How to check Adsense theft from freelancer who worked on my site?

[jc2021]

While I do not directly suspect theft at thee moment, I have had an experience in the past with a guy that altered my ad codes to make 50% of revenue go to him

This was the ad code I discovered back then.

<!-- XXX-->
<script type="text/javascript"> 
var random_number = Math.random(); 
if (random_number < .5){ 
google_ad_client = "ca-pub-XXX";
<!-- XXX -->
google_ad_slot = "123xxxxxxx";
google_ad_width = 300;
google_ad_height = 250;
} else { 
google_ad_client = "ca-pub-XXX";
<!-- XXX -->
google_ad_slot = "321xxxxxxx";
google_ad_width = 300;
google_ad_height = 250;
} 
</script> 
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>

Nothing seems out of the ordinary now but interested in hearing your thoughts on different ways this could be achieved.

[edited by: not2easy at 2:09 pm (utc) on Jan 18, 2022]
[edit reason] anonymized - privacy/ToS [/edit]

[NickMNS]

your thoughts on different ways this could be achieved.

No. What I will offer is means of ensuring that this doesn't occur.

The way it is done, as in your example is that the malicious actor added their publisher code to your page. So you must ensure that only your publisher code appears where ever there is an ad. The most efficient way to achieve this is to use some kind of an include such that the code for each unit is only entered in a single place, yet may appear on many pages.

Another potential place where ad theft could occur, would be via the ad networks themselves, where a malicious actor could sell ad space on your website despite not having that right. This is far more complex and I assume less likely, and it is also easily prevented by implementing a correct Ads.txt file.

[robzilla]

Version control. Review their edits. And hire better people ;-)

[puente]

he might have gotten away with it if he'd refactored the code by changing just one line instead of the horrible code bloat :)

[robzilla]

Well, I hope you'd notice if 50% of ad impressions and revenue suddenly go missing.

[NickMNS]

Well, I hope you'd notice if 50% of ad impressions and revenue suddenly go missing.

You'd think! But given the variability in earnings that can occur from day to day, no single drop is immediately attributable to anything. Don't get me wrong, if you know what you are looking at/for it would be obvious, but if the only number you track is revenue then it wouldn't be.

Just for those that are not sure what to look for, you need to compare Adsense impressions, to Google Analytics (or other tracking tools) impressions, and you need to account for coverage. Under normal conditions the ratio of GA page views to ad impressions should remain consistent, but if there is a sudden drop this could signal a problem. But you would need to check your coverage because a sudden drop in coverage would also cause a sudden drop in impressions.

You should also monitor page RPM and impression RPM. If page RPM drops while impression RPM is steady it also signals a problem, but here again a lack of coverage could cause this as well.

So you would think it's obvious but not always!

[jc2021]

^Great input, thanks!