Directly on the website
The code can be placed before the closing </head> tag or through a script-management module.
Four steps to your first analysis.
- Add the website. After registration, the platform creates a profile for the specific domain.
- Install the tracking code. Copy the asynchronous code from the dashboard and install it on the website or through Google Tag Manager.
- Tag ad visits. Add
utm_source=fraudto the ad URLs. - Collect enough data. The first full AI cycle runs after 7 days, and subsequent analyses compare new signals with historical data.
How the system identifies an ad visit.
The tracking code records visits and behavioural signals. To distinguish paid visits from other traffic, the ad URL must contain the following marker:
https://example.com/?utm_source=fraud
When the URL already contains parameters, add the marker with an ampersand:
https://example.com/?utm_campaign=search&utm_source=fraud
Google Tag Manager
Use a Custom HTML tag and trigger it on every page that should be measured.
What the engagement data means.
| Metric | What it measures | How it is used |
|---|---|---|
| Active time | The time during which the page is active and the visitor interacts with it. | Helps distinguish genuine browsing from a page that was opened and abandoned. |
| Total dwell time | The duration of the session, including periods without activity. | Used as context, but not sufficient on its own. |
| Scroll depth | The deepest point reached on the page. | Shows whether the content was explored in depth. |
| Interactions | The number of clicks on links, buttons and interactive fields, without recording their content. | Contributes to the quality score but does not automatically make a session engaged. |
| Key actions | Important actions explicitly marked with data-engagement-action, for example submitting an enquiry. After a successful AJAX form response, the following event can be dispatched: clickshield:key-action. | Can qualify the session as engaged, similarly to a key event. |
| Viewed pages | The total number of pages loaded by the address. | Distinguishes a single landing-page click from deeper browsing. |
| Ad visits | Loads during which the ad marker was detected. | Compared with total pages, repetition and behaviour. |
Dashboard breakdown
For each website, the dashboard shows three separate engagement-rate values: all measured sessions, ad traffic tagged with utm_source=fraud and the remaining direct, organic and referral traffic. Engagement rate is the share of sessions with at least 10 active seconds, 2+ pages or an explicit key action marked with data-engagement-action.
A separate behavioural score /100 is displayed alongside the percentage. It combines active time, scroll depth, genuine actions, page count, focus and an engaged-session bonus. This prevents an easily reached combination from automatically receiving 100 points.
Important: a low engagement rate or behavioural score does not prove fraud by itself. The AI score also considers frequency, repetition, pages after the click, behaviour and network context.
One score from 0 to 100 for a faster decision.
| Score | Recommended action | Practical meaning |
|---|---|---|
| 85–100 | Block | Several matching risk signals and sufficient evidence are present. |
| 65–84 | Monitor | A suspicious pattern is present, but more time or human review is required. |
| 0–64 | Do not block | The data does not justify restricting the address. |
Each decision includes the reasons, ad visits, post-click pages, behaviour and relevant network context. The final action remains under human control.
A separate list containing only approved addresses.
Once an address is approved for blocking, it moves to a separate section for the relevant domain. A user sees only their own website, while an administrator can filter all domains.
To add
IP addresses that have been approved but not yet confirmed as added to Google Ads.
Added to Google Ads
History of addresses whose manual addition has been confirmed by the user.
Copy and export
Copy the addresses or download a TXT/CSV file containing only current tasks.
Return to tasks
Mark an address as not added when it has been removed from Google Ads or confirmed by mistake.
These statuses do not control Google Ads automatically. They show whether a person completed the action manually. Direct changes to the advertising account require a separate Google Ads API integration.
How to add IP addresses to exclusions.
At account level
- Open Google Ads and sign in to the correct advertising account.
- From the Admin open Account settings.
- Find IP exclusions.
- Paste one address per line and save.
- Return to ClickShield and confirm the addition.
At campaign level
Open the relevant campaign, then Settings → Additional settings → IP exclusions. The availability of this setting depends on the campaign type.
Cleaner traffic makes conversion optimisation more reliable.
ClickShield does not replace A/B testing and does not automatically change landing pages. The platform helps separate suspicious and low-value traffic from the behaviour of genuine visitors.
Less budget wasted
Approved IP addresses can be excluded to limit their repeated participation in future ad impressions.
A cleaner conversion-rate baseline
When irrelevant traffic is separated, the relationship between visits and genuine actions can be interpreted more accurately.
Better CRO hypotheses
Active time, scroll depth, interactions and session depth reveal where visitors lose interest.
Better focus
Budget and optimisation effort can be directed towards campaigns and visitors showing genuine signals of interest.
About the “up to 30%” claim: this is a scenario observed in individual external audits of high-risk campaigns, not a universal average or guaranteed saving. The actual impact can only be determined from the specific account’s data.
Do not block an address simply because it clicked more than once.
- A single IP address may be used by an office, university, mobile operator or large shared network.
- Dynamic addresses may change between the ad impression and the website visit.
- Google has its own automated invalid-traffic protection; ClickShield adds onsite behaviour and first-party history for additional control.
- Review the reasons and network context before blocking a range.
- Compare results after blocking: spend, qualified enquiries, conversion rate and acquisition cost.