Getting clicks even no ads placed on my website

click bombing on adsense ads

[Nazhahp]

Why is my website ADS units getting clicks even-though those ad units are not placed in it?

Traffic reports on google analytics looks normal, there is no spike in traffic from the UK, I removed the ads from the website, but however the ads still getting clicks. What the heck is going on here...?

Please, help me

[not2easy]

When did you remove the ads? Is is possible that your pages are served from cache? Is it possible that someone has copied your pages and they did not remove the ads?

[Nazhahp]

i was thinking that someone is clicking on the ads that's why I removed them, which is obviously not.

they can copy the page content, but they can't use my account ad units on their website! can they?

[NickMNS]

There are at least two possible reasons. One the content with the ad code is cached somewhere, this could be by Google, AMP, or Cloudfalre (if you use AMP and/or Cloudflare), or even on your own server though that is unlikely. Two, it is possible that someone has scraped your content, ads and all, and is now showing on different a domain?

For the second case:
Have you verified your domain within Adsense?
Have you checked the sites reports in Adsense and see what website are getting clicks, are the domains listed that are not yours?

Generally:
Do you use Analytics? Is your Analytics connected with your Adsense account? If so, you can use the publisher pages report to see on what pages are getting the clicks.

[Nazhahp]

Analytics reports: the website got 15 visitors from UK today:
Adsense reports: 8 pageviews - 16 impressions - 105 clicks from the UK and still counting...

For second case:

Yes the domain is verified.
one website is getting clicks.
domain is mine.

Generally:
Yes I know the page that gets the clicks. and as i said even-though removing the ad units, still getting clicks.

[NickMNS]

Do you have the publishers pages report in analytics? "Behavior" -> "Publishers" -> "Publisher pages"
With this report you can see exactly what pages got the clicks, at what time and where. Then if needed, you can take that info and search your raw server logs for more detail like the user's IP address. With all that info you should have a pretty good idea of how/why that ad click is happening. Note that if you don't find an entry in your logs that corresponds to what you find in Analytics then you'll know for sure that the clicks are coming from a different domain.

Also does the Adsense "sites" report show the clicks coming from your domain?

[not2easy]

but they can't use my account ad units on their website! can they?

AdSense lets you control that setting. If you have not changed it, you might wish to look there. AdSense will serve the ads on other sites if you do not disable that - BUT I do not know if that is still the default - I have not looked at it again for years.

[Nazhahp]

No I don't have the publishers pages report in analytics.

Adsense "sites" report shows that the clicks are generated from the associated domain domain not from a different domain.

One more thing, I removed the ads but still seeing clicks but no ad impressions.

[not2easy]

Do you have language variations or translations of your content? Asking because of a similar situation under discussion and with a solution: [webmasterworld.com...]

[Nazhahp]

No i don't have that.

I am still encountering this problem since Thursday. It is nightmare.

Adsense report shows that the Clicks are generating from a Tablet device, but google analytics reports shows that no one entred the website using a tablet device.

I am having a headache. It looks like there is another version of the website hosted on another server as an android app. What makes me say this is that the clicks are generated under the same domain name. The only way to do that is to convert the website into an app using one of the online tools and then start playing arround with ads.

Just thinking... i may be wrong.

I really need your help guys.

[not2easy]

AdSense can sort through where clicks are from, but it may take them time to send an alert and to sort it out. It is up to you to manage your traffic, GA just reports what they 'see'. You can look at your access logs to be sure others are not showing your site using iframe. If that is what they're doing then you can block their access.

If a scraped copy of your site is hosted on another domain it should be not too hard to find out how to prevent that. If they won't take it down, contact their host to see how to have the hosting service take it down. These are things that change by location, your own host may offer better advice on how to deal with it, but it depends on you to know what is happening to be able to report that in order to deal with it.

Step one is to know where it is because there is more than one way to show your content from other domains. Your access logs tell you whether someone is remotely showing your content. Then you want to view source code to see how your content got there. Is it a scraped copy that does not change when you make page changes on your site?

[friedclyde]

Hey I was in the same boat and I have put some stuff up in the thread shared above, your problem sounds exactly the same as mine and if you are on cloudflare block tor etc also you will notice a specific user agent libera (something) i noticed all these were coming in, unfortunately i have no 100% solution to this but im sure this will help you lessen it.

Good luck

[tangor]

@Nazhahp ... just following up. What do your RAW LOGS say?

Start there, then move into what g is reporting ...

[das_bends]

Did you ever resolve this? Seeing the same issue one a single url channel - removed ads on the channel but impressions/clicks still showing up.

[Nazhahp]

Hi.

Connect your website to cloudflare and set security level to high.
Go to firewall section and then option and activate Bot Fight Mode
Go back to firewall rules and Create a JS challenge rule TO CHALLENGE continent like Asia, Africa, south America and TOR.

Here is an example:

field: continent | operator: equal | value: Asia
and
field; known bots | operator; equal | value: off.

OR

field: continent | operator: equal | value:Europe
and
field; known bots | operator; equal | value: off.

then choose an action:
JS challenge.


Create another rule and name it : unwanted bots and user agent. Paste the following rule in the expressions editor, and scroll down and choose action : block.

(cf.threat_score gt 15) or
(lower(http.user_agent) contains "crawler" and not http.user_agent contains "ia_archiver") or
(lower(http.user_agent) contains "spider") or
(http.user_agent contains "baidu.com") or
(http.user_agent contains "/bin/bash") or
(http.user_agent contains "DnyzBot/") or
(http.user_agent contains "DotBot/") or
(http.user_agent contains "eval(") or
(http.user_agent contains "Go-http-client/") or
(http.user_agent contains "Nikto") or
(http.user_agent contains "Nimbostratus") or
(http.user_agent contains "python-requests") or
(http.user_agent contains "Scrapy/") or
(http.user_agent contains "SeznamBot/") or
(http.user_agent contains "Sogou") or
(http.user_agent contains "spbot/") or
(http.user_agent contains "Uptimebot/") or
(http.user_agent contains "WebDAV-MiniRedir") or
(http.user_agent contains "WinHttp.WinHttpRequest") or
(http.user_agent contains "ZmEu")

[das_bends]

Thanks for your reply - did these changes resolve your issue?

I'm not seeing the pages with the clicks in GA or CloudFlare analytics - which sounds exactly like your case - so they're not being derived from actual access to my site - so how will any further CloudFlare blocking have an affect? Any insight appreciated.

[NickMNS]

I'm not seeing the pages with the clicks in GA or CloudFlare analytics - which sounds exactly like your case - so they're not being derived from actual access to my site - so how will any further CloudFlare blocking have an affect? Any insight appreciated.

If someone has copied your code and is hosting it on another domain then the blocking in Cloudflare will not have any effect. The only solution in that case is to be sure that you verify your sites within AdSense. But I don't find the where to do this anymore, so it is possible that sites are verified by default now.

If you don't see this in GA, then what exactly are you seeing, and where? Do you see the requests in your raw logs?

[das_bends]

They're not showing anywhere except in Adsense. Not in any logs, nothing.

in Adsense it's showing zero page views, but showing impressions and clicks. it's showing up on a URL channel with my actual domain. No other domains are listed under "Sites".

I even totally disabled the page and it's still showing impressions and clicks. It's a php page and behind a login and not cached at Cloudflare or Google search.

It's all very bizarre.

[Nazhahp]

Yes those changes helped me fix the problem.

[das_bends]

Thanks Zazhahp, and did the clicks stop right away when you made those changes or they continued for a day or two more?