Everything the industry talks about in plain language. Each term comes with why it matters for paid search and how MyClickShield handles it on your account.
Most-searched terms
Start here if you're new to click-fraud terminology.
Any deceptive practice that artificially inflates ad metrics — impressions, clicks, or conversions — to extract revenue from advertisers without delivering genuine engagement.
Why it matters for PPC
Ad fraud is the umbrella over click fraud, impression fraud, and conversion fraud. Industry estimates put global ad fraud losses in the $80B+/year range.
How MyClickShield handles this
MCS focuses on the click-and-conversion side: blocking fraudulent traffic before it costs you and reporting suspicious patterns through your dashboard.
Web traffic generated by automated software (scrapers, crawlers, ad-fraud bots, attack tooling) rather than real humans.
Why it matters for PPC
Not all bots are click-fraud bots — some are scraping your prices or inflating analytics — but on paid ads, every bot click is wasted spend.
How MyClickShield handles this
MCS classifies every visitor and blocks known and unknown bots from clicking ads or hitting key conversion paths. Good bots (Googlebot, etc.) are kept allow-listed.
Meta's server-side API for sending conversion events directly from your servers to Meta, replacing or complementing the browser-side Pixel.
Why it matters for PPC
CAPI events are harder to spoof than Pixel-only events, but if your CAPI source isn't filtering invalid traffic, fraudulent conversions still get attributed.
How MyClickShield handles this
MCS's Pixel Guard integrates with CAPI — fraudulent conversions are filtered server-side before they reach Meta, keeping your CAPI data clean.
An organized group of low-paid workers (often on cheap mobile devices) hired to click paid ads, like buttons, or app installs at scale.
Why it matters for PPC
Click farms produce traffic that looks human (real IPs, real devices, real touch events) and is one of the hardest categories to detect.
How MyClickShield handles this
MCS catches click farms via device repetition, geo-velocity, and behavioral patterns — even when individual clicks look genuine, the aggregate signal exposes the farm.
The practice of clicking on pay-per-click ads without genuine interest, done by bots, competitors, click farms, or disgruntled users to drain ad budgets or generate fake publisher revenue.
Why it matters for PPC
Every fraudulent click is real money out of your campaign — Google's built-in invalid-click filter catches the obvious ones but misses the sophisticated patterns.
How MyClickShield handles this
MCS detects click fraud in real time and excludes the source IP from your campaigns within seconds, across Google, Meta, and Microsoft Ads.
The amount an advertiser pays each time a user clicks their ad. Calculated as total ad spend ÷ total clicks.
Why it matters for PPC
High CPCs in competitive verticals (legal, insurance, B2B SaaS) mean each fraudulent click can cost $30–$100+. The CPC math is what makes click fraud expensive.
A technique to identify a unique device by combining browser attributes (user agent, plugins, screen resolution, fonts, timezone, canvas hash, etc.) into a stable hash.
Why it matters for PPC
IPs change; device fingerprints don't. Fingerprinting catches the same fraudster across IP rotations and VPNs.
How MyClickShield handles this
MCS uses a multi-signal fingerprint that survives IP changes, browser updates, and most consumer-grade fingerprint-spoofing tools.
Google Click Identifier — the query-string token (gclid=...) appended to ads and landing-page URLs to attribute clicks to specific Google Ads campaigns.
Why it matters for PPC
GCLID is the link between Google's click and your server data. Every fraudulent GCLID hit costs you the auction price.
How MyClickShield handles this
MCS parses and deduplicates GCLIDs on every hit, scoring each visitor and reporting fraudulent GCLIDs back to Google Ads via API exclusion.
Inflating ad impression counts using bots or hidden ad slots, so that CPM-based campaigns or publisher revenue gets paid out for views that never reached a human.
Why it matters for PPC
Mainly a display/CPM problem rather than CPC, but matters for brand campaigns where impressions drive billing.
IAB/MRC-standardized term covering any traffic that shouldn't be billable — bots, fraudulent clicks, duplicate hits, or accidental clicks. Subdivided into GIVT (General) and SIVT (Sophisticated).
Why it matters for PPC
IVT is the industry standard everyone (Google, Meta, MRC auditors) refers to. Knowing GIVT vs SIVT helps you read fraud reports correctly.
How MyClickShield handles this
MCS reports follow the IAB/MRC taxonomy so your audit teams and ad-platform reps can speak the same language.
