Layer 1 · Web Protection

Protect every paid impression and click that touches your web stack.

Two layers of defence in one tag. Creative-level scanning of every ad served through Google Ad Manager, header-bidding wrappers, and direct publisher integrations — and click-level scoring of every visit that lands on your campaigns, whether from Google, Meta (Facebook & Instagram), affiliate networks, or direct buys. Catches click farms, lead-gen bots, traffic-spike floods, and creative supply-chain risks, then pushes IP and audience exclusions back to Google Ads, Meta Custom Audiences, Bing, and GTM so the fraud stops being paid for.

What it catches

Every fraud surface, one tag

Web fraud isn't just about clicks. ClickTrust scans the creative, the click, the landing page, and the form — across Google, Meta, affiliate, and direct channels — so every dollar of paid media is defended the same way.

Creative-level scanning

Validate every ad served through GAM, header-bidding wrappers, and direct publisher integrations. Catch malvertising, redirect chains, supply-path mismatches, and pixel stuffing before they reach your audience.

Click farms & competitor clicks

Repeat-offender IP fingerprints, datacentre-IP bots, anti-detect browsers, headless WebDriver, suspicious geolocation, and competitor click attacks on your high-CPC keywords.

Lead-gen fraud on your forms

Superhuman fill speeds, paste-only entries, honeypot interactions, copy-pasted disposable emails. Stop fake leads polluting your CRM and wasting your sales team's time.

Traffic-spike floods

Sudden bursts of suspicious traffic — competitor sabotage, bot floods, scraped-list attacks. Real-time anomaly detection raises the alarm and auto-suppresses the source.

Google Ads traffic

Every click tagged with a gclid is fingerprinted, scored, and mapped back to its campaign. Risky IPs are pushed automatically to your Google Ads exclusion list via the API — no manual exports needed.

Meta (Facebook & Instagram) traffic

fbclid-tagged visits from Meta campaigns are scored the same way as Google traffic. Risky users flow into Meta Custom Audiences via the Pixel bridge or SHA-256 IP upload — and stop seeing your Meta ads.

Affiliate & partner traffic

Clicks arriving through affiliate tracking links are scored for CTIT anomalies, click spam, install hijacking, and bot patterns. Fraudulent conversions are suppressed at the postback level before they're paid out.

Viewability & ad-stack fraud

Below-50%/1s viewability, hidden iframes, ad stacking, clickjacking, in-WebView ad farms. Aligned with MRC IVT Standards so the evidence is publisher-ready.

Repeat-offender fingerprinting

Canvas, WebGL, plugin, screen, touch, and device-memory fingerprints persist a fraudster across IP changes — and across web, app, and affiliate touchpoints in your workspace.

How it works

One JS tag. Two scanning layers. Zero rework.

Drop a single line of JavaScript on your landing pages and ad creatives. The tag does two things: it validates the served creative against trap rules at impression time, and it fingerprints every click that lands on your page. Both feed the same trap engine and the same Traffic Quality Index — so you can compare campaigns apples-to-apples.

  • 320 MRC-inspired traps with GIVT / SIVT labels
  • Scans Google, Meta, affiliate, and direct traffic through a single tag
  • Auto-push IP exclusions to Google Ads, Meta, and Bing via API
  • Meta Custom Audience sync — risky visitors excluded from Meta campaigns automatically
  • GTM dataLayer integration for risk-based audience exclusion
  • Session replay + click / movement / scroll heatmaps included
  • Bulk log analysis for retroactive auditing of historical traffic
One-line install
<!-- Paste once in <head> on landing pages
     and ad creative containers -->
<script async
  src="https://cdn.clicktrust.cc/cs.js"
  data-tid="abcd1234"></script>

<!-- That's it. The tag:
   - validates served creatives in real time
   - scores every click + visit (Google, Meta,
     Bing, affiliate links, organic, direct)
   - propagates risk_score into your GTM
     dataLayer for audience exclusion
   - auto-pushes exclusions to Google Ads,
     Meta Custom Audiences, and Bing via API
   - feeds your dashboard, reports,
     and refund-evidence exports -->

Built for advertisers, not networks

Three things you'll do with Web Protection

Block fraud at the source

Auto-generated IP and audience exclusion lists pushed back to Google Ads, Meta Custom Audiences, Bing, and GTM. Affiliate postbacks suppressed for flagged sources. Fraudulent traffic stops seeing your ads — and stops costing you money.

Recover wasted spend with evidence

Per-campaign refund-claim reports with full evidence chains in MRC vocabulary (GIVT / SIVT). Hand them to Google, Bing, or your publisher and reclaim the spend.

Extend the same score to app + affiliate

If you also run app installs or affiliate campaigns, In-App Protection and Lite-MMP attribution share the same workspace, the same fraud score, and the same evidence chain.

FAQ

Questions advertisers ask before switching on Web Protection.

How does ClickTrust detect click fraud on Google Ads?
A JavaScript tag on your landing pages fingerprints every visit and scores it against 320 detection traps: datacenter and proxy IPs, headless browsers and automation tools, impossible travel, repeat offenders, and behavioural signals such as superhuman form fills. Each click carrying a gclid is mapped back to its campaign, and risky IPs are pushed to your Google Ads exclusion list automatically.
Does it work with Meta, Bing and affiliate traffic too?
Yes. Visits from Meta (fbclid), Bing (msclkid), TikTok, LinkedIn and affiliate tracking links are scored the same way. Risky Meta users flow into Custom Audience exclusions, and flagged affiliate conversions are suppressed at the postback.
Will the tag slow down my pages?
No. It is one async script that loads after your content, and scoring happens on ClickTrust's servers in under 50 milliseconds. It never blocks rendering.
How do I get refunds for invalid clicks?
ClickTrust exports per-campaign evidence reports with every flagged event labelled GIVT or SIVT, the vocabulary Google, Bing and publishers expect in a refund claim.
Is Web Protection enough if I also run app or affiliate campaigns?
Web Protection covers clicks and visits. Add In-App Protection for installs and Lite-MMP Attribution for affiliate payouts. All three share one workspace, one fraud score and one evidence chain.

Running app or affiliate campaigns too?

Pair Web Protection with In-App Protection and Lite-MMP attribution. Same workspace, same fraud score, same evidence chain — across every layer of your paid media buy.