This guide is about setting an account up before trouble starts. If you are watching a spike of suspicious clicks right now, start with the 24-hour click fraud response plan and come back here once things are under control. For the full picture of fraud types and warning signs, see the Google Ads fraud guide.
What prevention can and cannot do
Prevention changes which future auctions your ads enter and which conversions your bidding learns from. It cannot reverse spend on clicks that already happened. Keep that difference in mind, because a lot of click fraud advice mixes the two.
Here is what Google says it already does. Its invalid clicks page states that "you won't be charged for invalid clicks or impressions" that its automated systems catch. When it finds invalid activity after you have been billed, you receive "a credit on your next invoice where appropriate and possible." If you think something got past those filters, Google's About invalid traffic page says you can request an investigation, but "Google limits investigations to the past 60 days."
Two things follow from that:
- Exclusions work only going forward. An IP, placement or location exclusion stops your ads from serving to that source from then on. The click that revealed the problem has already been made, and whether you get that money back depends on Google's filters or a credit request.
- Google's filters judge clicks, not leads. Google has no way to know that a form fill was a bot or a competitor. Keeping fake conversions out of bidding is your job, and it is where most of the long-term damage happens.
| Layer | What it prevents | What it cannot do |
|---|---|---|
| Location and network settings | Ads serving outside your real market or on low-quality partner traffic | Stop fraud that originates inside your target area |
| Placement exclusions | Repeat spend on sites, apps and channels that never produce leads | Help on Search, where there are no placements to exclude |
| Match types and negatives | Ads entering auctions for irrelevant queries | Tell a real searcher from a bot on the same query |
| Clean conversion signals | Smart Bidding chasing traffic that produces fake leads | Reduce the cost of clicks already paid for |
| IP exclusions | Future ads to a proven repeat source | Block bots that rotate through residential or mobile IPs |
| Form and landing page checks | Bots registering as conversions | Stop the click itself |
| Monthly review and automation | Slow leaks going unnoticed for months | Recover spend older than Google's 60-day investigation window |
Step 1: Match location, network and schedule settings to your real customers
Start by making sure your ads only reach places and networks where your customers actually are. This is the cheapest prevention step, and it takes minutes.
Location option. Google Ads offers two location settings. "Presence or interest" also reaches people who have shown interest in your locations, and Google's location targeting help recommends it as a best practice on Search. The same page says to consider "Presence" when you only want to reach users in specific locations. If you are a local service business that can only serve people who are physically nearby, "Presence" is usually the better fit. If you sell to people planning travel or relocation, broad targeting may be correct. Choose based on who can buy from you, then check the locations report regularly for clicks from areas you do not serve.
Search partners. Search ads can also run on Google's search partner sites. If partner traffic in your account produces clicks but no qualified leads, turn partners off for that campaign. Our guide to Search Partners and lead quality shows how to compare the two.
Ad schedule. Use your own data here, not general rules about when fraud happens. Pull the day and hour report next to your CRM data on qualified leads. If a block of hours consistently produces clicks and no qualified leads over several months, exclude those hours. If it produces real customers, keep it, even at 3 a.m.
Step 2: Control where Display, YouTube and Performance Max ads appear
On Display, YouTube and Performance Max, the biggest prevention lever is placement control. These networks show ads on sites, apps and videos you do not pick one by one, and that is where low-quality and fraudulent placements tend to appear.
Do this once, then maintain it:
- Build an account-level placement exclusion list and apply it to every Display, Video, Demand Gen and Performance Max campaign.
- Exclude app categories or specific apps when app traffic in your account produces clicks but no qualified leads.
- Set content suitability (excluded content types and sensitive categories) to match your brand, since low-quality inventory and fraud often overlap.
- Review the 'where ads showed' placement report monthly and exclude placements with many clicks and no engaged sessions or leads.
- For Performance Max, check channel and placement reporting where Google provides it, and apply brand and placement exclusions at the account level.
Our guide to Google Ads exclusion lists walks through building and sharing these lists across campaigns.