Adding specific IP addresses (or ranges) to an ad platform's exclusion list so ads no longer serve to those addresses.
Why it matters for PPC
Google Ads, Microsoft Ads, and Meta all support IP-exclusion lists with limits (e.g. Google caps at ~500). Manual maintenance doesn't scale.
How MyClickShield handles this
MCS automates IP-exclusion list management across all three platforms — adding, rotating out, and pruning IPs to stay under the platform cap while maximizing protection.
Google's automated campaign type that uses Google AI to place ads across all Google inventory (Search, Display, YouTube, Discover, Gmail, Maps) from a single asset group.
Why it matters for PPC
PMAX mixes traffic sources opaquely, which makes fraud detection harder — you often can't see which placement produced an invalid click.
How MyClickShield handles this
MCS treats every PMAX click the same way: real-time scoring + exclusion happen regardless of placement opacity. Your reporting shows PMAX-specific fraud rates.
Meta's JavaScript snippet that fires conversion and pageview events from a browser back to Meta's ad platform for attribution and optimization.
Why it matters for PPC
Fraudulent pixel hits poison your Lookalike Audiences and Advantage+ optimization, costing you not just the click but every future campaign that learns from bad data.
How MyClickShield handles this
MCS's Pixel Guard filters fraudulent pixel events before they reach Meta, so your audiences and automated bidding train on clean data.
Google's 1–10 metric estimating ad and keyword quality based on CTR, ad relevance, and landing-page experience.
Why it matters for PPC
High invalid-click rates can indirectly hurt Quality Score by tanking actual CTR and conversion data. Cleaner traffic = better Quality Score over time.
How MyClickShield handles this
By keeping fraudulent clicks out, MCS protects the conversion-rate signal Google uses for Quality Score — without ever interfering with the bidding itself.
Return on Ad Spend — revenue generated for every dollar of ad spend. ROAS of 4 means $4 of revenue per $1 spent.
Why it matters for PPC
ROAS is the single most-watched metric for paid acquisition. Click fraud inflates spend without revenue, dragging ROAS down without an obvious culprit.
Google's machine-learning automated bid strategies (Target CPA, Target ROAS, Maximize Conversions) that adjust bids per auction based on conversion signals.
Why it matters for PPC
Smart Bidding learns from your conversion data. If fraudulent conversions feed in, the algorithm will bid up on the wrong audiences.
How MyClickShield handles this
MCS blocks fraudulent clicks before they reach your conversion funnel, so Smart Bidding trains on clean signals only.
The rightmost portion of a domain (.com, .io, .xyz, .ru, etc.). Used as a signal in fraud scoring — some TLDs disproportionately host abuse.
Why it matters for PPC
Referrer TLD is one of many passive signals fraud-scoring engines use. By itself it means little, but in combination with other signals it adds risk weight.
Identifying traffic coming through commercial VPN services, residential proxy networks, or anonymization tools like Tor.
Why it matters for PPC
Not all VPN users are fraudsters, but commercial VPN/proxy ranges disproportionately produce fraud. Detection enables nuanced policies (allow, flag, or block).
How MyClickShield handles this
MCS maintains a live database of VPN, datacenter, and residential-proxy ranges, scoring each visitor and letting you set platform-specific policies.
A tiny tracking script or transparent image embedded in a page that fires a request to a tracking server when loaded — used to log visits.
Why it matters for PPC
MCS uses a lightweight beacon on your site to score every visitor in real time. Understanding beacons helps when reviewing your privacy policy and sub-processors.
Common questions on the terms above and how they relate.
Invalid traffic (IVT) is the broad industry-standard category — any clicks or impressions that shouldn't be billable. Click fraud is a subset: it specifically refers to fraudulent clicks done with intent (by bots, competitors, or click farms). Google and Meta use the IVT term in their reports; the public uses "click fraud" more often.
No. Bot traffic is any non-human web traffic, including legitimate bots (Googlebot, Bing crawler) and unwanted bots (scrapers, spam bots). Click fraud is the subset of bot traffic that clicks ads. A bot crawling your site for SEO isn't click fraud, but a bot clicking your Google ad is.
They solve different problems. Ad-click protection stops fraudulent clicks before they cost you ad budget. Bot mitigation protects your forms, login pages, checkout, and content from automated abuse. Most customers start with ad protection and add bot mitigation when scraping or form-spam becomes a problem.
