XeroWP
Clicksora Click Fraud Protection
Clicksora Click Fraud Protection

Clicksora Click Fraud Protection

0/5 (0 ratings) — active installs Updated Nov 12, 2026
ad fraudbot trafficclick-fraudgoogle adsIP-blocking
Download v1.9.2 Plugin Website
Settings → Clicksora: the Tracking ID saved and the protection status, with the Test Connection check.

Settings → Clicksora: the Tracking ID saved and the protection status, with the Test Connection check.

Clicksora Click Fraud Protection connects a WordPress site to Clicksora, a click fraud protection service for Google Ads, Meta Ads and Microsoft Ads advertisers. Paste one Tracking ID and every paid click that lands on your site is scored as the page loads: the network it came from (home, mobile carrier, hosting or VPN), the device, whether the page actually rendered, how many times the same address or phone opened your ads, and whether the click ID was re-fired from somewhere else. Addresses that fail are blocked and, on the plans that include it, written to your Google Ads IP exclusion lists automatically, so the same address cannot cost you a second click.

The plugin itself is deliberately small. It adds the small Clicksora tracker (about 4 KB compressed) to the page head, a no-script fallback pixel, and a WooCommerce hook that reports real purchases. All detection, blocking and reporting happen in your Clicksora dashboard, not inside WordPress.

What you get

  • Click scoring on the landing page — every click with a Google, Meta or Microsoft click ID is examined the moment it arrives
  • Hosting, VPN, proxy and Tor detection — clicks from rented servers and anonymising networks are identified before they cost a second click
  • Bot and headless-browser detection — automation that never renders the page or shows no human interaction is caught
  • Repeat-click and click-burst rules — your own thresholds for how often one address or one phone may open your ads
  • Automatic Google Ads IP exclusions — blocked addresses are synced to your campaigns (Professional plan and above); the Starter plan exports them for a manual sync
  • Conversion verification — call, WhatsApp, form and purchase events are checked against the click that produced them; conversions judged fraudulent are never uploaded to Google
  • Cache-safe — the tracker is emitted for every visitor, so full-page caches (WP Rocket, W3 Total Cache, LiteSpeed, Cloudflare APO) never strip protection; your own admin visits are filtered out server-side instead
  • WooCommerce compatible — the order-received page reports the order value and currency to Clicksora, once per order
  • AMP-aware — the external script is skipped on AMP requests, where it would be invalid; the no-script pixel still records the visit
  • No code editing — install, paste the Tracking ID, save

How it works

  1. Install and activate the plugin.
  2. Enter your Clicksora Tracking ID (a 16-character code from your Clicksora dashboard).
  3. The tracker loads on every front-end page and sends the click, page-load and page-exit signals to Clicksora.
  4. Clicksora scores the click. Hosting networks, replayed click IDs and repeat clickers are blocked; genuine visitors from your market are never blocked on one click alone.
  5. Blocked addresses are synced to your Google Ads account as IP exclusions.
  6. You read everything — networks, devices, pages, calls — in the Clicksora dashboard, with the reason for every block.

Who it is for

  • Businesses running Google Ads to a WordPress or WooCommerce site
  • Agencies managing paid search for clients on WordPress
  • Local service businesses in competitive markets, where competitors and paid clickers are a daily cost
  • Anyone who wants to know what, exactly, is clicking their ads before paying for it again

What it is not

The plugin does not block visitors from reaching your site and does not change your pages. It records and reports; the blocking is done in Google Ads through IP exclusions, where it stops the next paid click. Clicksora is an independent service and is not affiliated with or endorsed by Google.

Pricing

Clicksora is a paid subscription with a 7-day free trial (a card is required and nothing is charged if you cancel before day 7) and a 14-day money-back guarantee. Plans start at $59 a month. Current prices are on clicksora.com/pricing.

External Services

This plugin connects to the following external services operated by Clicksora:

Clicksora Tracking API

  • Service: Clicksora
  • What it does: The plugin loads a lightweight tracking script (https://app.clicksora.com/t.js) on your site’s frontend pages. This script analyzes incoming ad clicks to detect click fraud in real-time. It communicates with the following Clicksora endpoints:
    • https://app.clicksora.com/api/track/click — click, page-load and page-exit signals used for fraud analysis.
    • https://app.clicksora.com/api/track/pixel — a <noscript> fallback pixel for visitors with JavaScript disabled.
    • https://app.clicksora.com/api/track/config — read on each page load to determine whether session replay is enabled for your account.
    • https://app.clicksora.com/api/track/conversion — conversion events (for example WooCommerce purchases) when you or the plugin fire them.
    • https://app.clicksora.com/api/track/session-recording — links a session replay to its click when replay is enabled.
  • Data transmitted: Click and device metadata including IP address, user agent, referrer URL, UTM/GCLID ad parameters, a lightweight browser fingerprint, on-page interaction signals (scroll depth, mouse/keyboard activity), and timestamps. For WooCommerce conversions, the order total, currency and order ID are sent. No names, emails, or passwords are collected by the plugin.
  • When data is sent: On every frontend page load. The tracker is emitted for all visitors (including logged-in admins) so it stays correct behind full-page caches. To keep your own visits out of your reports, list your office address under Internal IPs in the Clicksora dashboard: traffic from it is marked internal, never blocked and never counted as a paid click.
  • Terms of Service: https://clicksora.com/terms
  • Privacy Policy: https://clicksora.com/privacy

PostHog Session Replay (optional)

  • Service: PostHog, loaded on Clicksora’s behalf.
  • What it does: If — and only if — session replay is enabled server-side for your account (Pro/Enterprise plans), t.js additionally loads the PostHog recording library from https://us-assets.i.posthog.com and sends masked session recordings to https://us.i.posthog.com (or the PostHog host returned by /api/track/config). Recordings mask all input fields by default. If replay is disabled for your account, PostHog is never loaded.
  • Data transmitted (when enabled): Masked session recordings — page interactions, clicks, scrolls and network metadata — with input values masked. Controlled entirely from your Clicksora dashboard.
  • Privacy Policy: https://posthog.com/privacy