Resources

Everything you need to know about bots eating your budget.

Practical guides on click fraud, bot traffic detection, server-side tracking, and revenue attribution — written for the people who actually run the campaigns.

Book demo →Explore the platform

Ad fraud 101

What is click fraud, and how much is it costing you?

Click fraud is any non-human or bad-faith click on a paid ad — bots, click farms, or competitors draining budget. Industry studies put invalid traffic at 20–30% of PPC clicks and global losses in the tens of billions per year. If you buy traffic and never audit it, you're almost certainly paying for some of it.

  • Bots trigger browser pixels exactly like humans do — pixel counts can't catch them
  • High-CPC niches (legal, finance, B2B SaaS) suffer the most per fraudulent click
  • Fraud also poisons smart bidding: the algorithm learns to find more bots
See how Relayys handles this →

Detection

How to detect bot traffic on your landing pages

The reliable signals aren't IPs — sophisticated bots rotate them. Behavior is harder to fake: real users scroll, move the mouse with natural entropy, and take more than 0.4 seconds to fill a form. Honeypot fields — invisible inputs only bots fill — remain one of the highest-precision detectors available.

  • Watch submit timing: sub-0.4s form completion is effectively never human
  • Score telemetry: scroll depth, typing velocity, mouse movement
  • Inject honeypots: invisible to humans, irresistible to bots
See how Relayys handles this →

Google Ads

Google Ads offline conversion tracking, explained

Offline (enhanced) conversion uploads let you report conversions to Google server-to-server via ConversionUploadService, keyed on the gclid captured at click time. Instead of counting form fills, you can upload the moment a lead actually pays — with its real value — so smart bidding optimizes toward revenue.

  • Capture and store gclid on every landing — it's your join key
  • Upload conversions with transaction values for value-based bidding
  • Server-side uploads survive ad blockers, ITP, and cookie loss
See how Relayys handles this →

Meta

Meta Conversions API (CAPI): a practical guide

CAPI sends conversion events from your server to Meta directly, bypassing the browser pixel. Paired with fbclid capture and a first-party cookie, it restores the signal iOS 14.5 destroyed — and lets you choose what counts as a conversion, like verified humans who actually paid.

  • Server events dedupe against pixel events via event_id
  • Send exact purchase values to power value optimization
  • Filter what you send: clean data in, lower CPA out
See how Relayys handles this →

Attribution

Revenue attribution vs. click attribution

Click attribution answers “which ad got the click.” Revenue attribution answers “which ad made money.” The difference is the join between your billing system and your click data: matching a Stripe invoice's billing email to the tracked session that first clicked the ad — down to the keyword.

  • Form fills are a proxy metric; invoices are ground truth
  • Refunds and churn must be subtracted for true net ROI
  • Keyword-level revenue lets you cut spend with confidence
See how Relayys handles this →

Tracking

First-party tracking that survives ad blockers

Third-party pixels are blocked by ad blockers and throttled by Safari ITP. A first-party cookie set on your own domain, combined with server-to-server event delivery, keeps attribution intact — no rented pixels, no data loss when browsers tighten policy again.

  • First-party cookies live on your domain and your terms
  • Server-side payloads can't be blocked by browser extensions
  • Identity bridging links email → session → originating click
See how Relayys handles this →

FAQ

Common questions from marketers

How much of my ad traffic is likely bots?

Industry estimates range from 5% to 30% depending on channel. Display and audience networks skew highest; brand search skews lowest. The only way to know your number is to instrument your own forms and landing pages with behavioral detection.

Do CAPTCHAs stop click fraud?

CAPTCHAs add friction for humans and are increasingly solved by bots and farms. Invisible approaches — honeypots, submit timing, telemetry scoring — catch bots without costing you real conversions.

Can I get a refund from Google for invalid clicks?

Google credits some invalid activity it detects itself, but independent audits consistently find invalid traffic beyond what platforms refund. Blocking bots from ever converting — and never reporting them as conversions — protects you structurally, not case by case.

Reading is good. Auditing is better.

Connect your ads and forms and watch the live audit feed catch bots in real time.

Book demo