Google appends gclid=... as a query parameter when someone clicks your ad. A real example: https://yoursite.com/landing?gclid=EAIaIQobChMI8Y_OoMqB-AIV. The gclid is unique per click and lets Google attribute conversions back to the originating ad. MCS uses GCLIDs as one of many signals when scoring traffic.
No. Plenty of legitimate users (remote workers, privacy-conscious consumers, journalists) use VPNs. The right approach is risk-based: flag VPN traffic, score it against other signals, and act on the combined signal. MCS lets you set per-platform policies (e.g. block on Google Ads, flag-only on Meta).
Yes. Attribution to MyClickShield is appreciated but not required. The DefinedTerm structured data on this page is intentionally crawler-friendly so AI search engines and knowledge panels can pick up individual definitions.
See these terms in action.
Run a free 3-second fraud scan on your domain. We'll show you the signals that actually matter — invalid traffic, bot scores, VPN/proxy detection — with no signup.
An ad click, website visit and conversion describe different events. Knowing how each report counts them helps you compare results, investigate a discrepancy and explain the findings to someone else.
Read moreRead less
Use the same dates and check each report's definitions before comparing totals. If the numbers still differ, look at redirects, consent settings, reporting delays and the actions that trigger your conversions.
What is the difference between a click, a visit and a conversion?
A click is an interaction recorded by the advertising platform. A website visit is recorded after someone reaches your site, using the rules of the tracking tool. A conversion is the action your business has chosen to count, such as a submitted enquiry or paid order. These numbers can differ because someone clicks more than once, leaves before the page loads or returns later to buy.
A flagged visit also needs an explanation. It means the protection system identified something to review or act on under your settings. Check the reasons and action status before describing the visit as a confirmed financial loss. When comparing reports, use the same dates and check how each system defines its totals. If one counts all website activity while another counts paid clicks, a direct percentage comparison can mislead. Knowing what each term means makes it easier to ask support a precise question and explain campaign results to a colleague.
Ad click → Website visit → Customer action.
Where do visitors drop out after clicking your ad?
A customer can click an ad, browse your site and return tomorrow to buy. They might also call you instead of completing a form. When you compare clicks with sales, allow for the way people actually buy from you. For a plumber, answered calls may matter most. For a shop, start with paid orders. For a software company, look at demos attended as well as forms submitted.
Choose one campaign and follow its visitors through the landing page and the next step. If many clicks never become recorded visits, check redirects, loading errors and tracking consent. If people reach the page but leave at checkout, test delivery options and payment. If enquiries arrive but your team cannot reach anyone, inspect those submissions and their associated visits. Working through these stages helps you find the point that needs attention before changing a campaign that may be attracting the right customers.
Ad clicked → Page reached → Enquiry or order.
Why do ad clicks and website visits show different totals?
Your advertising account and website analytics count different things. A visitor can click twice during one session, leave before a slow page loads or decline analytics cookies. A redirect can also remove campaign parameters. Start by checking these possibilities when the numbers do not match; the difference alone cannot tell you how many clicks were fraudulent.
Use the same date range and time zone in both reports. Check that you selected the same campaign and landing page, and allow for reporting delays. Open the actual destination URL and follow any redirects to see whether its campaign information is kept. If an enquiry becomes a sale several days later, include that delay when reviewing results. For recurring discrepancies, save a specific example with the click time and destination. It will give the person maintaining your tracking a much clearer starting point than a screenshot of two unexplained totals.
Click recorded → Visit recorded → Dates and filters matched.
How can you tell why a visit was flagged?
Open an example flagged visit and check when it happened, which campaign brought it and what the visitor did. Several visits from one address may deserve a closer look, but offices and mobile networks can share addresses. A customer researching a costly purchase may also return repeatedly. The visit's timing and behaviour help you judge whether the flag makes sense.
Then check what happened after the flag. Was the visit recorded for review? Was access restricted on the website? Was an available action sent to an advertising account? Check the status shown for your setup. If you cannot explain a particular decision, save its date, campaign and record details for support. Looking closely at a few examples is a useful way to learn the dashboard, spot a configuration problem and decide whether a rule needs adjusting before you apply it more widely.
Visit details → Reason for the flag → Action taken.
