Click fraud & PPC glossary.

A

Ad fraud

Any attempt to make advertisers pay for activity that isn’t a genuine person interested in the ad: fake clicks, fake impressions, fake leads or fake installs. Click fraud is the kind that affects pay-per-click campaigns.

Ad spend allowance

The Google Ads spend a month your plan protects. Over it, exclusions already in place stay and visits are still recorded, but no new IP addresses are blocked until the next month or an upgrade. Allowances by plan →

Agency account

One login that looks after several businesses’ Google Ads. In ClickTrap each client keeps its own account and data, included in the agency’s plan, and the agency’s staff switch between them. Plans with agencies →

Allowlist

A list of IP addresses or ranges that are never excluded, such as your own office or a partner’s. In ClickTrap an address can be allowlisted for one website or for all of them, and any address can be checked to see whether it’s allowlisted or excluded, and why. How you stay in control →

Anti-detect browser

A browser built to disguise itself, faking its device details so each visit looks like a different person. Used to run many fake identities from one machine. ClickTrap reports these as tampered browsers.

Attack source

An IP address known for malicious activity such as scanning, credential stuffing or spam, according to threat intelligence feeds.

Audit log

A record of who changed what and when: rules, manual exclusions, connections, plan changes and support access. Useful when several people manage the same account.

B

Bot

Software that visits websites or clicks ads automatically. Some bots are harmless, like search engine crawlers; others exist to click ads, scrape prices or fill in forms.

Botnet

A network of computers or phones infected with malware and controlled remotely. Botnets can click ads from thousands of ordinary-looking home connections at once.

C

Campaign settings

Google Ads options that decide where your ads appear, such as search partners and the Display Network. Turning off the placements that bring poor traffic is often the quickest saving after blocking. Campaign settings →

Click-fraud audit

A trial period in which every paid click is checked but nothing is blocked, ending in a report of the invalid clicks, the sources that would be blocked and what they cost. Agencies use it to show a client the problem before changing anything. The free audit for agencies →

Click-through rate (CTR)

The share of people who saw an ad and clicked it. Fake clicks raise CTR, which can make a campaign look better than it really is.

Click-to-call

A phone number on a website or ad that starts a call when tapped. A tap on one can count as a conversion, since many service businesses win most work by phone.

Click farm

A group of low-paid workers, or racks of phones, clicking ads and interacting with websites to generate fake engagement that looks human.

Click fraud

Clicking a pay-per-click ad with no intention of becoming a customer, whether by a competitor, a bot, a click farm or a publisher inflating its earnings. The advertiser still pays for each click. How it’s stopped →

Click ID (GCLID)

A unique code Google adds to the landing page address when someone clicks an ad (gclid, gbraid or wbraid). It links a website visit to the ad click that caused it.

Click rule

A limit you set that turns a pattern into a block or a flag, for example “more than 2 clicks from one IP address in 1 minute”. Rules in ClickTrap count clicks per IP address or per device. Click rules →

Competitor click fraud

A rival business clicking your ads to use up your daily budget, so your ads stop showing and theirs take the space.

Conversion

An action you count as success after an ad click, such as a sale, a call or an enquiry. Invalid clicks never convert, which drags conversion rates down.

Conversion click

A click on something that shows intent, such as an email address, a phone number or a chosen button, counted as a conversion without a thank-you page. Conversions →

Conversion page

The page a visitor sees after buying, booking or sending an enquiry, such as a thank-you page. ClickTrap treats anyone who reaches it as a customer and never blocks them. See how customers are protected →

Conversion rate

The share of paid visits that convert. Invalid clicks never convert, so blocking them raises the rate even when nothing else changes.

Cost per acquisition (CPA)

What it costs, on average, to win one customer or conversion from your ads. Paying for fake clicks pushes CPA up.

Cost per click (CPC)

What you pay each time someone clicks your ad. The higher the CPC in your market, the more each fake click costs you. Work out your losses →

Cost per conversion

Ad spend divided by conversions over the same days. Lower is better; paying for fake clicks pushes it up.

Cost per lead (CPL)

What it costs, on average, to get one enquiry from your ads. A key figure for service businesses and lead generators.

D

Data-centre IP

An IP address belonging to a hosting or cloud provider rather than a home or mobile network. Real customers rarely browse from one; bots often do.

Device fingerprint

An identifier built from a browser’s and device’s characteristics, such as screen, fonts and graphics. It recognises the same device when it changes IP address. Device fingerprinting →

Display Network

Google’s network of websites and apps that show image and text ads. Cheap reach, but a frequent source of accidental and fake clicks.

E

Exclusion

A setting that stops an IP address from seeing a campaign’s ads. Google Ads allows 500 IP exclusions per campaign; ClickTrap adds and rotates them automatically.

Exclusion optimisation

Merging individual blocked IP addresses into ranges, so a campaign stays protected within Google Ads’ 500-exclusion limit. ClickTrap proposes the change and you approve or undo it.

F

Flagged visit

A paid visit marked as suspicious for you to review, without blocking it. Useful for signals like VPNs, which real customers sometimes use.

Form protection

Checking each enquiry, booking or order form against the visit that sent it, so form spam from bots and invalid clicks can be flagged or stopped before it reaches your inbox. Lead and form protection →

G

Geo-targeting

Choosing the countries or areas your ads are shown in. Clicks from outside them suggest proxies or fraud; ClickTrap’s location rules can flag or block them.

H

Headless browser

A web browser that runs without a screen, controlled by a script. Automation tools use headless browsers to click ads at scale.

I

Impression

One showing of your ad. You pay per click, not per impression, on most search campaigns.

Invalid click

Google’s term for a click it doesn’t consider genuine, from bots, repeat clicking or fraud. Google filters some; many get through.

