Description
Your ads are clicked by bots, scrapers and competitors. Every one of those clicks is billed to you, and the ad platforms refund only a fraction of them.
Didva watches the traffic arriving on your own site from your ads, scores every click, and builds the exclusion lists that stop the worst offenders from costing you again. This plugin is the WordPress half of that: press Connect once and the tracking snippet is installed on every page for you.
What you get
- Fraud clicks caught beyond what the ad platforms filter themselves, with the money those blocked IPs would have cost you.
- A ready-to-paste IP exclusion list for Microsoft Advertising, and an invalid-click appeal report covering Google and Microsoft clicks, so the worst offenders stop costing you at the platform too.
- Conversions counted correctly: WooCommerce orders automatically, and a thank-you page you pick for form and lead sites.
- Multi-channel by default: Google, Microsoft Advertising and Meta ads are recognised from the click itself.
- A daily self-check that warns you if a caching or optimisation plugin starts stripping the snippet.
One-click connect, no API keys
You never copy a key into this plugin. Pressing Connect sends you to didva, where you approve the connection for this site, and the plugin exchanges a single-use code for its own revocable access token. You can revoke it at any time from your didva profile, or press Disconnect here.
What “stops them” means
Didva scores the traffic and builds the exclusion lists. Actually excluding an offender happens in the account you connect: Google Ads exclusions are pushed for you, Cloudflare blocks the traffic at your site, and Microsoft Advertising has no exclusions interface at all, so didva produces a list you paste. Automatic exclusion is part of the paid plans. On the free plan you get the detection, the statistics and manual blocking.
Free plan
Didva has a free plan, and this plugin works on it: tracking, detection and your statistics are all included. Some of the features above — exports, exclusion lists and appeal reports — are part of the paid plans. You need a didva account either way: this plugin displays and installs protection for that account, it is not a standalone blocker.
External services
This plugin connects to didva, the click-fraud protection service at app.didva.com. It is required: without it there is nothing to protect your ads.
When you press Connect. Your site’s domain and the WordPress admin address you return to are sent to app.didva.com so the site can be created in your account and you can be sent back. In exchange the plugin receives an access token and a site key, which it stores in your WordPress database.
On every page a visitor loads. The plugin adds didva’s hosted tracking script to the page, preceded by a one-line tag that names your site key. That script runs in your visitor’s browser and sends what didva needs to score the visit: the advertising click identifier in the address, the page address, the referrer, technical characteristics of the browser and device, a hashed device fingerprint, and the network address the request comes from. It also measures how the visit behaves — time on the page, scroll depth, and the number and timing of mouse, pointer and keyboard events — which is how automated traffic is told apart from a person; browsers asking not to be tracked, through Do Not Track or Global Privacy Control, are left out of that part. So the same ad click can still be recognised when the visitor comes back and buys, the click identifier is kept on their device for up to 90 days, in a first-party cookie named cg_click and in the browser’s local storage. Your public pages are tracked; the WordPress administration screens are not.
On your WooCommerce order-received page and your chosen thank-you page. The plugin adds didva’s hosted conversion script, which reports that a conversion happened, the order number for WooCommerce orders, and the click identifier stored earlier, so the sale can be matched to the ad click that produced it.
From your WordPress admin. The plugin asks app.didva.com for your site’s statistics (blocked addresses, fraud clicks, money saved) to show them on its settings page, and once a day it checks that the snippet is still present on your homepage.
When you press Disconnect, or when you delete the plugin. The plugin asks app.didva.com to revoke its own access token, so the credential is not left behind.
Service provided by didva: terms — privacy policy
Screenshots
Installation
- Install and activate the plugin.
- Open Didva in the WordPress admin menu.
- Press Connect to didva, sign in or create your account, and approve the connection.
- That is it. The tracking snippet is now live on your site, and your dashboard fills up as ad clicks arrive.
Your site must be served over HTTPS to connect.
FAQ
-
Do I need a didva account?
-
Yes. The plugin installs the tracking snippet and shows your statistics; the detection, scoring and ad-platform exclusion lists live in your didva account. A free plan is available.
-
Will it slow my site down?
-
Two small tags go into the page head: a one-line setting and an asynchronous script file, cached by the browser for half an hour at a time. Neither blocks rendering. Your order-received or thank-you page gets one more.
-
My dashboard shows no clicks. What is wrong?
-
Usually a caching or “delay JavaScript” feature postponing the snippet. The plugin already marks its own tags so that Autoptimize, LiteSpeed Cache, WP Rocket and Cloudflare’s Rocket Loader skip them, so start by clearing your page cache. If an optimiser you use ignores that, exclude
ct-click.jsfrom its JavaScript delay or defer feature by hand. The plugin’s own daily check warns you when it cannot find the snippet on your homepage. That warning appears on the plugin’s own screen, your Dashboard and the Plugins page — not all over wp-admin — and can be dismissed for a week. -
How are conversions counted?
-
WooCommerce orders are counted automatically when the order is not failed, on both the classic checkout and the newer checkout block. For form or lead sites, pick your thank-you page in the plugin settings and didva counts a lead when an ad visitor reaches it.
-
I need visitor consent before tracking. How?
-
You remain responsible for consent and for privacy-law compliance on your own site: didva measures visitor behaviour and stores a click identifier on the visitor’s device, and only you know which rules apply to your audience. The plugin gives your consent-management plugin a hook to hold the tags back until consent is given:
add_filter( 'didva_should_track', function () { return my_consent_given(); } );While the filter returns false no didva tag is printed at all — nothing is queued and nothing fires later. Suggested Privacy Policy text is added to Settings Privacy for you to review and include.
-
Does it work on multisite?
-
Not in this version. Activate it per site rather than network-wide.
-
My host blocks outgoing connections. Can I still use it?
-
Only if
app.didva.comis allowed. On hosts that defineWP_HTTP_BLOCK_EXTERNAL, add it toWP_ACCESSIBLE_HOSTS. -
How do I remove everything?
-
Press Disconnect: the snippet stops immediately and the plugin asks didva to revoke its access token. Deleting the plugin does the same and removes every setting it stored. You can always confirm — or revoke by hand — under Connected devices in your didva profile. Your data stays in your didva account.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Didva Click Fraud Protection” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Didva Click Fraud Protection” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- First release: one-click connect, automatic tracking snippet, WooCommerce and thank-you-page conversions, statistics in the WordPress admin, daily snippet health check.