Step 3: Pick match types and negatives on purpose
Broader matching puts your ads into more auctions. That brings in more of everything: real buyers, irrelevant searches and any automated traffic attached to those queries. Broad match is not a fraud setting, but it makes the quality of your conversion data much more important, because Smart Bidding decides which of those extra queries to pursue.
A practical setup:
- Core, high-cost terms: exact or phrase match, so you know which queries you pay for.
- Broad match or AI Max: use it once Step 4 is in place, so bidding learns from qualified leads instead of raw form fills.
- Negative keyword lists: shared lists for job seekers ("careers", "jobs", "salary"), freebie hunters ("free", "template") and anything your sales team says never converts.
- Search terms report: review it weekly for new campaigns and monthly after that, and add negatives for irrelevant queries before they pile up spend.
Step 4: Make sure only real conversions train Smart Bidding
This is the most important prevention step. Smart Bidding learns from your conversion data, so fake conversions teach it to buy more of the traffic that produced them. Google describes Smart Bidding as bid strategies that "optimize for conversions or conversion value in every auction," and its Smart Bidding help page notes that "you need to have conversion tracking enabled." Clicks that never convert cost money, but they don't make bidding chase more of the same. Bot form fills, spam calls and junk leads counted as conversions do.
One method to avoid: negative conversion values. Some guides suggest giving fake leads a negative value, such as minus $50, to "teach" the algorithm. Google Ads does not support this. Google's conversion value rules documentation says added and set values "must be greater than 0," and multipliers must be between 0.5 and 10. A fake lead with a positive value still counts as a conversion.
Here is what works instead:
| Method | What it does | Source |
|---|---|---|
| Keep raw form fills and soft events as secondary actions | Secondary conversion actions are reported but not used for bidding (unless added to a custom goal) | Google Ads Help: About conversion goals |
| Import qualified leads as the primary conversion | Bidding learns from leads your sales team accepted, via offline conversion import or enhanced conversions for leads | Google Ads Help: offline conversion imports |
| Retract fake conversions | A retraction sets the value to 0.00 and removes it from the conversion count. Retractions affect CPA and ROAS strategies. Online conversions need a transaction ID to be adjusted | Google Ads Help: About conversion adjustments |
| Use conversion value rules correctly | Raise or lower values (within the positive limits above) by location, device or audience when lead quality truly differs | Google Ads API: Conversion value rules |
| Apply a data exclusion after a fake-conversion spike | Tells Smart Bidding to ignore clicks from a period when reported conversions were wrong. Google says to use it sparingly | Google Ads Help: About data exclusions |
Sources: About conversion goals, About conversion adjustments, About data exclusions.
Two details are worth knowing. Google says that once a conversion is retracted, "it can't be adjusted further," so check the file before you upload it. And data exclusions are meant for cases where something "causes reported conversions or conversion value in Google Ads to be incorrect," such as tagging or import problems. Google warns: "Don't use data exclusions frequently or for extended periods." A short burst of bot form fills fits that description. A constant trickle of junk leads does not, and needs the qualified-lead import instead.
For a deeper walkthrough of the lead side, read how fake leads train Google Ads Smart Bidding.
Step 5: Exclude proven repeat sources by IP, and know where that stops working
IP exclusions are useful for a specific job: stopping your ads from serving again to an address that has already shown it is not a customer. Google's IP exclusion help page says "you can exclude up to 500 IP addresses per campaign," and that ads are then "blocked from computers and networks associated with those addresses." Account-level IP exclusions also exist and cover Performance Max, Demand Gen, Search, Shopping, Display, Discover and YouTube. Campaign-level exclusions are not available for video, hotel, App, Performance Max or Smart Display campaigns.
Use them carefully:
- Exclude on evidence. Look for repeated paid clicks from one address with no engagement and no leads over a meaningful period, and record why each IP was excluded.
- Never exclude customers. Offices, universities and mobile carriers can put many real people behind one address. Check before you exclude a busy IP.
