Click fraud glossary

This glossary collects the terms you meet when you look into click fraud, traffic quality and protecting an ad budget. The distinctions matter: flagging a visit as suspicious, blocking it on your site, excluding it from an ad platform and getting a credit are four different things.

Click fraud

Deliberately generating clicks on paid ads that don't come from real interest, through automation or organised activity. The aim can be to drain a budget, distort data or earn money from fake engagement.

Fake clicks, malicious clicks

Everyday names for click fraud. Ask what the speaker actually means: a bot, deliberate human activity, an accidental click or simply a visit that didn't convert. A missing sale is not proof of fraud.

Invalid traffic (IVT)

A broad term for activity that doesn't reflect genuine interest. It covers deliberate fraud as well as accidental and duplicate activity. Google sets out its definition of invalid traffic.

GIVT and SIVT

The Media Rating Council's invalid traffic guidelines split IVT in two. General invalid traffic (GIVT) can be caught with routine filtering, such as known crawlers and datacenter traffic. Sophisticated invalid traffic (SIVT) takes more analysis to detect, such as bots built to look like people.

Invalid clicks

Clicks an ad platform judges invalid by its own criteria. In Google Ads they appear in the Invalid clicks column and aren't charged. That number won't necessarily match what a third-party tool flags as suspicious.

Bot

Software that performs automated actions. Some bots are harmful; others do legitimate work such as monitoring and indexing. Detected automation is a signal to read in context, not another word for fraud.

Crawler

Software that fetches pages, for example to index them or build a link preview. Protection has to tell a legitimate crawler from an impersonator. AdProtektor whitelists verified crawlers such as Googlebot and never blocks them.

Click farm

Organised activity that produces clicks or engagement to order, using people, devices or automation. Activity from a real device can still be commercially fake.

IP address and IP exclusion

An IP address identifies a network connection, not necessarily one person. An IP exclusion asks an ad platform not to show ads to an address, within the limits the platform supports. Google explains how IP exclusions work. See also how to spend Google's 500 slots.

Residential proxy

Routing traffic through an address that looks like a home connection. It makes an address alone less reliable to judge by, but using a proxy doesn't prove bad intent.

Fingerprinting

Combining device and browser traits such as canvas, audio, GPU and TLS. In AdProtektor these signals are collected as evidence of fraud (hardware that changes under one visitor id is a signal), but they don't define who a visitor is, and a fingerprint is not a certain personal identifier.

Person-based detection

In AdProtektor, a person is one browser on one device: the server issues each browser a persistent visitor identity that survives IP changes, so repeat clicks from a changing address stay on one record. Clearing site data resets the identity, and another browser or device is another person. There is no cross-device claim. How it differs from IP blocking.

Click-frequency rules and time windows

A policy you set, such as how many qualifying ad clicks one visitor may make within a time window. AdProtektor's click-frequency rules for Google Ads act automatically when the limit you set is exceeded.

AI analysis versus enforcement

Analysis gives a classification and an explanation; enforcement takes an action such as a block. On eligible AdProtektor plans you choose separately whether AI analysis influences click blocking or site access.

Custom audience exclusion

An audience set to be excluded from an ad set. On Meta, AdProtektor keeps an audience of eligible blocked people up to date with a periodic sync; Meta's own matching and processing decide how it takes effect.

Whitelist

A setting that lets a source you trust through. It sits alongside unblocking and rule changes as a way to correct and manage protection.

False positive

A legitimate visit flagged as suspicious or blocked. That is why confidence thresholds, behavioural context, an audit trail and the ability to reverse a decision matter.

Session replay

A reconstruction of what happened during a visit. Whether a recording exists depends on settings, collection and the retention period. It can support an investigation but doesn't prove who the visitor was. Disclose session recording in your site's privacy notice where the law requires it.

Server-side conversion tracking

Collecting or sending conversion events through a server instead of only the browser. ConversionOS supports several connection paths and sends to the destinations you configure. Capturing an event, the platform accepting it and the platform attributing it to a campaign are separate steps.

Click bombing

A concentrated burst of repeat clicks. The name describes a pattern; telling an attack from real demand means checking where the visits came from, their timing and what they did on the site.

Competitor clicks

Clicks meant to hurt a competitor's budget. Classifying a pattern as suspicious can justify protection, but it doesn't prove the identity of a particular business or person. More on competitor click fraud.

VPN

A connection that routes traffic through another server and can change the address a site sees. VPNs have many legitimate uses, so one alone is not enough evidence of fraud.

Threat score

A number that sums up risk signals according to the detection model. In AdProtektor it runs from 0 to 100. A high score can support a decision, but it is not a percentage certainty that the visitor is an attacker; your settings decide which actions it may trigger.

Tracking template

A URL setting used to track ad clicks. A tracking template is not in itself a guarantee against being charged or a way to block every visit; check what your implementation supports.

Manager account (MCC)

A Google Ads account that manages and links other accounts through permissions. Connecting Google Ads to AdProtektor uses a link request that you accept in your own account.

Search partners and the Display Network

Different places Google can show your ads. Judge each one by the quality and conversions of its traffic against your campaign goals; where a visit came from doesn't make it fraudulent. How to check search partners.

Google click identifier (GCLID)

A parameter Google's systems use to tie an ad click to measurement. It helps tracking and attribution; it is not the user's name or proof of who they are.

Conversions API (CAPI)

Meta's interface for sending events from a server. A successful send shows the delivery step worked; it doesn't guarantee attribution to a particular campaign or that reports will match exactly.

Lookalike audience

An audience built from traits similar to a source audience. Which events feed the source, and how clean they are, shapes what the lookalike finds.

Cost per click (CPC)

Cost divided by the number of clicks in the relevant measurement. Compare the same kind of click, currency and period for the number to be useful.

Click-through rate (CTR)

Clicks divided by impressions, as a percentage. A rise can come from a better ad or a change in traffic; it is not a diagnosis of fraud.

Conversion rate

Conversions divided by the base you chose, such as clicks or visits. Define what a conversion is and what the denominator is before comparing reports.

Pay-per-click (PPC)

An advertising model where the billing unit is a click. Not every digital campaign bills the same way, so check what your account actually measures and charges for.

For the whole process, continue to what click fraud is, the Google Ads protection checklist or the 10-minute click audit.