Detecting and preventing invalid traffic

Detection is not one test. It is a set of small questions asked at different moments, each of which a real person passes without noticing and a fake one tends to fail somewhere. This lesson explains the questions, when they are asked, and how an operator turns them into a routine.

1. A visit arrives: Every click on a search ad starts as a visit from some device. Most are people; some are scripts, crawlers or hijacked phones. IVT detection is the work of telling them apart.
2. Line 1: easy catches, before the ad: Pre-click filtering checks what can be known instantly: declared bots, data-centre addresses, impossible device details. This routine layer is GIVT. Blocked visits never see an ad, so no advertiser is charged.
3. Deeper signals: Harder cases need more: device fingerprinting to spot one machine posing as many, signs of a headless browser, or a residential proxy hiding the true origin. Visits that pass go on to the page.
4. An ad is clicked and logged: The visitor clicks a sponsored result. The click is recorded with its context: time, device, the query, how long the page had been open, where the pointer or finger was.
5. Line 2: judged after the fact: Post-click analysis looks at what only shows up in bulk: clicks that never convert, identical timing, the same few devices returning. Disguised, deliberate fraud of this kind is SIVT.
6. Invalid clicks are refunded: A click judged invalid is credited back to the advertiser and removed from publisher earnings. A valid click is billed as normal, say $1.00. Two outcomes from the same button press.
7. Each verdict sharpens the filter: Findings roll up into a traffic quality score per source or placement. ClearTrust’s TQI Score™, for example, combines 150+ filters into one number. A publisher who scores its own traffic can cut a bad source before the engine does it for them.

Before the click and after the click

Pre-click filtering and post-click analysis are partners. The first keeps obvious junk away from the feed. The second finds the subtle junk and feeds what it learns back into the first, as a blocklist entry or a new rule.

The families of signal

Good systems score rather than simply block. Each signal adds or removes a little confidence, and the total decides. This matters because every signal has innocent explanations. Plenty of real people use VPNs. Plenty of real people click fast. A rule that blocks on one signal throws away real customers, and a rule that needs every signal to fire lets fraud through.

A prevention routine for operators

1. Know your baselineRecord normal values for your clean traffic: Lander CTR, Ad CTR, share of mobile, hour-of-day curve, deduction rate. Fraud is only visible as a departure from normal.
2. Tag everythingPass source, campaign, placement and creative through your tracker using a Click ID and Sub ID values, and map each source to its own Channel ID. Untagged traffic cannot be diagnosed.
3. Test new sources smallGive any new source or placement a capped budget and its own channel until it has been through a full finalisation cycle.
4. Filter on arrivalApply pre-click checks so clearly non-human visitors never trigger a feed request. Review what was filtered to make sure real users are not being lost.
5. Review outcomes weeklyLook at RPC trend, provider quality feedback and estimated-versus-finalised gaps per source. Act on trends, not single days.
6. Block narrowly, then widenExclude the specific placement or sub ID first. Use an allowlist for sources where only a few placements are trustworthy.
7. Keep evidenceArchive creatives, lander versions, placement reports and quality scores with dates. You will need them for disputes with sellers and reviews by providers.

Prevention that is not about bots

Much invalid traffic in this business is self-inflicted through design. Three habits remove most of it. Keep ads visibly labelled and clear of buttons, menus and close icons, so clicks are deliberate. Make sure the creative promises only what the page delivers. And let the visitor choose their own search term instead of pushing a higher-paying one. These are policy requirements as well as quality measures, and they cost nothing.

What advertisers do on their side

1. An advertiser buys a keyword: A car leasing firm creates a search campaign in Google Ads and bids on “SUV lease deals”. It expects its ad to appear when people search for that on Google.
2. One setting widens the reach: Search campaigns include an option to show ads on Google’s search partners as well as Google.com. It is switched on unless the advertiser turns it off. It is all or nothing: partners cannot be picked one by one, only excluded.
3. The ad appears on an arbitrage page: A visitor on a partner site taps a related search for “SUV lease deals”. The firm’s ad appears in the results there, and a click costs it about $1.00 (illustrative), the same budget as a click on Google.com.
4. Does it convert?: What matters to the advertiser is the conversion rate: do these clicks become enquiries? Some partner traffic performs well. Where it converts less, Google says it lowers the price automatically (smart pricing), and invalid clicks are credited back.
5. Seeing where the ads ran: For years partner sites were a black box. Since 2025 Google has reported the individual partner sites where Search, Shopping, App and Performance Max ads appeared, so an advertiser can see each Placement by name.
6. Excluding what does not work: A site that spends money without results can be added to an account-level placement exclusion list, and ads stop showing there. The blunt alternative is the opt-out: switch search partners off for the campaign.
7. One whole category removed: Google went further with parked domains: advertisers were opted out by default in 2025, and on 10 February 2026 parked domains stopped being part of the search partner network altogether.
8. Why arbitrageurs should care: Every exclusion removes a bidder from that page, and fewer bidders mean lower prices. A page that sends advertisers real customers keeps its demand. A page that does not is slowly switched off, one exclusion list at a time.

Advertisers are the other half of prevention. They can see partner performance separately, exclude individual placements with a placement exclusion, or leave partner networks entirely. Google's own change log shows the direction of travel: site-level placement reporting for search partners arrived in August 2025, and an Invalid Activity Credit Report in April 2026. Performance advertisers also use click-fraud tools of their own. ClearTrust's ClickTrust is one such product. The more clearly advertisers can see and reject bad placements, the faster a poor-quality source loses its income.