You are updating a list by hand against something that changes addresses automatically. ### Performance Max needs the account-level list Campaign-level IP exclusions are not available for Performance Max, video, hotel, app and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max, so if your spend has moved there, that is the list to use. We cover the details in Performance Max IP exclusions. ## Finding the Addresses Worth Excluding Google Ads does not show you the IP address of a click. Not in the interface, not in reports, not in the API. So every exclusion list starts somewhere else: server logs, analytics with a custom dimension, or a tracking layer that records the visit and ties it back to the ad click. This is where most exclusion projects stall. Getting the address is straightforward. Proving that a given address is responsible for the clicks you are being charged for takes stitching two data sources together, and doing it badly produces confident, wrong exclusions. The method matters, which is why it has its own walkthrough: how to find the IP addresses behind fraudulent ad clicks. ### The cost of a wrong exclusion is invisible Worth dwelling on, because it changes how careful you should be. When you block an address that was producing junk, you see the spend drop and you feel good. When you block an address that was producing customers, nothing happens in any report. The inquiries simply do not arrive, and there is no line item anywhere labelled buyers you shut out. That asymmetry is the argument for doing the identification work properly rather than blocking on a hunch. ## Refunds Are Not a Substitute for Blocking Google does issue automatic credits for clicks its systems classify as invalid, and those credits appear on the account without you asking. What Google does not do is disclose the criteria behind that classification. You cannot see what was caught, what was missed, or why. Treating the credit as proof that the problem is handled is a mistake a lot of accounts make. We go into what the credits cover and what they do not in our piece on Google's invalid click refunds. The useful distinction is timing. A credit arrives after the click was served and billed. An exclusion prevents the auction entry in the first place. Prevention is worth more, which is the whole argument for maintaining a list at all. ## Where IP Exclusions Fit in a Wider Defense Think of the exclusion list as the manual layer. It handles known, stable, identified offenders and it handles them permanently. It does not scale, it does not adapt, and it cannot see anything you have not already investigated by hand. For accounts where the stakes per click are high, the manual layer alone leaves too much exposed. Legal is the clearest example, with click costs that make a single bad session expensive enough to notice, which is why we treat it separately in our guide to click fraud targeting law firms. Where the waste is continuous rather than occasional, automated click fraud protection is what closes the gap between what you can catch by hand and what is actually hitting the account. ## The Practical Verdict Set up IP exclusions. They are free, they take minutes, and for a known repeat offender with a fixed address they are the correct answer. Just be honest about the ceiling: 500 entries per list, no visibility into who is clicking, and no defense against anything that changes address. Keep a record outside the platform too. Date every entry, write down why it went in, and review the list on some kind of schedule. Google stores none of that for you, and an undocumented list becomes unmaintainable within a year because nobody can remember which entries still matter. If you have added addresses and the wasted spend has not moved, the list is not failing. It is doing its job on a problem that was never the one costing you money. At that point the answer is better detection, not more entries. ## Compare IP Exclusions Against the Alternative Blocking at the server is the other approach advertisers try, and it fails for a reason that is easy to miss until you look at the billing timeline. We put the two side by side in IP exclusions versus server blocking. --- ## Click Fraud Protection: How It Works and What It Saves URL: https://blockclickfraud.com/click-fraud-protection.md Click fraud protection is software that identifies paid search clicks which will never turn into customers, then stops those sources from being shown your ads again. That is the entire product in one sentence. Everything after this is detail: how the blocking gets applied, what it can reach, what it cannot, and whether the waste it prevents is larger than what it costs you. You are probably here because something in your Google Ads account looks wrong. Clicks that go nowhere. Sessions that end in two seconds. The same small town appearing again and again with no calls attached to it. Maybe you already suspect a competitor. This page explains what protection software does about that, where it runs out of road, and how to tell whether it is actually working rather than just producing a dashboard. ## What click fraud protection does, step by step Three things happen, in order. **It watches.** A script on your site, or a server-side integration, records what happens after each paid click: how long the visit lasted, what the visitor did on the page, the device and network they arrived from, and whether this visitor has been here before and how often. **It decides.** The system compares that visit against the rest of the traffic on your account and against the known signs of automated and repeat traffic. Visits that carry the marks of automation or repeat abuse get flagged. Ordinary customers do not. **It acts.