{"id":328136,"date":"2026-06-28T23:09:12","date_gmt":"2026-06-28T23:09:12","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/rankshield-ranking-ad-spend-attack-protection\/"},"modified":"2026-06-30T01:01:41","modified_gmt":"2026-06-30T01:01:41","slug":"rankshield-ranking-ad-spend-attack-protection","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/rankshield-ranking-ad-spend-attack-protection\/","author":23518691,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"2.6.1","stable_tag":"2.6.1","tested":"7.0","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"RankShield \u2014 Ranking & Ad-Spend Attack Protection","header_author":"SEO Elite Agency","header_description":"Protects your Google rankings from CTR manipulation bot attacks. AI-powered defense network.","assets_banners_color":"0c1015","last_updated":"2026-06-30 01:01:41","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/rankshield.seoeliteagency.com","header_author_uri":"https:\/\/seoeliteagency.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":179,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"2.3.0":{"tag":"2.3.0","author":"rankshield","date":"2026-06-28 23:08:36"},"2.3.1":{"tag":"2.3.1","author":"rankshield","date":"2026-06-28 23:56:47"},"2.3.2":{"tag":"2.3.2","author":"rankshield","date":"2026-06-29 00:11:07"},"2.3.3":{"tag":"2.3.3","author":"rankshield","date":"2026-06-29 15:10:05"},"2.4.0":{"tag":"2.4.0","author":"rankshield","date":"2026-06-29 18:35:01"},"2.4.1":{"tag":"2.4.1","author":"rankshield","date":"2026-06-29 18:56:52"},"2.4.2":{"tag":"2.4.2","author":"rankshield","date":"2026-06-29 21:09:13"},"2.5.0":{"tag":"2.5.0","author":"rankshield","date":"2026-06-29 21:46:14"},"2.5.1":{"tag":"2.5.1","author":"rankshield","date":"2026-06-29 22:07:28"},"2.6.0":{"tag":"2.6.0","author":"rankshield","date":"2026-06-30 00:38:51"},"2.6.1":{"tag":"2.6.1","author":"rankshield","date":"2026-06-30 01:01:41"}},"upgrade_notice":{"2.3.0":"<p>Code-quality + performance fixes for WordPress.org review (asset loading and caching). Recommended for all users.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3589318,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3589318,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3589318,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3589318,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","2.4.1","2.4.2","2.5.0","2.5.1","2.6.0","2.6.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The RankShield dashboard \u2014 live protection status and threats stopped.","2":"Live Traffic \u2014 attack vectors, top attacking networks, and recent blocked activity.","3":"Ad Protection \u2014 click-fraud stats and the copyable IP exclusion list.","4":"Connections \u2014 link Google Search Console, Analytics, and Ads in one click (read-only)."}},"plugin_section":[],"plugin_tags":[149009,166108,4270,600,186],"plugin_category":[54,55],"plugin_contributors":[269340],"plugin_business_model":[],"class_list":["post-328136","plugin","type-plugin","status-publish","hentry","plugin_tags-ad-fraud","plugin_tags-bot-protection","plugin_tags-click-fraud","plugin_tags-security","plugin_tags-seo","plugin_category-security-and-spam-protection","plugin_category-seo-and-marketing","plugin_contributors-rankshield","plugin_committers-rankshield"],"banners":{"banner":"https:\/\/ps.w.org\/rankshield-ranking-ad-spend-attack-protection\/assets\/banner-772x250.png?rev=3589318","banner_2x":"https:\/\/ps.w.org\/rankshield-ranking-ad-spend-attack-protection\/assets\/banner-1544x500.png?rev=3589318","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/rankshield-ranking-ad-spend-attack-protection\/assets\/icon-128x128.png?rev=3589318","icon_2x":"https:\/\/ps.w.org\/rankshield-ranking-ad-spend-attack-protection\/assets\/icon-256x256.png?rev=3589318","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>RankShield defends your site against the bot attacks that quietly damage your search rankings and waste your ad spend:<\/p>\n\n<ul>\n<li><strong>CTR manipulation &amp; sitemap-sweep attacks<\/strong> \u2014 bots that pull your sitemap and run your pages through fake impressions and fast click-and-bounce sessions to poison Google's engagement signals.