What happens after a suspicious click is detected?
There are several possible responses to a suspicious visit. The system can record it for review, apply a supported website action or send an available exclusion to a connected advertising account. The option depends on the integration and campaign. Check which response your setup uses before judging the result from a dashboard total.
A website block happens after a visitor has reached your site. It cannot undo the original ad click. An advertising exclusion is intended to affect later ad delivery, subject to that platform's rules. Check whether the action was applied successfully and whether the account connection needs attention. If you manage Google, Meta and Microsoft campaigns, review each connection separately; their controls differ. For an unresolved case, give support the campaign type, approximate time and action status. Those details make it easier to find out whether you need to adjust a setting, reconnect an account or investigate the visit further.
Visit flagged → Response selected → Status checked.
How to investigate a sudden increase in ad clicks
Suppose a campaign suddenly receives more clicks without more enquiries. Before investigating, you only know that costs have risen. Pausing the campaign may stop the spending, but it can also stop genuine customers reaching you. Start by noting the affected dates and checking whether you changed the budget, targeting, offer or landing page around that time.
Next, inspect the traffic source and a few visits from the affected period. Test the enquiry form yourself. If you find a page problem, repair it. If a particular group of visits looks suspicious, review the available protection settings for that campaign and record the change you make. Afterwards, watch both the suspicious activity and genuine enquiries. This before-and-after example shows how to narrow the response. To assess your own result, compare similar days and keep other campaign changes in the record so you can see what helped.
Before: rising clicks → Check the cause → After: targeted action.
Where can you check invalid clicks in Google Ads?
Google Ads has its own systems for identifying invalid traffic. Its invalid-click reporting and billing adjustments are useful starting points when you suspect a problem. Compare the affected campaign and dates with the visits recorded on your website. Some activity may already have been filtered from charges, so check the account before treating every flagged website visit as money lost.
Look for a repeatable pattern you can describe: a particular campaign, time period or group of visits. Save the relevant details if you need to request an investigation. Check which exclusions are available for that campaign type and how they are applied in your connected account. Search and Performance Max do not necessarily offer the same controls. If you are unsure which action is supported, use the current Google documentation and ask about your specific campaign. That gives you a clearer next step than adding broad exclusions based only on a high click count.
Google Ads report → Billing adjustments → Visits to inspect.
What do low-quality clicks mean in Microsoft Advertising?
Microsoft Advertising reports low-quality clicks and identifies activity that is not charged. Read those definitions when comparing its figures with MyClickShield. A suspicious website visit and a low-quality ad click are recorded at different stages, so the totals may differ even when both reports are working correctly.
Select the same dates, time zone and campaign before comparing the numbers. Check the network and source of the traffic that concerns you. For a local service business, also ask whether the resulting enquiries come from areas you actually serve. Poor targeting can produce unsuitable calls without fraudulent activity. If you decide to use an available exclusion, confirm that the correct Microsoft Advertising account is connected and check the action status. Keep a few examples of the visits or enquiries that prompted the change. They make it easier to review the result and to explain a remaining problem to support.
How much money has click protection actually saved?
Start with what you were actually charged and the results your business received. A flagged visit does not automatically equal a paid click. Your advertising platform may already have filtered or credited some invalid activity. Check its reporting and billing adjustments before adding up a claimed saving from the same visits.
For a practical comparison, look at spend per qualified enquiry or paid order before and after the change. Include the subscription fee and the time you spend reviewing traffic. For example, if ten flagged visits are multiplied by a $4 average click price, the resulting $40 is an estimate of possible exposure, not proof of a $40 refund. Keep estimates labelled and explain the calculation. A useful review should show whether your account is producing better-quality enquiries or orders for its overall cost, with promotions, bid changes and other adjustments taken into account.
Start your report with the campaign, dates and question you investigated. For example: enquiries fell after a new placement started sending traffic. Show the change in spend and qualified enquiries, then add a few visits that explain why you investigated that source. Include the action taken and any question that still needs an answer.
If the report goes to a client, explain unfamiliar terms the first time you use them. They should be able to see what happened without interpreting a list of IP addresses. Keep the detailed records available for the person checking the account. Where a change has been made, say when you will review its effect and what you will compare. A short report with a specific follow-up is easier to use in a campaign meeting than a long list of blocked visits with no explanation of how customers or advertising costs were affected.
