Knowledge base

How the Zinn® Ads click-fraud shield works

Free on every Zinn-hosted site: paid clicks scored for bots, datacenter networks, repeat clicks and zero dwell, with estimated wasted spend. Converting visits are never flagged.

The Zinn® Ads click-fraud shield is free on every site hosted by Zinn® and is on by default. It looks at the paid clicks that land on your sites and marks the ones that look invalid, so you can see how much of your ad spend may be going to bots, competitors or click farms.

What it looks at

A paid click is a visit whose address carries an ad platform's click id: gclid, msclkid, fbclid, ttclid, li_fat_id, twclid, epik. For each one, the shield reads your site's own web-server log (no tracking script is added to your site) and checks:

  • Bot or script: the browser name is a crawler, a script or a headless browser.
  • Datacenter or VPN network: the visit came from a hosting, cloud or commercial VPN network
  • rather than a home or mobile connection.

  • Repeat clicks: the same address, or many addresses on the same network, clicked your ads
  • several times within 24 hours.

  • Zero dwell: nothing else was loaded within 10 minutes of the click.
  • No page assets: the visitor stayed but never loaded the page's scripts, styles or images.
  • Seen elsewhere: the address or network was judged invalid on another Zinn-hosted site.

Each click gets a score from 0 to 100 and the reasons behind it. A click scoring 50 or more is listed as suspected invalid.

⛔ A click that converted is never flagged. If the visitor reached an order-received or thank-you page, or sent a form, the click is marked converted whatever else is true about it. You can add your own conversion pages under Zinn® Ads → Click-fraud shield.

Estimated wasted spend

Enter your average cost per click and the shield multiplies it by the suspected clicks. This is an estimate: Google decides which clicks are invalid and what it credits back, and we never promise a refund.

The shared fraud network

When a click is very clearly invalid, the address and its network are added to a shared fraud network as an anonymous signal: a scrambled key and a count. It never contains your organisation, your site, a page address or the visitor's address, and other customers can never see that it came from you. Signals expire after 30 days unless they are seen again.

Privacy and how long we keep it

The shield runs under legitimate interest (fraud prevention). The visitor's address, browser name, click id and page are kept for 60 days — the window in which an invalid-click claim can be made — and are then deleted. The score and reasons, without any of that, are kept for 400 days for your reports. In the dashboard the address is only ever shown as its network. You can switch the shield off for your organisation at any time.

What it does not do yet

The shield does not yet block addresses in Google Ads or prepare refund claims for you; those need your Google Ads account connected and are coming next. Sites not hosted by Zinn® are not covered.

Using it from an AI assistant

An AI assistant connected to your account (MCP) can read the shield's totals and the scored clicks with the same permissions you gave it.

Latest from the blog

What we have been writing about hosting, SEO and running sites at scale.

SEO and Link Building from the Hosting Layer: A 2026 Operator's View

How hosting shapes indexing and link equity in 2026: keeping pages indexed, vetting aged domains before you build on them, link building without a footprint, and an honest line on what infrastructure can and cannot do for SEO.

Read the post →

Making WordPress Fast and Secure: A Performance and Plugin Checklist

A practical checklist for fast, secure WordPress: server-level caching, a per-site object cache, the handful of plugins worth running, keeping the stack current, and the WooCommerce pages you must never cache.

Read the post →

How to Choose Managed Web Hosting in 2026: A Buyer's Guide

What actually separates good managed hosting from a cheap box with a control panel — migrations, backups, isolation, real caching and honest scaling — and how to judge it before you commit.

Read the post →

Read the blog →

Still stuck?

Support is included on every plan, the desk is open 24 hours a day, and you can write to us in any of our 58 languages — we answer you in yours.

Contact support → All articles →