<\/li>\n<li><strong>Ad click fraud<\/strong> \u2014 bots and competitors clicking your Google Search Ads to drain your budget. RankShield ties on-site behavior to each paid click and builds a ready-to-apply IP exclusion list for your ads team.<\/li>\n<li><strong>Real-customer safety first<\/strong> \u2014 flagged traffic gets a one-second JavaScript challenge, never a hard block. Logged-in users and visitors who already passed are never challenged. Shared\/residential networks are never auto-excluded.<\/li>\n<\/ul>\n\n<p>A live security dashboard shows protection status, threats stopped, the per-URL attack story, and your ad click-fraud overview.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to the RankShield protection service (an external SaaS operated by SEO Elite Agency) to detect and block attacks. Detection and threat intelligence run on the RankShield servers; the plugin enforces the decisions on your site.<\/p>\n\n<p><strong>Service:<\/strong> RankShield API \u2014 https:\/\/sea-shield-production.up.railway.app<\/p>\n\n<p><strong>What is sent, and when:<\/strong>\n* On each page view, the plugin sends anonymized behavioral signals (time on page, mouse\/scroll\/keystroke counts, a bot score, the request URL\/path, and \u2014 for visitors arriving from a paid ad \u2014 the ad click identifier such as gclid) so attacks can be scored. The visitor's IP is read server-side for attribution and is never exposed in the browser.\n* Periodically, the plugin requests the current block rules and your protection dashboard data using your site's API key.\n* When an attack is confirmed on your site, the attacker's network indicator (e.g. IP \/ IP range) is contributed to the RankShield Network (RankShield's shared threat-intelligence network) so other protected sites can be defended \u2014 this is how the network protects everyone. Paid plans additionally receive the full RankShield Network feed for instant immunity.\n* Your API key is used to authenticate these requests and is never exposed to the public front-end.<\/p>\n\n<p>This service is required for the plugin to function. By installing and activating the plugin you agree to the RankShield Terms of Service and Privacy Policy:\n* Terms of Service: https:\/\/portal.seoeliteagency.com\/terms\n* Privacy Policy: https:\/\/portal.seoeliteagency.com\/privacy<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Open <strong>RankShield \u2192 Dashboard<\/strong> and click <strong>Activate free protection<\/strong> \u2014 no account or payment required. (If you have a paid plan, paste your API key instead.)<\/li>\n<li>Protection begins immediately. Open <strong>RankShield \u2192 Dashboard<\/strong> to see live status.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20paid%20account%3F\"><h3>Do I need a paid account?<\/h3><\/dt>\n<dd><p>No. The plugin is fully functional for free: it detects and actively blocks\/challenges attacks on your site using the RankShield service's threat decisions. A paid RankShield subscription expands the <em>service<\/em> \u2014 the full RankShield Network (instant immunity from attackers confirmed on any other protected site), Google Search Ads click-fraud IP exclusions, and advanced reporting \u2014 all of which are processed on the RankShield servers.<\/p><\/dd>\n<dt id=\"will%20it%20block%20my%20real%20customers%3F\"><h3>Will it block my real customers?<\/h3><\/dt>\n<dd><p>No. RankShield uses a one-second JavaScript challenge instead of hard blocks, never challenges logged-in or already-verified visitors, and never auto-excludes shared\/residential networks. Clicks that convert are always treated as real customers.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20cloudflare%3F\"><h3>Does it work without Cloudflare?<\/h3><\/dt>\n<dd><p>Yes. The plugin is fully standalone; an optional Cloudflare edge worker is a bonus, not a requirement.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>2.6.1<\/h4>\n\n<ul>\n<li>Two plans: Full Protection actively blocks bot ad-clicks and spoofed AI agents in real time; Monitoring shows you every threat and all your analytics without active blocking. (Existing protected sites are unchanged.)