- Expect rotation. Bots on residential proxies or mobile networks change IP between clicks, so a list of single IPs will not keep up. Our post on why IP blocking fails against residential proxies explains the pattern, and the 500 IP exclusion limit covers how to prioritize.
What about a "honeypot" campaign? Some guides recommend a separate, aggressively bid campaign with no exclusions, built to attract fraud so you can study it. We don't recommend this. It spends real budget on the traffic you are trying to avoid, Google filters some of that traffic anyway, so what you learn is incomplete, and the campaign competes in your own auctions. Your existing click logs, search terms and placement reports give you the same evidence without the extra spend.
Step 6: Harden forms and landing pages so bots cannot become conversions
Landing page checks don't stop the click, but they can stop a bot from becoming a conversion, and that is what protects your bidding. The rule is simple: only fire the Google Ads conversion after your server has accepted the submission.
Practical checks that real visitors never notice:
Hidden honeypot field. Add a field that people cannot see and bots tend to fill in. Hide it off-screen instead of with display:none, which some bots skip:
.hp-field {
position: absolute;
left: -9999px;
width: 1px;
height: 1px;
}
Reject or flag any submission where that field has a value, and don't count it as a conversion.
Time-to-submit check. Record when the form loaded and when it was submitted. Choose a threshold that fits your form, based on your real submissions rather than a general rule, and send anything faster to review instead of counting it as a conversion.
Server-side validation. Check that the email domain accepts mail and the phone number is valid before the conversion fires. For calls, Google's call conversions let you set a minimum call length so short calls don't count.
Challenge only suspicious traffic. A CAPTCHA on every visitor lowers real conversion rates. Show it only when other checks flag a session.
Step 7: Review the account monthly, and automate when manual review falls behind
A monthly routine catches the slow leaks that setup alone misses, and it keeps your evidence inside Google's 60-day investigation window.
| Monthly check | Where | What to look for |
|---|---|---|
| Invalid clicks | Add the Invalid clicks column to the campaigns table | Sudden changes compared with your usual level |
| Credits received | Report Editor: Invalid Activity Credit Report: Search & PMax | Which campaigns are receiving credits |
| Placements | Where ads showed (Display, Video, Demand Gen, PMax) | High clicks with no engaged sessions or leads |
| Search terms | Search terms report | New irrelevant queries that need negatives |
| Lead quality by campaign | CRM next to Google Ads | Campaigns where form fills rise but qualified leads do not |
| Click logs | Server logs or your protection tool | Repeat sources worth excluding, and evidence for any credit request |
The Invalid Activity Credit Report is available for Search and Performance Max campaigns and shows credits applied after a billing period ended. If you find activity Google missed, use the Click Quality Form with timestamps, IPs and your reasoning. Our guide to Google Ads invalid-click credits covers what to include.
When manual review is no longer enough. Reviewing logs by hand works for a small account. It falls behind once you run several campaign types, spend more, or see attacks spread across many IPs. That is when click-level automation earns its cost. ClickFortify for Google Search scores every click on dozens of behavioral, device and network signals in real time, adds fraudulent IPs to your Google Ads IP exclusions automatically, and covers Search, Display, Shopping, YouTube and Performance Max. It keeps an evidence trail for every block. The limits from the top of this guide still apply: an automatic exclusion stops the next click from that source, and the click that triggered it is handled by Google's filters or a credit request.
The prevention checklist
- Location option set to match where your customers can actually buy (Presence for strictly local businesses).
- Search partners on or off based on qualified-lead data, not habit.
- Account-level placement exclusion list applied to Display, Video, Demand Gen and Performance Max.
- Exact or phrase match on core high-cost terms, plus shared negative keyword lists.
- Raw form fills set as secondary; qualified leads imported as the primary conversion.
- A process to retract fake conversions, and no negative conversion values.
- IP exclusions only for proven repeat sources, with a recorded reason for each.
- Honeypot field, time-to-submit check and server-side validation before the conversion fires.
- Monthly review of invalid clicks, credits, placements, search terms and lead quality.
Prevention is the set of layers you build before anything goes wrong. When something does get through, the response plan is the next step.
