Cloudflare Traffic expert (wanted)

If I have to give my personal opinion, ShapeSecurity has been stepping up their game a lot lately, they will surely be able to solve your current problems.

thanks again cheers mate

So far I have contacted 8 different companies out of those 1 has called me other 7 don’t even reply to email. And none so far have said they can sort invalid traffic.

I don’t just want to stop bots, there are fake apps and other things going on anyway we have some of it sorted we will see.

Wait for tomorrow Cloudflare blog announcement surrounding Bot Management outside of Cloudflare Enterprise plans I am guessing it might be availability on lower tier plans. Fingers crossed as I’ve been using Bot Management for Enterprise since last year and it is bloody awesome for combating bad and malicious bots to reduce invalid HTTP traffic :sunglasses:


Google’s definition of invalid traffic is fairly wide. Even slow page load or bad UX or bad ad positioning/placement or experience covered Stay compliant with our policies - AdSense Help

Contact me using the email in this hosts file:

It will take access to information you cannot disclose due to GDPR, etc. Please do not compromise your business or your customers by letting any sensitive info slip out.

thank you this sounds good :slight_smile:

yeah its wide open too wide open for our liking but nothing we can do but wait

Hey @user8044,

I’ve had the same AdSense invalid traffic / confirmed click issue since February 28. I’ve already lost an entire month of revenue, and it doesn’t seem like April will get any better.

I’ve been actively participating in a big thread related to the issue over at Webmasterworld.

Using Cloudflare Firewall rules, I was able to detect and challenge / block almost 100% of the invalid traffic going to my website. This was a lengthy and complicated process, but I was able to keep only the traffic from real users and good bots. But the invalid clicks on the ads continued.

What I’ve found so far is NOT encouraging. I believe it is NOT a real invalid traffic / invalid clicks issue. To confirm the clicks were NOT coming from people or bots, I set up a transparent div over each ad on my website and recorded the clicks using Google Analytics Events. As I suspected, the clicks were much lower than the number of clicks shown in AdSense Reports.

I believe there is a bug in AdSense that is falsely detecting / reporting clicks. To make a test and see if this was the case, I ended up archiving / removing all AdSense ads and code (including adsbygoogle.js) from my website. But even after having archived the ads and removed the code for days, they were STILL receiving clicks every day, with very little impressions.

If you want to check this out on your own website, go to AdSense Reports, select Today, and then look for ad units with a high CTR, something over 2%. After, you can break down the report by Country / Platform and see if some Countries or Platforms are getting crazy high CTR like 10%+. Make sure you only check today’s report as the invalid clicks get deducted at the end of each day.

In my case, I am getting a CTR over 300% from Spain and the United States on those archived ad units. If I break down by platform, those clicks are all coming from High-end mobile devices (200%) and Other devices (1600%). The oddest part of this is the fact that I normally never receive much traffic or clicks from US and Spain. My website is in French and is viewed mostly from people in France and Canada.

I have contacted AdSense many times about the issue, providing logs and detailed reports as proof. Unfortunately, even after they forwarded the info to their invalid traffic team, they said they didn’t find any errors and could not help me any further.

As I mentioned previously, I believe this is a bug in AdSense. Hundreds of people have opened tickets in different online forums (official AdSense Community, Reddit, Cloudflare Community, Webmasterworld, etc.) about the same issue, but Google seems to be playing the ostrich.

After spending countless hours trying to fix the problem and losing thousands of dollars in revenue, I have pretty much lost all hope that it will go away. Unless Google decides it’s serious enough to need attention, I believe the bug won’t get fixed and things will remain the way they are.

I’ve now applied for other Ad Networks like Mediavine, Sublime and Teads. I am still waiting for approval and hope that my website will be accepted.

Even if Google ends up fixing the bug, this is pretty much the end of Google for me.

I am available for discussion if you have any questions.


I know this might sound crazy, but I think Cloudflare should start its own Ad Network to compete with Google and AdSense. I’m sure they would get users flooding in, specially since there are currently so many publishers with issues that are looking for an alternative.

I would DEFINITELY switch to Cloudflare Ads if it was launched.

1 Like

im reading this now …thanks will reply soon

1 Like

also we are trying these guys atm you can add them to your CF account easy

Please let us know if you do find a solution.

will do I am also going to write a list of things we have done

1 Like

Nice troubleshooting :slight_smile: I believe, this can happen too if someone clone/scrapes/proxy (copy and manipulates HTML content) your site and embedded ad code too. Try a quick google search for your Adsense publisher id on the internet to see if your ad codes made it’s way onto other web sites too.

1 Like

Thanks eva2000. Countless hours of fun :wink:

I was aware of this, but I think it is unlikely. I have tried doing this myself by downloading a copy of a page from my website and running it locally, but the ads did NOT load. I believe there are protections in place so the ads will only appear if all the proper conditions are met. But maybe I’m wrong. Maybe there are new ways of doing this that circumvent AdSense’s protections.

This is a good idea. I will definitely search for my publisher ID to see if it appears anywhere else. But I did enable the Sites list in AdSense which prevents my ad code from appearing on all other sites except mine. Other sites have used my code before and I’ve immediately been notified by AdSense.

Here is what Google Support says about the Sites list:

Adding your sites protects you from malicious use of your ad code by others. The sites in your sites list are the only sites that are permitted to use your ad code. If a site displaying your ad code isn’t on your list of sites, then no ads will show on that site.

1 Like

After a quick Google Search, I’ve confirmed that my AdSense code doesn’t appear anywhere else on the web.

1 Like

Interesting. Other explanation is if you’re using CF full HTML page caching and it seems to have long duration cached the HTML and embedded code too ?

1 Like

I do cache my static content for 1 year. So theoretically, the cached pages could be stuck somewhere with the old ad code, and something could be clicking on the ads / accessing the ad links continously. It is an interesting theory.

But then again, the clicks I am seeing are from United States and Spain, and I cannot find records of users from Spain, and the only records I find from the United States are from good bots. The way I check this is by waiting until it is 1:00 AM so all AdSense stats have reset from the previous day and very few stats are showing for the current day, including clicks from US and Spain. Then, I go check the special Cloudflare Firewall Rules I’ve put in place to track traffic from US and Spain and analyze the traffic.

So unless the traffic is being somehow spoofed from other regions and AdSense detects a different region than Cloudflare, I don’t know how it could be possible that those ads are truly being clicked. If they were, I would definitely see the IPs from those countries in the Firewall log.

Also, the ads always have much more clicks than impressions, which hints that my website URLs are most probably not being loaded when the ads are clicked. Unfortunately, unless you select specific URLs to track, AdSense cannot break down a report by URL. This would be incredibly useful as I could see which URLs are being clicked. But I simply cannot guess what URLs to track when I have hundreds of published URLs for the month of March alone.

so it’s here Introducing Super Bot Fight Mode

If your site interacts with Slack, for example, you can exclude verified bots to help Slackbot do its job. Or if you notice an increase in ad fraud, try challenging automated traffic and watch the results.

1 Like