Prevent Click Fraud in Google Ads: A Practical Checklist

Published October 6, 2026 by Block Click Fraud

To prevent click fraud in Google Ads, you need a short set of checks that you repeat on a schedule, not a single setting you switch on once. No step below stops every bad click. Together they cut the waste you can control and leave a paper trail for the waste you cannot.

Step 1: Read the Invalid clicks column on a schedule

Google already filters some invalid traffic before you are billed. You can see how much by adding the Invalid clicks column to your campaigns table (Columns, then Modify columns). Those clicks were removed before billing, so you were not charged for them.

Treat the column as a trend line, not a verdict. A rising count means Google's filters are catching more, which tells you someone is pointing traffic at your ads. It says nothing about what got through. Read it every week, on the same day, for the same date range, so a jump stands out.

Check Billing, then Summary, once a month as well. Invalid activity found after billing is credited later as an "Invalid activity" adjustment, which never shows up in your campaign tables.

Step 2: Tighten location and audience targeting

Every click you invite from outside your market is a click you have to defend. Open each campaign's location settings and look at the location option. The default, Presence or interest, reaches people in your area plus people who have shown interest in it. Presence alone reaches only people who are likely to be in, or regularly in, the places you target. Google says switching to Presence usually reduces impressions, which is the point if you serve a fixed area.

Then compare where clicks come from against where customers come from, and exclude regions that never convert. Loose targeting is not fraud, but it gives fraud room to hide.

Step 3: Clean up account access

Some damage comes from inside the account. Old logins, shared passwords and former contractors who still have access make it easy for someone to change settings quietly or spend your budget badly. Turn on 2-Step Verification under Admin, then Access and security, on the Security tab. Google strongly encourages every advertiser to use it.

While you are on that page, read the user list. Remove anyone who no longer works on the account and give the rest the lowest access level that lets them do their job. Repeat this each quarter.

Step 4: Record a baseline before you change anything else

Before you start excluding sources, write down what normal looks like for each campaign over a recent stretch of weeks: clicks, cost, conversions, conversion rate, cost per conversion, Invalid clicks, and how traffic splits by device and by hour. If you can, take this snapshot before step 2 too, so you can tell what the targeting changes did on their own.

Without a baseline, every change looks like a win or a loss depending on how the week felt. With one, you can say "conversion rate on Search is back to where it was before the spike" and mean it.

Steps 5 to 7: Exclude sources and watch for patterns

Step 5: Build and maintain IP exclusions

When server logs show a source clicking with no sign of real interest, add it to IP exclusions. At campaign level the path is Campaigns, Settings, select the campaign, Additional settings, then IP exclusions. Google allows up to 500 addresses per campaign, and an asterisk in place of the last digits excludes a block (for example 123.45.67.*). Account-level exclusions sit under Admin, then Account settings, and apply to every campaign in the account. Our Google Ads IP exclusions guide walks through the setup.

"Maintain" is the part people skip. Addresses get reassigned, and an entry that made sense in spring may block a real customer by autumn.

Step 6: Watch repeat clickers

One person clicking twice while comparing options is normal. The same source clicking across several days without ever calling or filling in a form is not. Search your server logs for repeats by IP address and by GCLID. Repeat clickers are often the easiest pattern to confirm and the easiest to block.

Step 7: Check device and network concentration

Break paid clicks down by device in Google Ads and by network in your logs. If one device type or a handful of hosting networks suddenly accounts for a big slice of clicks while conversions stay flat, look closer. People searching for a local plumber or a lawyer rarely browse from a server rack.

Steps 8 to 10: Microsoft Ads, the monthly review and the log

If you run Microsoft Ads, repeat steps 1 through 7 there. Bad sources do not care which network they click on, and an address you excluded in Google Ads can keep costing you in Microsoft Ads. See click fraud on Microsoft Ads for what is different on that platform.

Once a month, compare against the baseline. Did conversion rate recover? Did cost per conversion move? Are any exclusions stale?

Keep a plain log throughout: date, source, campaign, what you saw, what you blocked and why. It does two jobs. It stops you from blocking and unblocking the same address on instinct. And if you file a request through Google's Click Quality Form, which only covers the past 60 days, you will already have the dates, campaigns, IP addresses and GCLIDs Google asks for. See Google invalid click refunds.

A weekly, monthly and quarterly rhythm

Cadence	What to do
Weekly	Read Invalid clicks, scan logs for repeat sources, add confirmed exclusions, update the log.
Monthly	Compare against the baseline, check Billing for invalid activity credits, prune stale exclusions, run the same checks in Microsoft Ads.
Quarterly	Review users and 2-Step Verification, revisit location and audience targeting, refresh the baseline.

What no tool can do to prevent click fraud

Be skeptical of anyone who promises zero fraud. Some things are out of reach for you and for any software:

The first click from a new source is paid for before anyone can judge it. An exclusion works on the next click, not that one.
Google will not confirm which specific clicks it judged invalid, so you cannot audit its filters click by click.
Campaign-level IP exclusions are not available in Performance Max. Account-level IP exclusions do apply to all campaigns, including Performance Max. See Performance Max IP exclusions for the detail.
Credits are Google's decision. Good records help a request, but nothing guarantees a refund.
A determined clicker on a fresh address every time is hard to stop with exclusions alone.

What the checklist does is narrow the gap and make each decision defensible. That is a realistic goal.

If you want this done automatically, see how Block Click Fraud works.

Frequently Asked Questions

How often should I check my Google Ads account for click fraud?

Run the quick checks weekly: the Invalid clicks column, repeat sources in your logs and new exclusions. Do the baseline comparison and billing review monthly. Access and targeting reviews can wait for a quarterly pass.

Doesn't Google already prevent click fraud?

Partly. Google filters invalid traffic automatically, and you are not charged for what it catches before billing. It credits some invalid activity it finds later. It does not catch everything, and it will not tell you which clicks it judged invalid.

Should I exclude every IP address that clicks my ad twice?

No. Real buyers often click more than once while they compare options. Look for repeats over several days with no calls, forms or purchases before you exclude anything.

Can I use IP exclusions with Performance Max?

Not at campaign level. Google Ads Help says campaign-level IP exclusions are not available in Performance Max, but account-level IP exclusions apply to all campaigns in the account, including Performance Max.

What should a click fraud log include?

At minimum: the date, the source IP address or range, the campaign, what you observed, what you did and why. Keep GCLIDs where you have them. That is the same detail Google asks for in a Click Quality Form request.

Sources

Prevent Click Fraud in Google Ads: A Practical ChecklistBlock Click Fraud2026-10-20T18:04:24+00:00