Description
Every paid click that reaches your site carries a click identifier – gclid from Google Ads, msclkid from Microsoft Advertising, fbclid from Meta. Those identifiers are meant to be used once, by one visitor. In practice they get shared in messages, pasted into forums, replayed by bots, indexed by scrapers, and clicked again days later by people who never saw your ad.
Every one of those replays looks to your analytics exactly like a fresh paid click. Your conversion data drifts. Your cost-per-lead looks wrong. And your sales team calls leads that came from an ad click nobody paid for.
Vetraclix records every ad click the first time it arrives, then refuses to let it count twice.
How it works
- Capture. When a visitor arrives with an ad click identifier in the URL, it is recorded server-side, before your theme renders anything.
- Clean. The click identifier and campaign parameters are removed from the visible address bar, so they never land in browser history and never travel in a copied link.
- Score. If the same identifier comes back, it is scored 0-100 on how suspicious the repeat looks: a changed IP address, a changed device, a changed country, how quickly it was reused, how many times it has been seen, and how late in its lifetime it reappeared.
- Act. Depending on the resulting status, tracking scripts are withheld, form submissions are refused, and the visitor can be shown a branded notice or quietly redirected to a clean version of the page.
Genuine visitors are never affected. Organic and direct traffic carries no click identifier at all and is ignored completely.
What makes it different
- It blocks before your page loads, not after. Most approaches hide something in the footer, long after the tracking script in your
<head>has already fired and already counted the visit. Vetraclix intercepts ontemplate_redirect, before your theme is loaded at all, so a bad click never reaches a single tracking tag. - It works with the tags you already have. There is no need to rip out Google Tag Manager or move your pixels. Wrap them in one function call and they are gated automatically.
- It makes no external requests. No third-party fraud API, no geolocation service, no account to sign up for, no data leaves your server. Country data is read from headers your CDN already sends.
- Nothing is hard-coded. Expiration windows, scoring weights, which networks to watch, what visitors see, which forms are protected, how long data is kept – all of it is configurable from the settings screen.
Ad networks supported
Google Ads (gclid, gbraid, wbraid), Microsoft Advertising (msclkid), Meta Ads (fbclid), TikTok (ttclid), X/Twitter (twclid), LinkedIn (li_fat_id), Pinterest (epik), and Impact/affiliate (irclickid). Enable only the networks you actually advertise on.
Form protection
Submissions made under an invalid click session are rejected and logged, with built-in integrations for Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Elementor Forms, and Forminator. Each one can be switched on or off individually, and the rejection message is yours to write.
Gating your own tracking
In PHP:
if ( function_exists( 'click_guardian_can_track' ) && click_guardian_can_track() ) {
// Print or enqueue your conversion tag here.
}
In JavaScript:
window.ClickGuardian.whenTrackable( function () {
// Fire your conversion event here.
} );
Both answer “yes” when the plugin is deactivated, so a gated tag can never be silently lost.
Reporting
A dashboard with status counters and a 30-day activity chart; a searchable, filterable record of every click with its score and full visit history; a grouped event log; CSV export; and a diagnostics screen showing exactly what the plugin is configured to do and what it can see.
Privacy
IP addresses and user agents are stored as a salted, one-way SHA-256 hash – enough to recognise the same visitor reusing a click, impossible to reverse. Storing readable IP addresses alongside the hash is a separate setting you can leave switched off; if you turn it on, disclose it in your privacy policy. The plugin’s own click-fraud detection makes no external requests and sends no data anywhere outside your own site.
External services
This plugin’s own fraud-detection engine makes no external requests. It has one optional, off-by-default feature that does: Print Snippets For Me, under Settings Tracking IDs. It exists only for sites with no tag manager already installed; when enabled, it loads the tracking scripts for the ad network IDs you enter, gated behind the same click-validity check the rest of the plugin uses. No account is created and no data is sent to these services by the plugin itself beyond loading the script you asked for; whatever that script then does is between your site and the ad network, governed by that network’s own terms.
