Bots and repeat clickers burn your Google Ads budget. stopfakeclicks spots them on your WooCommerce shop, then blocks them in Google Ads with IP exclusions added by a script you paste into your Google Ads account. No Google Ads login is shared and no API connection is needed.
This plugin:
- adds the stopfakeclicks tag to your shop. The tag only reports visits that arrive from a Google ad, sets no cookies and loads after the page;
- tells stopfakeclicks when a visitor from an ad adds to cart or buys, so real shoppers are never blocked.
You need a stopfakeclicks account (14-day free trial, then USD 9.99 a month). Your first 7 days are watch-only: suspicious sources are recorded, nothing is blocked.
External service
The plugin’s script (included in the plugin) sends visit events to the stopfakeclicks service at https://api.stopfakeclicks.com/c, only for visits that arrive from a Google ad: the click id, the page path, the visitor’s IP address and browser details, and add-to-cart and purchase events. This is how suspicious clicks are detected and real shoppers are recognised.
For the same visits it also sends a short summary of how the page was used (time on screen, time to the first interaction, and counts of mouse moves, touches, presses and scrolls; never positions, keys or anything typed) and a short one-way hash of the device (how the browser draws a test image, its graphics card and basic settings; never the raw values). With a consent plugin that uses the WP Consent API, the device hash is only computed after marketing consent, and you can switch it off in Settings > stopfakeclicks.
When you click Connect to stopfakeclicks in the settings, your browser opens https://api.stopfakeclicks.com/connect/wordpress with your site address, your WordPress admin return address and a one-time code. Nothing is sent before you click. After you sign in and confirm, you come back with your site key.
Terms: https://stopfakeclicks.com/terms – Privacy policy: https://stopfakeclicks.com/privacy
If you use a consent plugin that supports the WP Consent API, the visit is only remembered after statistics consent. You can also stop the script entirely with the stopfakeclicks_load_tag filter.