Title: Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking
Author: Muhammad Arfa Rehman
Published: August 28, 2026
Last modified: August 28, 2026
---
Search plugins
# Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking
By [Muhammad Arfa Rehman](https://profiles.wordpress.org/arfarehman/)
[Download](https://downloads.wordpress.org/plugin/vetraclix-for-google-ads.1.0.2.zip)
* [Details](https://wordpress.org/plugins/vetraclix-for-google-ads/#description)
* [Reviews](https://wordpress.org/plugins/vetraclix-for-google-ads/#reviews)
* [Installation](https://wordpress.org/plugins/vetraclix-for-google-ads/#installation)
* [Development](https://wordpress.org/plugins/vetraclix-for-google-ads/#developers)
[Support](https://wordpress.org/support/plugin/vetraclix-for-google-ads/)
## Description
Every paid click that reaches your site carries a click identifier – `gclid` from
Google Ads, `msclkid` from Microsoft Advertising, `fbclid` from Meta. Those identifiers
are meant to be used once, by one visitor. In practice they get shared in messages,
pasted into forums, replayed by bots, indexed by scrapers, and clicked again days
later by people who never saw your ad.
Every one of those replays looks to your analytics exactly like a fresh paid click.
Your conversion data drifts. Your cost-per-lead looks wrong. And your sales team
calls leads that came from an ad click nobody paid for.
**Vetraclix records every ad click the first time it arrives, then refuses to let
it count twice.**
#### How it works
1. **Capture.** When a visitor arrives with an ad click identifier in the URL, it
is recorded server-side, before your theme renders anything.
2. **Clean.** The click identifier and campaign parameters are removed from the visible
address bar, so they never land in browser history and never travel in a copied
link.
3. **Score.** If the same identifier comes back, it is scored 0-100 on how suspicious
the repeat looks: a changed IP address, a changed device, a changed country, how
quickly it was reused, how many times it has been seen, and how late in its lifetime
it reappeared.
4. **Act.** Depending on the resulting status, tracking scripts are withheld, form
submissions are refused, and the visitor can be shown a branded notice or quietly
redirected to a clean version of the page.
Genuine visitors are never affected. Organic and direct traffic carries no click
identifier at all and is ignored completely.
#### What makes it different
* **It blocks before your page loads, not after.** Most approaches hide something
in the footer, long after the tracking script in your `` has already fired
and already counted the visit. Vetraclix intercepts on `template_redirect`, before
your theme is loaded at all, so a bad click never reaches a single tracking tag.
* **It works with the tags you already have.** There is no need to rip out Google
Tag Manager or move your pixels. Wrap them in one function call and they are
gated automatically.
* **It makes no external requests.** No third-party fraud API, no geolocation service,
no account to sign up for, no data leaves your server. Country data is read from
headers your CDN already sends.
* **Nothing is hard-coded.** Expiration windows, scoring weights, which networks
to watch, what visitors see, which forms are protected, how long data is kept–
all of it is configurable from the settings screen.
#### Ad networks supported
Google Ads (`gclid`, `gbraid`, `wbraid`), Microsoft Advertising (`msclkid`), Meta
Ads (`fbclid`), TikTok (`ttclid`), X/Twitter (`twclid`), LinkedIn (`li_fat_id`),
Pinterest (`epik`), and Impact/affiliate (`irclickid`). Enable only the networks
you actually advertise on.
#### Form protection
Submissions made under an invalid click session are rejected and logged, with built-
in integrations for **Contact Form 7**, **Gravity Forms**, **WPForms**, **Fluent
Forms**, **Elementor Forms**, and **Forminator**. Each one can be switched on or
off individually, and the rejection message is yours to write.
#### Gating your own tracking
In PHP:
```
if ( function_exists( 'click_guardian_can_track' ) && click_guardian_can_track() ) {
// Print or enqueue your conversion tag here.
}
```
In JavaScript:
```
window.ClickGuardian.whenTrackable( function () {
// Fire your conversion event here.
} );
```
Both answer “yes” when the plugin is deactivated, so a gated tag can never be silently
lost.
#### Reporting
A dashboard with status counters and a 30-day activity chart; a searchable, filterable
record of every click with its score and full visit history; a grouped event log;
CSV export; and a diagnostics screen showing exactly what the plugin is configured
to do and what it can see.
#### Privacy
IP addresses and user agents are stored as a salted, one-way SHA-256 hash – enough
to recognise the same visitor reusing a click, impossible to reverse. Storing readable
IP addresses alongside the hash is a separate setting you can leave switched off;
if you turn it on, disclose it in your privacy policy. The plugin’s own click-fraud
detection makes no external requests and sends no data anywhere outside your own
site.