** Flagged addresses are written into your Google Ads IP exclusion list through the API, so your ads stop being served to them. Some tools also block the flagged visitor at the page level. That is a different thing, and a weaker one. The first two steps are where vendors genuinely differ. The third step is broadly the same everywhere, because it uses controls Google already provides. ## Blocking at the ad level versus blocking at the page This distinction matters more than anything else in the category, and most marketing copy blurs it. A server-side block happens after the click has already been billed. The visitor clicked your ad, Google charged you, and your server then refused to serve them the page. You saved nothing on that click. You only stopped them consuming bandwidth and polluting your analytics. A campaign IP exclusion is different. It prevents the ad from being shown to that address at all, so there is no click and no charge. That is the mechanism that saves money, and it only works on clicks that have not happened yet. Which means every protection tool is inherently reactive: the first bad click from a new source is always paid for. What you are buying is the prevention of the second through the fiftieth. If you want to understand the exclusion mechanism itself in more depth, the piece on how Google Ads IP exclusions work covers the setup and the constraints in detail. ## Where click fraud protection runs into walls Any vendor who tells you their product stops all invalid traffic is either careless or lying. Here are the real limits, and they apply to every tool in the category including ours. - **Google Ads allows up to 500 IP exclusions per campaign.** That is a hard ceiling. Once you are at 500, adding a new exclusion means removing an old one, so any serious tool has to manage that list rather than just fill it. - **Performance Max needs the account-level list.** Campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to every campaign in the account, PMax included. That list also holds 500 addresses, so it has to be managed the same way. - **Addresses change.** Mobile networks rotate addresses constantly. A determined abuser on a phone or a VPN can keep coming back with a new address. Blocking helps against repeat sources and does very little against a single motivated person who knows what they are doing. - **Google already refunds some of this.** Google issues automatic credits for clicks it deems invalid, without disclosing the criteria it uses. Those credits appear on your account whether or not you run any third-party tool. Understanding what Google's invalid click refunds already cover is the first step in working out what is left for a protection tool to do. None of that makes the category useless. It makes the honest version of the pitch narrower: protection software reduces repeat waste from identifiable sources on campaign types that support exclusions. That is a real and measurable job. It is not a force field. ## What click fraud protection saves, and how to check Nobody can tell you your savings figure in advance, and you should be wary of anyone who tries. The number depends on your cost per click, your click volume, and how much of your traffic is bad, and only the first two of those are known before you start. Here is the arithmetic you can run yourself. Take your average cost per click. Multiply it by the number of clicks the tool blocked in a month. That is the ceiling on what it saved you, and it is a ceiling rather than a figure, because some of those blocked clicks would have been worthless anyway and some might have been refunded by Google regardless. Compare the result against the subscription cost. If the ceiling is not comfortably larger than the price, the tool is not earning its place. The second check is more useful and takes longer. Watch your cost per conversion, not your click count. If blocking is working, you should be buying the same number of leads for less, or more leads for the same money. If your conversions drop in step with your clicks, the tool is blocking real customers and you should turn it off. That second scenario is worth taking seriously, and the piece on whether click fraud protection actually works goes through how to test it properly rather than trusting a dashboard. ## Who tends to need it The pattern is consistent: high cost per click, local competition, and a long gap between click and revenue. Legal, home services, insurance, and medical all sit in that space. When a single click costs as much as a decent lunch, a handful of wasted ones a day becomes a real line item. The specific dynamics in click fraud in legal advertising are a good illustration of why the expensive verticals feel it first. The other pattern is automated traffic rather than human competitors. Scrapers, headless browsers, and low-grade bot networks hit paid ads constantly, and they behave very differently from a rival clicking your ad from their office. If your suspicion is machines rather than people, the breakdown of bot traffic in Google Ads covers what that looks like in the data. ## How to evaluate a vendor without taking their word for it Ask for a trial and run it on one campaign, not the whole account. Keep a second campaign unprotected as a control if your budget allows it. Two weeks tells you very little. A month tells you something. Ask what happens when the 500-exclusion ceiling is reached. Ask whether the tool writes to the account-level exclusion list, the only one that covers Performance Max. Ask whether blocking is applied through the Google Ads API or only at your own server. A vendor who answers those three questions plainly is worth talking to further. A vendor who redirects to a savings percentage is not. Read the contract terms before the feature list. Watch for annual lock-ins sold as discounts, pricing that scales with your ad spend rather than your site count, and cancellation that requires an email to support rather than a button. The comparison of ClickCease alternatives goes through the trade-offs between the established tools without pretending one of them wins on everything. ## Where BlockClickFraud fits We detect invalid clicks and push exclusions into