AdProtektor – Click Fraud Protection

Description

See who is really clicking your ads. AdProtektor checks every visit to your WordPress or WooCommerce site and sorts it into real visitors, crawlers, bots, competitors and click farms, with the evidence behind each verdict: where the visit came from, what it did on the page and why it was flagged.

Start free. Every account starts with a seven-day trial of every feature. After it, your first website stays on the free plan: visits are still checked and every attack is shown in your dashboard, up to a monthly visit limit. Blocking, Google Ads and Meta exclusions and ConversionOS are on the paid plans.

Stop paying for the same source twice. On a paid plan, a visitor who crosses your threat threshold is blocked even when they change IP address, and once your Google Ads account is connected the addresses behind them go into its IP exclusion lists automatically. Google still charges for the click that revealed a source; the Refund Report gathers the evidence for an invalid-traffic claim, and Google decides whether to credit it.

A suspicious visit is not proof of fraud on its own: shared IP addresses, short visits and automation need context, which is why every verdict comes with its evidence and you choose how strict protection is.

Traffic review and protection:

• Visitor analytics, browser identity signals and device fingerprinting
• Risk classifications and configurable protection rules
• Google Ads IP exclusions for eligible connected campaigns, and Meta exclusion audiences where configured and supported
• First-party tracking option that serves the script and relays requests through your own domain; this does not guarantee bypassing ad blockers or browser restrictions
• Evidence reports to support a Google Ads invalid-traffic review; Google decides whether a refund is granted
• Checkout protection for WooCommerce: a visitor AdProtektor has flagged on hard evidence (detected automation, a block you set yourself, or a visit from outside the area you allow) cannot add to the cart or place an order, and is shown a reference to quote if they think it is a mistake. Everyone else checks out as normal, and if AdProtektor cannot be reached the order goes through. You can switch it off per domain in the AdProtektor dashboard

Installing the plugin does not automatically enable every protection action. Add your tracking code, confirm visits are arriving, and review the domain’s protection settings and advertising-account connections in AdProtektor.

ConversionOS server-side conversion capture:

With ConversionOS enabled on your subscription and a domain site key configured, the plugin sends supported events to AdProtektor. Delivery to Meta CAPI, GA4 and Google Ads requires the corresponding destination configuration, account permissions and eligible events. A delivery receipt is distinct from a conversion appearing in a platform’s reports.

• WooCommerce — purchases when payment is confirmed, plus refund/cancellation notifications; downstream adjustments depend on the destination and the original conversion’s delivery status
• WooCommerce funnel events — product views, add-to-cart and checkout events
• Gravity Forms, Contact Form 7, WPForms and Elementor Pro — leads from supported form submissions
• Email, phone and name are SHA-256 hashed on your server before they are sent, using the normalization required for matching
• Read-only Activity page with connection status and a rolling outbound-event log

Server-side capture can retain supported order and form events without depending solely on a browser pixel. It does not guarantee complete attribution, platform acceptance or immunity to blockers. A form submission is not a qualified lead.

Requirements and evaluation:

The connector plugin is free. Current plan terms, including the free plan’s monthly visit limit, are on the AdProtektor pricing page.

• An active AdProtektor account at app.adprotektor.app, your domain and its tracking code
• For ConversionOS: the add-on enabled on your subscription plus a site key for your domain; configure the destinations you want to use
• Install the tracking code and verify actual visits and supported test events before evaluating results
• The seven-day trial requires installation and real traffic to be useful; low traffic may leave the evaluation inconclusive. Check current trial and subscription terms in AdProtektor before signing up

External services

This plugin connects your site to AdProtektor (https://adprotektor.app), a third-party click-fraud protection and conversion-tracking service operated by AVI-WEB. An AdProtektor account is required; nothing is sent until you enter a tracking code or site key in Settings → AdProtektor.

AdProtektor tracking script (cdn.adprotektor.app and api.adprotektor.app)

• What it is for: assessing tracked visits for risk signals and supporting configured protection actions on eligible connected advertising accounts.
• When: once a tracking code is saved, the plugin adds the script to every front-end page. With “First-party tracking” switched on, the same script and its requests are relayed through your own domain (under /_adp) instead: your server fetches the script from cdn.adprotektor.app and forwards the tracking requests to api.adprotektor.app, adding your site key and the visitor’s IP address (and, behind a trusted edge you configure, the visitor’s TLS fingerprint). Of the visitor’s cookies, only AdProtektor’s own (adp_*) are forwarded.
• What is sent, from the visitor’s browser: the visitor’s IP address, user agent, browser and device characteristics (used to recognise the same browser across visits), page URL and referrer, ad click identifiers and campaign parameters (such as gclid, fbclid and UTM values), and on-page behaviour such as time on page, scrolling, clicks and mouse movement. A visitor identifier is kept in first-party cookies and browser storage.
• Session recording: if you switch on session recording for your domain in the AdProtektor dashboard, the script also records visitors’ sessions so you can replay them. If you use it, disclose session recording in your site’s privacy notice where the law requires it.

ConversionOS server-side conversions (api.adprotektor.app)

• What it is for: reporting conversions from your server to the ad and analytics platforms you connect in AdProtektor (Meta Conversions API, GA4, Google Ads Enhanced Conversions).
• When: only if you enter a ConversionOS site key, and only when a supported event happens: a WooCommerce order is paid, refunded or cancelled, a product is viewed, added to the cart or checked out, or a Gravity Forms, Contact Form 7, WPForms or Elementor Pro form is submitted.
• What is sent, from your server: the event type, order or form details (order value, currency, product IDs, names and categories), the visitor and session identifiers from the AdProtektor cookies, and the customer’s email, phone, name and address. Email, phone and name are SHA-256 hashed on your server before they are sent.

Checkout protection (api.adprotektor.app)

• What it is for: refusing an order from a visitor AdProtektor has flagged on hard evidence before WooCommerce creates it.
• When: only if you enter a site key, and only when a shopper places a WooCommerce order (classic checkout, the Checkout block, or a payment button that places the order through them). Store managers placing an order are not checked.
• What is sent, from your server: your site’s host name and checkout page path, the visitor identifier from the AdProtektor cookies, the shopper’s IP address, the cart or order total and currency, and your site’s language. AdProtektor answers allow or block; a blocked attempt is recorded in your AdProtektor dashboard with its reference.

Connection status on the Activity page (api.adprotektor.app)

• What it is for: showing whether ConversionOS is enabled for your domain and when AdProtektor last received an event from it.
• When: only when an administrator opens the AdProtektor Activity page with a site key saved. The answer is kept for five minutes.
• What is sent, from your server: the site key and your site’s host name.

Sign-up and connect links (app.adprotektor.app)

• What it is for: creating your AdProtektor account for this site and getting its tracking code into the settings field.
• When: only when an administrator clicks “Create your free account” on the Settings → AdProtektor page. The plugin itself sends nothing: the button opens app.adprotektor.app/register in a new tab with your site’s host name and the plugin’s UTM tags in the link, so the sign-up form is filled in for this site and the signup is credited to the plugin. The dashboard’s “Open my WordPress plugin settings” button links back to this settings page with your tracking code in the link; it fills in the field and saves nothing until you click Save Settings.

Optional footer badge (adprotektor.app)

• Off by default. If you switch on “Footer badge” in Settings → AdProtektor, a small “Protected by AdProtektor” text link to https://adprotektor.app/ is added to your site footer, with your referral code if you enter one. Nothing is sent anywhere unless a visitor clicks it.

AdProtektor Terms of Service · Privacy Policy · Data Processing Agreement