### External services
This plugin’s own fraud-detection engine makes no external requests. It has one
optional, off-by-default feature that does: **Print Snippets For Me**, under Settings
Tracking IDs. It exists only for sites with no tag manager already installed; when
enabled, it loads the tracking scripts for the ad network IDs you enter, gated behind
the same click-validity check the rest of the plugin uses. No account is created
and no data is sent to these services by the plugin itself beyond loading the script
you asked for; whatever that script then does is between your site and the ad network,
governed by that network’s own terms.
* **Google (Google Tag Manager, gtag.js, Google Analytics/GA4, Google Ads)** –
loads `googletagmanager.com/gtm.js` and/or `googletagmanager.com/gtag/js` when
a GTM container ID, GA4 measurement ID, or Google Ads conversion ID is entered
and this feature is enabled. Sent when: on every page load where tracking is
allowed. [Google Terms of Service](https://policies.google.com/terms), [Google Privacy Policy](https://policies.google.com/privacy).
* **Microsoft Advertising (Microsoft/Bing UET)** – loads `bat.bing.com/bat.js`
when a UET tag ID is entered and this feature is enabled. Sent when: on every
page load where tracking is allowed. [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement),
[Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement).
* **Meta (Meta Pixel)** – loads `connect.facebook.net/en_US/fbevents.js` and sends
a PageView event when a Pixel ID is entered and this feature is enabled. Sent
when: on every page load where tracking is allowed. [Meta Terms of Service](https://www.facebook.com/legal/terms),
[Meta Privacy Policy](https://www.facebook.com/privacy/policy/).
If you already have any of these tags installed through a tag manager or another
plugin, leave **Print Snippets For Me** off and gate your existing tags with `click_guardian_can_track()`
instead – see “Gating your own tracking” above.
## Installation
1. Install through **Plugins Add New**, or upload the plugin folder to `/wp-content/
plugins/`.
2. Activate it through the **Plugins** screen.
3. Go to **Vetraclix Settings** and tick the ad networks you advertise on under **
Detection**.
4. Under **Protection**, choose an expiration window. Twelve hours suits most lead-
generation campaigns.
5. Gate your existing tracking tags with `click_guardian_can_track()`, or turn on **
Print Snippets For Me** under **Tracking IDs** if you have no tag manager yet.
Nothing else is required. Sensible defaults are applied on activation.
## FAQ
### Will this block real visitors?
No. A visitor with no ad click identifier in their session – all organic, direct,
referral and social traffic – is never touched. Only a session that arrived from
a paid click can ever be gated, and then only once that click has expired or looks
reused.
### Does this replace Google Ads conversion tracking?
No. It controls _when_ your existing tags are allowed to fire. It does not replace
Google Tag Manager, GA4, or your conversion tags, and it never sends data to Google
on your behalf.
### I already have Google Tag Manager. Should I use the built-in snippets?
No – leave **Print Snippets For Me** switched off. It exists for sites with no tag
manager at all. If you already have tags installed, printing a second copy would
double-count every pageview. Gate your existing tags with `click_guardian_can_track()`
instead.
### What does single-use mode do?
A click identifier is valid only for its very first visit. If the same value appears
in a URL again – from the same visitor or anyone else – it is immediately expired.
This is the strictest setting, and suits businesses that want every click to be
strictly one-time.
### Do I need Cloudflare?
No. A CDN or WAF is detected automatically when present and its headers are used
for more accurate IP and country data, at no extra cost. Cloudflare, Amazon CloudFront,
Fastly, Sucuri and Akamai are recognised out of the box, and a filter lets you add
others. Sites with no CDN work normally; they simply have no country data.
### Will my own clicks be recorded while I test?
Not if you are signed in. **Ignore Signed-in Users** is on by default, precisely
because site owners and agencies click their own ads far more often than they expect.
### Can I try it without affecting visitors?
Yes. Turn **Enable Click Blocking** off under **Protection**. Clicks are still captured,
scored and reported, but no visitor is ever interrupted and no tracking is withheld.
Run it that way for a week, look at the records, then decide.
### Can my agency see the reports without being an administrator?
Yes. Change **Required Capability** under **Advanced** to a capability their role
holds.
### Does it make my site slower?
No measurable amount. Capture is one indexed database query on a paid-click landing,
and nothing at all for organic traffic. There are no external HTTP requests during
a page load, and the admin assets load only on the plugin’s own screens.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking” is open source
software. The following people have contributed to this plugin.
Contributors
* [ Muhammad Arfa Rehman ](https://profiles.wordpress.org/arfarehman/)
[Translate “Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking” into your language.](https://translate.wordpress.org/projects/wp-plugins/vetraclix-for-google-ads)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/vetraclix-for-google-ads/),
check out the [SVN repository](https://plugins.svn.wordpress.org/vetraclix-for-google-ads/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/vetraclix-for-google-ads/)
by [RSS](https://plugins.trac.wordpress.org/log/vetraclix-for-google-ads/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.2
* The optional managed-snippets feature (Google Tag Manager, gtag.js, Microsoft
UET, Meta Pixel) now loads through `wp_enqueue_script()` instead of printed `