Invalid traffic (IVT)

All non-genuine traffic, often split into general invalid traffic (known bots, easy to filter) and sophisticated invalid traffic (built to look human, much harder to catch).

IP address

The number that identifies a device’s connection to the internet. Google Ads exclusions work by IP address.

IPv6 prefix (/64)

A block of IPv6 addresses usually given to one home or device. Fraudsters can move between addresses inside it, so the Collective Shield lists the whole block when several addresses in it are reported.

L

Lead

An enquiry, booking or order form sent by a visitor. ClickTrap can mark each lead from your ads as genuine, suspicious or invalid, without recording anything typed into it. See lead protection →

Location rule

A rule that flags or blocks paid clicks from outside the countries you advertise in. Set per website. Location rules →

M

Manager account (MCC)

A Google Ads account that manages other accounts, used by agencies and businesses with several brands. ClickTrap can work through a manager account.

Microsoft click ID (MSCLKID)

The code Microsoft Advertising adds to the landing page address on an ad click, as Google adds its GCLID. It links a visit to the Microsoft ad click behind it.

Monthly report

A one-page summary of a month’s paid clicks, threats, conversions and spend saved, to keep or share. Agencies can send it to clients under their own name and logo.

N

Network (ASN)

The organisation an IP address belongs to, such as a broadband provider, a mobile network or a hosting company. Shown beside each address, it helps tell a home visitor from a data centre.

No-JavaScript click

An ad click the website’s own server saw arrive, but whose visitor never ran the page’s scripts. Real browsers run them; many bots don’t.

P

Paid visit

A visit to your website that came from an ad click, recognised by its click ID. These are the visits ClickTrap checks. What’s checked →

Pay-per-click (PPC)

Advertising where you pay each time someone clicks your ad, as on Google Ads and Microsoft Advertising.

Progressive web app (PWA)

A website that can be installed like an app, with its own icon and window, on phones and computers. ClickTrap can be installed this way from the sidebar.

Protection level

How strictly an area of protection works in ClickTrap: Conservative blocks only the clearest cases, Balanced suits most websites, Aggressive catches more but may now and then block a real visitor. Each area can also be switched off, or set with your own rules. Click rules →

Proxy

A server that forwards traffic so the website sees the proxy’s address instead of the visitor’s. Used for privacy, and to hide fraud.

Q

Quality Score

Google’s 1–10 rating of how relevant your ads, keywords and landing pages are. Fake clicks that bounce straight away can drag the signals behind it down.

Quick leaver

A visitor from an ad who leaves within seconds, before the page has finished loading. ClickTrap still records the visit, marked “Left early”, and checks it against your rules; bots that click and go often look like this.

R

Refund for invalid clicks

Google credits advertisers for clicks it agrees were invalid. ClickTrap exports the click IDs, times and reasons Google asks for when you report them.

Repeat clicker

Someone who clicks the same ad again and again, often changing network or IP address so each click looks new.

Reporting feed

A private web address with your daily figures as CSV, which Google Sheets can read with IMPORTDATA and Looker Studio through the sheet. Available on the larger plans. Plans with the feed →

Residential proxy

A proxy that routes traffic through real home connections, making fraud look like ordinary households. Device fingerprinting helps where IP addresses can’t.

Return on plan

The estimated saving divided by what the plan cost over the same days. For an agency’s clients, each is measured against its share of the agency’s plan.

S

Search partners

Websites outside Google Search that show Google’s search ads. They extend reach, and are often where invalid traffic is higher.

Shared IP

An IP address many people use at once, such as mobile networks and carrier-grade NAT. The Collective Shield never lists these automatically, so real people aren’t blocked.

Smart Signals

Fingerprint’s detections for bots, VPNs, Tor, tampering and more, which ClickTrap uses alongside its own checks.

Spend saved

An estimate of what blocked sources would have gone on to cost: each is taken to keep clicking at the rate it showed before it was blocked, for up to 30 days, at each day’s average cost per click. See the plans →

Suspicious click

A paid click flagged by a signal such as a VPN or an unusual device, whose source hasn’t been blocked. Shown separately from valid and invalid clicks in analytics.

T

Tampered browser

A browser whose reported details have been altered, a strong sign of an anti-detect tool.

Threat network

A shared list of offenders built from reports by many advertisers. The Collective Shield excludes IP addresses several of our customers have caught, the first time they click your ads. How it uses data →

Tor

A network that hides a user’s location by passing traffic through volunteer relays. Traffic leaving a Tor exit node is rarely a genuine ad customer.

Tracking template

A Google Ads setting that sends each ad click through a tracking address before the landing page, so the click is recorded even when the page never loads. Google requires the tracking address to be certified.

Traffic alert

An email, or a Slack or Microsoft Teams message, when flagged clicks surge on a website or its paid visits stop arriving.

U

UTM parameters

Tags added to a link (utm_source, utm_campaign and so on) so analytics tools know where a visit came from.

V

Valid click

A paid click with nothing suspicious about it and from a source that isn’t blocked: the clicks you want to be paying for.

Visit history

How long paid visits are kept and shown, which depends on the plan. Exclusions and blocked devices are kept whatever their age, so protection carries on. History by plan →

VPN

A virtual private network, which hides a user’s real IP address behind the VPN provider’s. Real people use VPNs too, so ClickTrap flags them rather than blocking by default.

W

Wasted spend

What blocked sources’ clicks cost before they were stopped: money already spent on clicks that were never going to convert.

Watched address

An IP address whose visits were flagged recently but which isn’t excluded. ClickTrap keeps an eye on it, and it’s blocked if it breaks a rule.

White-label report

A report sent under an agency’s name and logo rather than the software’s, so clients see their agency’s brand.