Click Fraud & Security Protection

Monetizing websites with display advertising (such as Google AdSense, Mediavine, Raptive, and direct affiliate campaigns) exposes publishers to the risk of invalid click penalties or permanent account bans caused by malicious competitors, scraping bots, or click bombers.

AdFuz Pro Click Fraud & Security Protection is an enterprise-grade defense shield. It dynamically monitors click frequency across visitors, IP addresses, and CIDR subnets, automatically detects cross-domain iframe clicks (such as Google AdSense units), enforces honeypot traps for web scrapers, suppresses ads site-wide for offending actors, and maintains an auditable security event log.

---

1. How Click Fraud Protection Works

The protection shield operates at both the server-side decision pipeline and client-side interaction layer:

Visitor Clicks Ad
       │
       ▼
[1] Whitelist & Blacklist Evaluation
    • Whitelisted IP / Subnet (Admins, Office) ──► Allowed (Bypass checks)
    • Blacklisted IP / Pattern                ──► Blocked immediately
       │
       ▼
[2] Rolling Window Click Counter
    • Evaluates clicks within configured window (e.g., Max 3 clicks in 3 hours)
    • Tracks across Cloudflare (CF-Connecting-IP), reverse proxies & privacy HMAC hashes
       │
       ▼
[3] Threshold Decision
    ├── Under Threshold: Click recorded normally; Warning logged if 1 click away
    └── Exceeded Threshold:
         ├── Issue automatic ban for configured duration (e.g., 7 days)
         ├── Collapse & suppress ALL ads site-wide across the entire domain
         └── Log Critical Threat event in Pro Security & Audit Trail

Frequency Capping vs. Click Fraud Protection

Frequency Control & Visitor Capping (in the Campaign editor) is a marketing pacing tool to prevent banner fatigue. Click Fraud Protection is a site-wide security shield designed to stop malicious actors from getting your Google AdSense or ad exchange accounts banned.

---

2. Key Capabilities

Rolling Click Rate Limiting

Define custom thresholds such as Maximum 3 clicks within 3 hours. Once crossed, the offender is banned immediately.

Google AdSense & Iframe Listener

Monitors pointer hover states and window focus blur events to detect clicks inside cross-domain iframe embeds (such as AdSense, Mediavine, and Google Ad Manager).

Scraper Bot Honeypot Traps

Injects invisible honeypot elements into ad spaces. Automated bots and web scrapers that click these invisible links receive an instant 30-day or permanent ban.

Pro Security & Audit Dashboard

View live threat deflection metrics, manage active IP bans with 1-click unban, filter incident severity, and inspect full audit logs.

---

3. Configuring Click Fraud Protection

1. In your WordPress admin dashboard, navigate to Ad Fuz → Audit & Security.
2. Click the Security Rules & Settings tab.
3. Toggle Enable Protection to ON.
4. Configure your desired thresholds:
   • Maximum Clicks Allowed: e.g., 3 clicks.
   • Rolling Time Window: e.g., 3 hours (evaluated against Server Time, displayed in the header).
   • Offender Ban Duration: e.g., 7 days (or customize as needed).
   • Action After Limit Reached: Select Collapse & Completely Suppress All Ads Site-Wide or Render Invisible Blank Space.
5. Enable Google AdSense & Iframe Protection if running external script ads (supports Google AdSense, Mediavine, Raptive, Google Ad Manager, and other cross-origin ad networks).
6. Enable Scraper Bot Honeypot Trap and customize the Honeypot Ban Duration (default: 30 days).
7. Configure Estimated Average CPC ($) to accurately calculate your protected budget savings.
8. Add trusted administrator or office IP addresses to the IP Whitelist (supports exact IPs and CIDR ranges like 192.168.1.0/24).
9. Click Save Security Settings.

---

4. Managing Banned Visitors & Audit Logs

Banned Visitors Table

Under the Banned Visitors tab, administrators can:

• Quick Status Pills: Instant 1-click filtering by All, Active, Unbanned, and Expired with real-time count badges.
• Search & Clear Filters: Fast lookup by IP, country, or reason with a dedicated Clear Filters reset button.
• 1-Click Unban: Instantly restore ad visibility to a visitor if flagged by mistake.
• + Manual Ban IP: Outline action button to proactively ban abusive actors with custom reasons and durations.

Security Audit Trail

The Audit Trail & Logs tab maintains an immutable event history:

• Severity & Date Range Filters: Filter by severity (Critical, High, Medium Warnings, Low) and specific From / To date ranges.
• Auto-Refresh Sentinel: Toggle automated log polling with configurable intervals (5s, 10s, 15s, 30s, 60s, default: 10s) for live threat monitoring during active campaigns.
• Clear Logs: Purge audit logs on-demand with safety confirmation dialogs.

---

5. Security & Fraud Analytics in Statistics Dashboard

AdFuz Pro deeply connects fraud mitigation to the main AdFuz → Statistics report under the dedicated Click Fraud & Security tab:

Estimated Ad Spend Saved

Dynamically projects ad budget saved by multiplying prevented invalid clicks by your configured Estimated Average Cost Per Click (CPC) (configurable in Security Settings).

Threat Volume & Timeline Chart

Visualizes daily blocked invalid clicks, honeypot deflections, and click-bombing spikes alongside regular traffic curves.

Geographic & Device Intelligence

Breaks down attack sources with country names and flags, device categories (Desktop, Mobile, Tablet), and identified scraper bot signatures.

Targeted Campaigns & One-Click CSV Export

Ranks campaigns receiving fraudulent activity with campaign names and IDs, plus instant one-click CSV export of all telemetry.

Quick Date Range Presets

Analyze traffic across preset time slices with a single click:

• Today & Yesterday
• Last 7 Days & Last 30 Days
• This Month & Last Month
• Live Refresh: Instant stats reload without refreshing the entire browser window.

Server Time & Rolling Windows

All click-bombing frequency counters and ban expiration calculations are strictly based on your WordPress Server Time and configured timezone (shown in Security Settings), ensuring reliable defense regardless of visitors’ client clocks.

Configuring Estimated CPC

To see accurate budget savings in both the Audit & Security overview card and the main Statistics dashboard, set your publisher average CPC under Ad Fuz → Audit & Security → Security Rules & Settings → Estimated Cost Per Click (CPC) (default: $0.50).

GDPR & Privacy Compliance

AdFuz Pro stores IP addresses in compliance with modern privacy regulations. All rolling click tracking uses one-way SHA-256 HMAC salted hashing, preventing exposure of raw visitor IP addresses in public cookies or local storage.