Firewalls to mitigate potential invalid activity

Protecting ads from invalid activity

[kkinfy]

I am exploring using mod_security with OWASP CRS ruleset on my apache-CentOS server. In general, do such firewalls are any good in mitigating potential invalid (user/bot) activity? Especially will such firewalls offer a layer of protection for adsense or other third party ads? Do you use such firewalls (any for that matter)?

[phranque]

will such firewalls offer a layer of protection for adsense or other third party ads?

no.
implementing any type of security on your server will only protect your server from attacks on your server.
it will have no impact on requests sent to google's ad servers or any other third party servers.

[kkinfy]

@phranque but won't firewalls capture at least some of potential click bots (which some webmasters would had experienced at some point in time).

[lammert]

No, the clicks won't pass through your server. The JavaScript code is directly pulled from the Google Ad servers and clicks will follow the same return path back.Technically, there is no need for your site to be even live to receive invalid clicks. Copies of the pages in caches can already be misued for that purpose.

[kkinfy]

Hi @lammert I understand someone/bots can click on offline/downloaded/cached pages. But I think "allowed sites" and ads.tx of adsense will take care that only the clicks that originate from the concerned live domain will be considered legal. I am actually thinking bout those potential clicks generated on a live website directly mostly by bad bots or sometimes repeated clicks by users (brute force).

[lammert]

No. ads.txt is only an informational file to tell which parties are allowed to sell ads for your site. It is used in the auction process in the background, not in counting the clicks.

The "allowed sites" setting can also be easily circumvented. If a bad actor copies a page from your site, hosts it somewhere else and lets a private DNS server point that it with your domain name, Google will see your domain name as referrer in the script requests as and count all clicks towards your domain name. The "allowed sites" only prevents clicks through translate services and copycats of your content. Not against parties that really want to target you with invalid clicks.

[kkinfy]

@lammert Sorry I am quite new to server security. Though I have worked for years now at an application level, I lack knowledge or experience regarding server security. Based on your comments, can I infer that a firewall is no good in preventing potential click fraud in the future? Just trying to be proactive, but not sure I am headed in the right direction.

[yaashul]

I think web application firewall can help you fighting some of the bad actors. Plus aggressive SIVT and GIVT protection script can help you further in identifying bad actors.

[ronron]

Here is an almost 100% fool proof way to solve AdSense IVT:

1) Use Google Analytics and link AdSense to it
2) Google how to add custom variables that can be sent to your Google Analytics
3) Have the user's IP address as one of the variables you will send to Analytics on page view

With AdSense and Analytics linking you will be able to show clicks coming from each IP address in your reports. From there, it is easy to block IP's/ASN's.

You are also gathering user IP's so make sure privacy concerns are being addressed.

[robert976]

Hi ronron,
it's only possible using GTM with GA or i'm wrong?

[ronron]

^ You need to use Analytics for the linking and stat gathering. I did upgrade to the GTM code before I made the changes above. I believe you can still log custom variables with the older Analytics tag however.