your Google Ads account automatically, and we report what was blocked and why in terms you can check against your own Google Ads data. The detection logic itself is proprietary and we do not publish it, for the obvious reason that anyone trying to evade it would read that page first. Plans are structured by the number of sites you protect. The starter tier covers a single site, higher tiers cover more, and agency tiers are sized for managing many client accounts at once. The article on what click fraud protection costs explains the pricing models used across the category so you can compare like with like before you look at any single number. ## A reasonable next step Before you buy anything, pull a month of Google Ads data and look at the search terms, the geography, and the time of day of your worst-performing clicks. If nothing looks strange, you may not have a problem worth paying to solve. If you find clusters that make no sense, you have something specific to test a tool against, and you will know within a month whether the tool moved it. That is a slower way to buy software than clicking a trial button. It is also the only way to know afterwards whether the money was well spent. --- ## Terms of Service URL: https://blockclickfraud.com/terms-of-service.md **Effective 21 September 2026.** These terms are the agreement between you and The Streamer Agency, LLC ("BlockClickFraud", "we", "us") covering your use of the BlockClickFraud service. By opening an account or using the service you accept them. If you are agreeing on behalf of a company, you are confirming you have the authority to bind it. ## 1. What the service does BlockClickFraud records technical details of visits to websites you control, scores those visits to identify invalid or fraudulent paid advertising clicks, maintains a blocklist of the addresses responsible, and, where you connect an advertising account, writes those addresses into that account as campaign-level IP exclusions. We may change or improve how detection works at any time. We will not reduce the core function of the service during a paid term without telling you. ## 2. Your account You must be 18 or older and provide accurate details. You are responsible for everything done under your account and for keeping your password and API key secret. Tell us promptly at joe@blockclickfraud.com if you think either has been exposed. Your plan covers a stated number of websites. Running more than your plan allows is a breach of these terms, and we may enforce the limit or move you to the tier that matches your use. ## 3. What you are promising us When you add a website or connect an advertising account, you are confirming that: - You own or are authorized to administer that website and that advertising account - You have the authority to let us collect visitor data on that website and to write exclusions into that advertising account - Your own privacy notice tells visitors that a service like ours collects their IP address and technical browsing details, and that you have any consent or legal basis your jurisdiction requires For data collected on your website you are the data controller and we act as your processor. You decide what happens to it. If you need a written data processing agreement, ask us. ## 4. The Google Ads connection Connecting Google Ads is optional and you grant access through Google's own consent screen. We never receive your Google password. Within a connected account we read your list of accessible accounts, your campaigns, and the IP exclusions already on them. We write campaign-level IP exclusions. We do not touch campaigns, ads, keywords, budgets, bids, billing, or account users. The Privacy Policy sets out exactly what we store. Three things worth being plain about: - Google enforces its own limits, including a cap on exclusions per campaign. When you reach one, we cannot add more. - Exclusions we write are yours. If you disconnect or close your account they stay in place until you remove them. - Your use of Google Ads is governed by your agreement with Google, not by us. We are not affiliated with, endorsed by, or acting for Google. ## 5. What we do not promise This section matters, so it is in plain words rather than buried. Click fraud detection is a judgment made from incomplete information. We cannot identify every fraudulent click, and no honest provider in this category can. We may also occasionally flag a click that turns out to be genuine. You keep control: every blocklist and exclusion is visible to you and you can remove any entry. We do not promise that using the service will reduce your advertising costs, increase your conversions, or produce any particular financial result. We do not promise that Google or any other advertising platform will refund or credit you for clicks we identify. Refunds are entirely the platform's decision under their own invalid traffic policies. Where our software runs as a plugin on your website, it only sees traffic that reaches your website. Traffic filtered earlier, for example at a content delivery network or firewall, is outside its view unless you also install our edge integration. ## 6. Acceptable use Do not use the service to: - Collect data from websites you do not control - Access an advertising account you are not authorized to administer - Block or exclude people on the basis of race, religion, sex, disability, or any other characteristic protected by law - Identify, profile, or pursue individuals for any purpose other than protecting your advertising spend - Break any law, or any advertising platform's terms - Resell or white-label the service unless your plan expressly permits it - Probe, reverse engineer, overload, or interfere with our systems We may suspend an account that breaches this section, and where the breach is serious we may do so without notice. ## 7. Fees Paid plans are billed in advance at the price shown when you subscribe, and renew automatically until cancelled. Fees are