- Google (Google Tag Manager, gtag.js, Google Analytics/GA4, Google Ads) – loads
googletagmanager.com/gtm.jsand/orgoogletagmanager.com/gtag/jswhen a GTM container ID, GA4 measurement ID, or Google Ads conversion ID is entered and this feature is enabled. Sent when: on every page load where tracking is allowed. Google Terms of Service, Google Privacy Policy. - Microsoft Advertising (Microsoft/Bing UET) – loads
bat.bing.com/bat.jswhen a UET tag ID is entered and this feature is enabled. Sent when: on every page load where tracking is allowed. Microsoft Services Agreement, Microsoft Privacy Statement. - Meta (Meta Pixel) – loads
connect.facebook.net/en_US/fbevents.jsand sends a PageView event when a Pixel ID is entered and this feature is enabled. Sent when: on every page load where tracking is allowed. Meta Terms of Service, Meta Privacy Policy.
If you already have any of these tags installed through a tag manager or another plugin, leave Print Snippets For Me off and gate your existing tags with click_guardian_can_track() instead – see “Gating your own tracking” above.
Installation
- Install through Plugins Add New, or upload the plugin folder to
/wp-content/plugins/. - Activate it through the Plugins screen.
- Go to Vetraclix Settings and tick the ad networks you advertise on under Detection.
- Under Protection, choose an expiration window. Twelve hours suits most lead-generation campaigns.
- Gate your existing tracking tags with
click_guardian_can_track(), or turn on Print Snippets For Me under Tracking IDs if you have no tag manager yet.
Nothing else is required. Sensible defaults are applied on activation.
FAQ
-
Will this block real visitors?
-
No. A visitor with no ad click identifier in their session – all organic, direct, referral and social traffic – is never touched. Only a session that arrived from a paid click can ever be gated, and then only once that click has expired or looks reused.
-
Does this replace Google Ads conversion tracking?
-
No. It controls when your existing tags are allowed to fire. It does not replace Google Tag Manager, GA4, or your conversion tags, and it never sends data to Google on your behalf.
-
I already have Google Tag Manager. Should I use the built-in snippets?
-
No – leave Print Snippets For Me switched off. It exists for sites with no tag manager at all. If you already have tags installed, printing a second copy would double-count every pageview. Gate your existing tags with
click_guardian_can_track()instead. -
What does single-use mode do?
-
A click identifier is valid only for its very first visit. If the same value appears in a URL again – from the same visitor or anyone else – it is immediately expired. This is the strictest setting, and suits businesses that want every click to be strictly one-time.
-
Do I need Cloudflare?
-
No. A CDN or WAF is detected automatically when present and its headers are used for more accurate IP and country data, at no extra cost. Cloudflare, Amazon CloudFront, Fastly, Sucuri and Akamai are recognised out of the box, and a filter lets you add others. Sites with no CDN work normally; they simply have no country data.
-
Will my own clicks be recorded while I test?
-
Not if you are signed in. Ignore Signed-in Users is on by default, precisely because site owners and agencies click their own ads far more often than they expect.
-
Can I try it without affecting visitors?
-
Yes. Turn Enable Click Blocking off under Protection. Clicks are still captured, scored and reported, but no visitor is ever interrupted and no tracking is withheld. Run it that way for a week, look at the records, then decide.
-
Can my agency see the reports without being an administrator?
-
Yes. Change Required Capability under Advanced to a capability their role holds.
-
Does it make my site slower?
-
No measurable amount. Capture is one indexed database query on a paid-click landing, and nothing at all for organic traffic. There are no external HTTP requests during a page load, and the admin assets load only on the plugin’s own screens.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Vetraclix for Google Ads – Click Fraud Protection & GCLID Tracking” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.2
- The optional managed-snippets feature (Google Tag Manager, gtag.js, Microsoft UET, Meta Pixel) now loads through
wp_enqueue_script()instead of printed<script>tags. - Hardened the safety-net output buffer used on
template_redirectso it never closes a buffer opened by another plugin or the theme. - Documented the optional managed-snippets feature’s external services in this readme.
1.0.1
- Fixed a “translation loading too early” notice by deferring form-integration registration to
init. - Hardened all custom-table queries to use
$wpdb->prepare()‘s%iidentifier placeholder instead of raw string interpolation.
1.0.0
- Initial release.