Webmarka Ad Click Protection for Google Ads

Description

Competitors, click farms and bots can burn through your Google Ads budget in hours. Webmarka Ad Click Protection watches every ad click that lands on your site, scores each visitor for fraud and keeps the IP exclusion list of your Google Ads campaigns up to date – every hour, automatically.

Core tracking and scoring run on your own WordPress site. The plugin has no subscription or account requirement. Optional IP lookups send visitor IP addresses to the selected external provider only after you enable them.

Webmarka publishes this plugin free of charge to share its work and demonstrate its technical expertise. There is no paid plugin edition, plugin license key, usage limit or locked plugin feature. Optional external IP lookup services have their own terms and quotas.

How it works

1. A small script (a few KB, no dependencies) records each page view, including the Google Ads click id (gclid, gbraid, wbraid), campaign id and UTM parameters. It runs in the browser, so it keeps working behind page caches and CDNs.
2. Every visitor IP gets a risk score from 0 to 100, based on:
   • repeated ad clicks from the same IP or the same browser (Google Analytics client id), even when the IP changes
   • datacenter, VPN, proxy and Tor networks (via ipapi.is or proxycheck.io, your choice)
   • automated and headless browsers (WebDriver, Puppeteer, Playwright, curl, …)
   • ad clicks without any interaction or time on page
   • clicks from outside your target countries
   • request floods
3. Suspicious IPs that clicked your ads go on an exclusion list. A ready-made Google Ads script syncs that list into the campaigns you choose once an hour.

Features

• Works with page caches and CDNs (LiteSpeed Cache, WP Rocket, Autoptimize, SiteGround Optimizer, host CDNs)
• Page reloads with the same click id are not counted twice – just like Google Ads
• Reads existing Google Analytics and Google Ads cookies (_ga, _gcl_au, _gcl_aw, _gcl_gb, _gcl_gs) to recognize returning ad clickers across IP addresses. Webmarka Ad Click Protection never sets cookies itself.
• Bot detection for search engines, AI crawlers, SEO tools, uptime monitors and automation tools; Google’s own AdsBot is recognized and never flagged
• Google Ads sync keeps your manual IP exclusions untouched and respects the 500 IPs per campaign limit
• Filterable visit and IP reports, CSV export, whitelist and manual flagging
• Setup checklist, dashboard with daily suspicious clicks and campaigns under attack
• Automatic data cleanup after a configurable retention period
• Privacy policy text for your site, ready for community translations on WordPress.org

Made by Webmarka

Webmarka Ad Click Protection is built and maintained by Webmarka, a digital agency. We share it free of charge as part of our public work.

The full source code is included in the plugin package. Bug reports and contributions are welcome.

External services

Webmarka Ad Click Protection connects to the following services. Nothing is sent to any of them until you enable or set it up.

IP lookup provider: ipapi.is or proxycheck.io

Used to look up the country, city, network provider and network type (datacenter, VPN, proxy, Tor) of visitor IP addresses. You choose one of the two providers in the settings; the selected provider is contacted only when “Look up visitor IP addresses” is enabled. proxycheck.io works without a key (100 free lookups a day); a free key raises its quota to 1,000 a day. ipapi.is requires a free account and API key for bulk lookups and network detection (1,000 a day, including commercial use). Data sent: the visitor IP address and, when used, your API key. Lookups run in the background, at most once every 30 days per IP.

ipapi.is – Terms of service: https://ipapi.is/terms.html – Privacy policy: https://ipapi.is/privacy.html
proxycheck.io – Terms of service: https://proxycheck.io/terms – Privacy policy: https://proxycheck.io/privacy

ip-api.com (optional fallback)

Used only when you enable the fallback and the selected provider is unavailable or its quota is exhausted. Data sent: the visitor IP address and, if entered, your ip-api.com Pro key. The free endpoint uses HTTP and its terms allow only non-commercial purposes in a non-commercial environment. A Pro subscription provides HTTPS and permits commercial environments. The terms of this external service apply separately from this free plugin.
Terms and privacy policy: https://ip-api.com/docs/legal

Google Ads

Webmarka Ad Click Protection itself does not connect to Google. The optional Google Ads script you install in your own Google Ads account calls your WordPress site (secured by a secret key) to download the IP exclusion list, and reports back which IPs it added or removed.
Google Ads Scripts: https://developers.google.com/google-ads/scripts – Google privacy policy: https://policies.google.com/privacy

Privacy

Webmarka Ad Click Protection stores visitor IP addresses, user agents, visited paths, referrers, ad click identifiers and identifiers from existing Google cookies in your WordPress database, to detect ad fraud. Data older than the retention period (30 days by default) is deleted automatically. A suggested privacy policy text is added to Settings → Privacy. Logged-in editors and administrators are never tracked.

Technical details