<\/li>\n<\/ul>\n\n<h4>2.6.0<\/h4>\n\n<ul>\n<li>New SEO dashboard: a full agency-grade Search Console report \u2014 clicks\/impressions\/CTR\/position with period-over-period change, a 90-day trend, your biggest ranking winners and drops, \"striking distance\" keywords (quick wins), CTR opportunities, ranking distribution, top keywords and pages, plus devices and countries.<\/li>\n<li>The console now uses the full screen width.<\/li>\n<\/ul>\n\n<h4>2.5.1<\/h4>\n\n<ul>\n<li>Real Google Ads spend: the dashboard now shows your actual ad spend, clicks, and average CPC for the month \u2014 pulled live from your linked Google Analytics property, no extra setup. (If your Google Ads account isn't linked to Analytics yet, the dashboard shows the one-time step to enable it.)<\/li>\n<\/ul>\n\n<h4>2.5.0<\/h4>\n\n<ul>\n<li>New \"Ad spend protected\" figure and a real-time bot &amp; AI-agent defense panel on the dashboard \u2014 see datacenter ad-bot clicks challenged, spoofed AI agents blocked, and verified agents allowed, all in dollars and counts.<\/li>\n<li>One-click, zero-configuration setup: activate free protection and everything turns on automatically \u2014 no account, no settings.<\/li>\n<\/ul>\n\n<h4>2.4.2<\/h4>\n\n<ul>\n<li>Real-time ad-fraud defense: a paid-ad click (gclid\/wbraid\/msclkid) arriving from datacenter\/cloud space is challenged the moment it lands \u2014 a real person passes the one-second check, a bot never reaches your page or wastes the click. Apple iCloud Private Relay and Cloudflare WARP users are exempt, so real customers are never affected.<\/li>\n<\/ul>\n\n<h4>2.4.1<\/h4>\n\n<ul>\n<li>AI-agent defense now verifies agents against each operator's own official published IP ranges (delivered by the RankShield Network), in addition to reverse DNS \u2014 so agents that publish IP lists are accurately told apart from impersonators.<\/li>\n<\/ul>\n\n<h4>2.4.0<\/h4>\n\n<ul>\n<li>AI-agent defense: the firewall now tells real AI agents apart from impersonators. Verified agents (confirmed by reverse DNS) pass through untouched; bots spoofing a known AI agent get the one-second verification challenge. No effect on normal visitors.<\/li>\n<\/ul>\n\n<h4>2.3.3<\/h4>\n\n<ul>\n<li>Google Analytics 4: once connected, the dashboard now shows a live Audience panel \u2014 90-day sessions, users, pageviews, engagement rate, a sessions-over-time chart, and your top traffic channels.<\/li>\n<\/ul>\n\n<h4>2.3.2<\/h4>\n\n<ul>\n<li>Google Search Console: once connected, the dashboard now shows a live Search performance panel \u2014 90-day clicks, impressions, CTR, average position, a clicks-over-time chart, and your top-ranking keywords.<\/li>\n<\/ul>\n\n<h4>2.3.1<\/h4>\n\n<ul>\n<li>Dashboard now shows a 30-day \"threats stopped\" trend chart so you can see your protection at a glance.<\/li>\n<\/ul>\n\n<h4>2.3.0<\/h4>\n\n<ul>\n<li>Verify-challenge page now loads its CSS\/JS through the WordPress enqueue system (wp_register\/enqueue_style\/script) instead of hardcoded tags.<\/li>\n<li>Decision dedupe uses the object cache instead of transients (no wp_options row growth under heavy bot traffic).<\/li>\n<\/ul>\n\n<h4>2.2.0<\/h4>\n\n<ul>\n<li>Wordfence-style security console: Dashboard, Live Traffic, and Ad Protection sections.<\/li>\n<li>Ad click-fraud protection with a copyable, ready-to-apply IP exclusion list.<\/li>\n<\/ul>","raw_excerpt":"Protect your Google rankings and ad budget from bot-driven CTR manipulation, sitemap-sweep attacks, and pay-per-click ad fraud.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/328136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=328136"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/rankshield"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=328136"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=328136"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=328136"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=328136"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=328136"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=328136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}