non-refundable except where the law requires otherwise or where we have said so in writing. You can cancel at any time and your plan runs to the end of the period you have paid for. We may change prices with at least 30 days' notice, effective at your next renewal. Taxes are your responsibility unless we are required to collect them. ## 8. Your data and ours You own your data: your click records, your blocklists, your account content. You grant us the licence needed to host and process it in order to run the service for you. We own the service: the software, the detection methods, the dashboard, the documentation, and our name and marks. Nothing here transfers any of that to you. We may use aggregated, anonymized statistics that cannot identify you, your visitors, or your advertising account to describe and improve the service. ## 9. Availability and support We aim to keep the service running continuously but we do not offer a guaranteed uptime commitment unless your plan states one. We may take the service down for maintenance, and will give notice where we reasonably can. Support is provided by email at joe@blockclickfraud.com. ## 10. Ending the agreement You can close your account at any time. We may terminate or suspend your account for breach of these terms, for non-payment, or if we stop offering the service. If we stop offering the service we will give reasonable notice and refund any unused prepaid fees. On closure we delete your click data and any stored advertising tokens as described in the Privacy Policy. Export anything you want to keep before you close. ## 11. Disclaimer The service is provided "as is" and "as available". To the maximum extent the law allows, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. Some jurisdictions do not allow these exclusions, in which case they do not apply to you. ## 12. Limitation of liability To the maximum extent the law allows, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, or lost advertising spend, even if told such damages were possible. Our total liability arising out of or relating to this agreement is limited to the amount you paid us in the twelve months before the event giving rise to the claim, or US $100 if you have paid us nothing. Nothing here limits liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence. ## 13. Indemnity You will defend and indemnify us against claims arising from your breach of these terms, your use of the service, or your failure to hold the rights and permissions you promised in section 3. ## 14. Governing law These terms are governed by the laws of the State of Florida, without regard to conflict of law rules. The courts of Palm Beach County, Florida have exclusive jurisdiction, and both parties consent to that venue. ## 15. General These terms, together with the Privacy Policy, are the entire agreement between us. If any part is unenforceable, the rest stands. Our not enforcing something is not a waiver of it. You may not assign this agreement without our consent; we may assign it in connection with a merger or sale of the business. We may update these terms. We will post the revised version here with a new effective date, and for material changes we will notify account holders by email before they take effect. Continuing to use the service after that means you accept them. ## 16. Contact The Streamer Agency, LLC, 4627 Windward Cove Lane, Wellington, FL 33449. Email joe@blockclickfraud.com. --- ## Privacy Policy URL: https://blockclickfraud.com/privacy-policy.md **Effective 21 September 2026.** ## The short version BlockClickFraud looks at clicks arriving on our customers' websites and works out which ones came from bots, click farms, or people repeatedly clicking the same paid ad. When we find one, we can add that IP address to the exclusion list in the customer's advertising account so the ad stops being shown to it. That means we handle two different kinds of data, and it matters which is which: - Technical information about visits to our customers' websites, including IP addresses. - Account information belonging to our customers, including access to their Google Ads account when they choose to connect it. We do not sell either one. We do not use either one to build advertising profiles, serve ads, or train machine learning models for anyone else. We do not share Google account data with third parties except as described below. ## Who we are BlockClickFraud is operated by The Streamer Agency, LLC ("BlockClickFraud", "we", "us"). Our website is https://blockclickfraud.com. You can reach us at joe@blockclickfraud.com, or by post at 4627 Windward Cove Lane, Wellington, FL 33449. For the technical data described in the next section, our customer is the data controller and we act as their processor. We are the controller of our own customers' account data. ## Information collected from visits to customer websites When a BlockClickFraud customer installs our plugin or edge worker on their website, we record the following for each visit: - IP address and the country it resolves to - Browser user agent string - The URL requested, the referring URL, and the HTTP status returned - Advertising click identifiers present in the URL, such as a Google Ads gclid - Timestamp - Whether JavaScript executed in the browser, and a small set of technical browser characteristics used to tell an automated client from a person We do not collect names, email addresses, postal addresses, phone numbers, payment details, form contents, or the text of anything typed on the page. We do not place advertising or tracking cookies on customer websites, and we do not follow visitors across other websites. An IP address is personal data in many jurisdictions, and we treat it as such. We use it for one purpose: deciding whether a click was genuine, and building the exclusion list that follows from that decision. If you are a visitor to a website running BlockClickFraud and you want your data removed, contact the operator