Fraud Warden watches every ad click on your site, scores it for fraud signals in real time, and excludes the IP from your campaign, usually in under two seconds. Try it free for 7 days. No card required.
Works with any site: WordPress, Laravel, plain PHP, or anything else via a small tracking endpoint. Supports single Google Ads accounts and MCC. Built for Search campaigns; Google doesn't allow IP exclusions in Performance Max, video or app campaigns.
Representative example. Your dashboard shows real traffic to your own campaigns.
Representative example. Your dashboard shows real traffic to your own campaigns.
Three IPs, one laptop. Fraud Warden links them by device and excludes all three.
Case closed: 5 IPs checked, 4 excluded, 1 real visitor kept.
Two pieces: a small file that lives on your own site, and a connection to your Google Ads account.
The client file watches every ad click for fraud signals.
Each signal adds up.
Your site calls our relay with the flagged IP.
Popular click-fraud tools price by ad clicks, site visits or ad spend, with plans from about $69 to $79 a month. Fraud Warden charges per website from $19, runs on your own server, and lets you try it for 7 days without a card.
Illustrative estimate. Set both sliders to your own numbers.
| Fraud Warden | Typical subscription tools | |
|---|---|---|
| Pricing model | Per website, flat | By ad clicks, visits or ad spend |
| Starting price | $19/mo, or $9.50/mo billed annually | Often $69–$79/mo to start |
| Where it runs | Self-hosted, on your own site | Third-party SaaS platform |
| Your traffic data | Stays on your server | Often kept on their platform |
| For agencies | Unlimited websites and MCC, $59/mo | Multi-site plans often $99–$159/mo |
Flags an IP after a configurable number of clicks on the same campaign in a short window.
Cross-references every visitor against live IP reputation data, not a static blocklist.
Catches clicks with no mouse movement, no scroll, no touch: a strong bot signal even below the click threshold.
Recognizes the same device clicking from a rotating pool of IPs, common on mobile carrier networks.
Filters known crawler, cloud-hosting, and prefetch-proxy traffic before it ever reaches your fraud log.
Connect one Google Ads account or a full Manager Account. Sub-accounts are discovered automatically.
Start free. No card, no commitment. Every plan covers full real-time protection. The difference is how many domains you can protect.
Every plan starts with a 7-day free trial. Pick a plan only when you're ready to continue. Annual billing saves 50% on any tier. Agencies: Sentinel protects unlimited client websites across your whole MCC for $59/month.
No. Sign up with just an email and password, install the client file, and it protects your campaigns for 7 days at no cost. You only enter payment details if you decide to continue.
If you haven't subscribed, protection simply pauses — no surprise charge, nothing to cancel. Subscribe anytime from your dashboard to pick back up, or continue right away on monthly or annual billing.
Yes. There's no lock-in on any plan. Cancel from your dashboard whenever you like; you keep access until the end of the period you've already paid for.
Three steps, all running on your own server: (1) it watches every ad click on your site and scores it against fraud signals — repeat clicks, VPN/datacenter origin, zero-interaction bounces, device fingerprints reused across rotating IPs; (2) once an IP crosses the threshold, your server sends us just three pieces of information — the IP, the campaign ID, and your domain; (3) our relay uses your connected Google Ads account to add that IP as a negative criterion on the matching campaign, usually in under two seconds. Everything else — your visitor logs, click history, device data — stays on your server and is never transmitted to us.
When you connect your account, Google's own consent screen asks you to let our relay manage your Google Ads account. This is the standard Google Ads API permission; Google doesn't offer a narrower one. We only ever use it to add an IP exclusion to the matching campaign when your own client file detects fraud. We don't change budgets, bids or ads, and no password is shared. You can revoke access anytime from your Google account's connected apps settings; protection stops until you reconnect.
Three things, all one-time: (1) install the client file on your site — a single line added to your site's existing code; (2) connect your Google Ads account with one click; (3) add a short Final URL suffix (campid={campaignid}&adgid={adgroupid}) to your campaigns so we know which campaign a click belongs to. No server changes, no Google Cloud setup, no developer tokens.
Yes. When you connect, we automatically discover every account your login can access, whether that's one account or a full Manager Account with many client accounts underneath.
It still counts as a single domain. Your plan limit is based on how many websites you protect, never on how many Google Ads accounts or MCCs sit behind them. One site running campaigns across five sub-accounts under the same MCC is still one domain on your plan.
Each website is a separate domain and needs its own installation of the client file, pointed at that same shared Google Ads account — that part works with zero extra configuration, since our system reads the campaign ID from each click automatically. Because the domains are what's counted, this scenario needs a plan that covers as many domains as you have websites (Guardian for 2–3, Sentinel for unlimited), even though there's technically only one ad account involved.
One installation of the client file on one website, registered automatically the first time it blocks a threat. The number of Google Ads accounts or MCCs behind that website never affects the count — only the number of distinct websites you protect does.
No. Connecting your Google Ads account is one click, the same way you'd connect any app with "Sign in with Google." The relay handles every API detail on its side.
The client file needs a PHP runtime, but your main site doesn't have to be PHP. Run it on a small subdomain and load it like a tracking pixel — works with any tech stack.
No. Detection and storage happen entirely on your own server. Only a block request — an IP, a campaign ID, and your domain — is sent to the relay, and only once a threat is confirmed.