Clicksora Click Fraud Protection

Clicksora is the easiest way to protect your PPC ad campaigns from click fraud, bots, and competitors wasting your ad budget.

This official WordPress plugin automatically injects the Clicksora tracking snippet into your site. Simply enter your Tracking ID and your ads are protected — no code editing required.

Key Features

• Real-time click fraud detection — Identifies fraudulent clicks the moment they happen
• Automatic IP blocking — Blocks bad IPs and syncs exclusions to your Google Ads account
• Bot detection — Filters out automated bot traffic before it costs you money
• Lightweight — Only 3KB tracking script loaded in the page head, minimal impact on page speed
• Cache-safe — Works correctly behind full-page caches (WP Rocket, W3TC, LiteSpeed, Cloudflare APO); your own admin visits are filtered out by Clicksora server-side, so the page HTML never varies by login state
• WooCommerce compatible — Tracks real purchases on the order-received page and reports order value + currency to Clicksora
• One-click setup — Just paste your Tracking ID and save

How It Works

1. Install and activate the plugin
2. Enter your Clicksora Tracking ID (found in your Clicksora Dashboard)
3. The tracking script loads automatically on every page
4. Clicks from ads are analyzed in real-time
5. Fraudulent IPs are blocked and synced to your Google Ads
6. View everything in your Clicksora Dashboard

Who Is This For?

• Businesses running Google Ads campaigns
• Marketing agencies managing PPC for clients
• E-commerce stores protecting their ad spend
• Anyone who wants to stop paying for fake clicks

A Clicksora account is required. Sign up at clicksora.com — all plans include a 14-day money-back guarantee.

External Services

This plugin connects to the following external services operated by Clicksora:

Clicksora Tracking API

• Service: Clicksora
• What it does: The plugin loads a lightweight tracking script (https://app.clicksora.com/t.js) on your site's frontend pages. This script analyzes incoming ad clicks to detect click fraud in real-time. It communicates with the following Clicksora endpoints:
  • https://app.clicksora.com/api/track/click — click, page-load and page-exit signals used for fraud analysis.
  • https://app.clicksora.com/api/track/pixel — a <noscript> fallback pixel for visitors with JavaScript disabled.
  • https://app.clicksora.com/api/track/config — read on each page load to determine whether session replay is enabled for your account.
  • https://app.clicksora.com/api/track/conversion — conversion events (for example WooCommerce purchases) when you or the plugin fire them.
  • https://app.clicksora.com/api/track/session-recording — links a session replay to its click when replay is enabled.
• Data transmitted: Click and device metadata including IP address, user agent, referrer URL, UTM/GCLID ad parameters, a lightweight browser fingerprint, on-page interaction signals (scroll depth, mouse/keyboard activity), and timestamps. For WooCommerce conversions, the order total, currency and order ID are sent. No names, emails, or passwords are collected by the plugin.
• When data is sent: On every frontend page load. The tracker is emitted for all visitors (including logged-in admins) so it stays correct behind full-page caches; Clicksora filters out your own administrator self-clicks server-side.
• Terms of Service: https://clicksora.com/terms
• Privacy Policy: https://clicksora.com/privacy

PostHog Session Replay (optional)

• Service: PostHog, loaded on Clicksora's behalf.
• What it does: If — and only if — session replay is enabled server-side for your account (Pro/Enterprise plans), t.js additionally loads the PostHog recording library from https://us-assets.i.posthog.com and sends masked session recordings to https://us.i.posthog.com (or the PostHog host returned by /api/track/config). Recordings mask all input fields by default. If replay is disabled for your account, PostHog is never loaded.
• Data transmitted (when enabled): Masked session recordings — page interactions, clicks, scrolls and network metadata — with input values masked. Controlled entirely from your Clicksora dashboard.
• Privacy Policy: https://posthog.com/privacy