of that website. They control it. We will act on their instruction promptly, and you may also contact us directly at joe@blockclickfraud.com and we will put you in touch or act where we are permitted to. ## Information collected from customers When you open an account we collect your name, email address, password (stored hashed, never in readable form), the domains you register, your subscription tier, and records of your use of the service. If and when paid plans are offered, payment is handled by a third-party payment processor and we do not store full card numbers on our systems. ## Google account data and the Google Ads API Connecting a Google Ads account is optional. The service works without it, though the exclusions then have to be applied by hand. If you choose to connect one, you are taken to Google's own consent screen and you grant access there. We never see, ask for, or store your Google password. **What we request.** A single scope, https://www.googleapis.com/auth/adwords, which permits access to the Google Ads accounts you authorize. **What we read.** The list of advertising accounts your login can reach, so you can choose which one applies. Within the account you choose: campaign names, IDs and types, and the IP exclusions already present on those campaigns, so we do not add an address twice. **What we write.** Campaign-level IP exclusions, and nothing else. We do not create, pause, or edit campaigns, ads, keywords, budgets, bids, or billing settings. We do not create accounts or manage account users. **What we store.** An OAuth refresh token, the customer ID of the account you selected, the login customer ID where a manager account is involved, and a record of which IP addresses we have already added to which campaign. The refresh token is stored on our server and is used only to carry out the actions described above. **Limited Use.** BlockClickFraud's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the click fraud protection features you signed up for. We do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you. We do not use it for serving advertisements. We do not allow humans to read it, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized. **Revoking access.** You can disconnect at any time from inside your BlockClickFraud dashboard, or from your Google Account permissions page. When you disconnect, we delete the stored refresh token. IP exclusions already written to your Google Ads account remain there, because they are yours, and you can remove them inside Google Ads. ## How we use information - To score clicks and identify invalid or fraudulent traffic - To build and maintain the blocklist and exclusion list for each customer - To apply exclusions in connected advertising accounts - To show customers their own reporting - To operate, secure, and support the service, and to meet legal obligations Each customer's data is scoped to that customer. One customer cannot see another customer's clicks, IP addresses, blocklists, or advertising accounts. ## What we do not do - We do not sell personal information, and we have not in the preceding twelve months - We do not share it for cross-context behavioural advertising - We do not use Google user data to serve advertisements - We do not combine one customer's data with another's - We do not read the contents of your advertising campaigns beyond what is listed above ## Who we share data with We use a small number of service providers to run the service, and they may process data on our behalf under contract: our hosting provider, our email provider, and, if paid plans are active, our payment processor. We also send IP exclusions to Google Ads on your instruction, which is the point of the product. We will disclose information where we are legally required to, and to protect our rights, our users, or the public where the law permits it. ## How long we keep it - Click event records: retained while they are useful for detection and reporting, and deleted or aggregated after 12 months - Blocklist entries: until they expire or you remove them - OAuth refresh tokens: until you disconnect or the account is closed - Account records: for the life of the account, plus any period required for tax, accounting, or legal purposes When you close your account we delete your click data and tokens. Backups roll off on their own schedule. ## Security Traffic to and from the service runs over TLS. Access to production systems is limited to people who need it. Credentials and tokens are stored outside the web root and are not exposed to client-side code. No system is perfect, and we do not claim ours is. ## Your rights Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. California residents have rights of access, deletion, correction, and to opt out of sale or sharing, and we will not discriminate against you for exercising them. Since we do not sell or share personal information, there is nothing to opt out of, but you are welcome to confirm that with us. Write to joe@blockclickfraud.com and we will respond within the period the applicable law allows. For data collected on a customer's website, we will refer you to that customer or act on their instruction, because they control it. ## Cookies on this website This website sets cookies needed to keep you logged in to your account and to keep forms secure. We do not run advertising or cross-site tracking cookies here. ## Children This is a business product. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. ## International transfers Our servers are located in Canada. If you are outside that country, your information will be transferred there and handled under this policy. ## Changes We will post any change on this page and update the effective date. If a change materially affects how we handle your data, we will tell account holders by email before it takes effect. ## Contact The Streamer Agency, LLC, 4627 Windward Cove Lane, Wellington, FL 33449. Email joe@blockclickfraud.com. ---