WordPress.org

한국어

워드프레스 받기
WordPress.org

Plugin Directory

Clicksora Click Fraud Protection

Clicksora Click Fraud Protection

작성자: clicksora
다운로드

설명

Clicksora is the easiest way to protect your PPC ad campaigns from click fraud, bots, and competitors wasting your ad budget.

This official WordPress plugin automatically injects the Clicksora tracking snippet into your site. Simply enter your Tracking ID and your ads are protected — no code editing required.

Key Features

  • Real-time click fraud detection — Identifies fraudulent clicks the moment they happen
  • Automatic IP blocking — Blocks bad IPs and syncs exclusions to your Google Ads account
  • Bot detection — Filters out automated bot traffic before it costs you money
  • Lightweight — Only 3KB tracking script loaded in the page head, minimal impact on page speed
  • Cache-safe — Works correctly behind full-page caches (WP Rocket, W3TC, LiteSpeed, Cloudflare APO); your own admin visits are filtered out by Clicksora server-side, so the page HTML never varies by login state
  • WooCommerce compatible — Tracks real purchases on the order-received page and reports order value + currency to Clicksora
  • One-click setup — Just paste your Tracking ID and save

How It Works

  1. Install and activate the plugin
  2. Enter your Clicksora Tracking ID (found in your Clicksora Dashboard)
  3. The tracking script loads automatically on every page
  4. Clicks from ads are analyzed in real-time
  5. Fraudulent IPs are blocked and synced to your Google Ads
  6. View everything in your Clicksora Dashboard

Who Is This For?

  • Businesses running Google Ads campaigns
  • Marketing agencies managing PPC for clients
  • E-commerce stores protecting their ad spend
  • Anyone who wants to stop paying for fake clicks

A Clicksora account is required. Sign up at clicksora.com — all plans include a 14-day money-back guarantee.

External Services

This plugin connects to the following external services operated by Clicksora:

Clicksora Tracking API

  • Service: Clicksora
  • What it does: The plugin loads a lightweight tracking script (https://app.clicksora.com/t.js) on your site’s frontend pages. This script analyzes incoming ad clicks to detect click fraud in real-time. It communicates with the following Clicksora endpoints:
    • https://app.clicksora.com/api/track/click — click, page-load and page-exit signals used for fraud analysis.
    • https://app.clicksora.com/api/track/pixel — a <noscript> fallback pixel for visitors with JavaScript disabled.
    • https://app.clicksora.com/api/track/config — read on each page load to determine whether session replay is enabled for your account.
    • https://app.clicksora.com/api/track/conversion — conversion events (for example WooCommerce purchases) when you or the plugin fire them.
    • https://app.clicksora.com/api/track/session-recording — links a session replay to its click when replay is enabled.
  • Data transmitted: Click and device metadata including IP address, user agent, referrer URL, UTM/GCLID ad parameters, a lightweight browser fingerprint, on-page interaction signals (scroll depth, mouse/keyboard activity), and timestamps. For WooCommerce conversions, the order total, currency and order ID are sent. No names, emails, or passwords are collected by the plugin.
  • When data is sent: On every frontend page load. The tracker is emitted for all visitors (including logged-in admins) so it stays correct behind full-page caches; Clicksora filters out your own administrator self-clicks server-side.
  • Terms of Service: https://clicksora.com/terms
  • Privacy Policy: https://clicksora.com/privacy

PostHog Session Replay (optional)

  • Service: PostHog, loaded on Clicksora’s behalf.
  • What it does: If — and only if — session replay is enabled server-side for your account (Pro/Enterprise plans), t.js additionally loads the PostHog recording library from https://us-assets.i.posthog.com and sends masked session recordings to https://us.i.posthog.com (or the PostHog host returned by /api/track/config). Recordings mask all input fields by default. If replay is disabled for your account, PostHog is never loaded.
  • Data transmitted (when enabled): Masked session recordings — page interactions, clicks, scrolls and network metadata — with input values masked. Controlled entirely from your Clicksora dashboard.
  • Privacy Policy: https://posthog.com/privacy

설치

  1. Upload the clicksora-click-fraud-protection folder to the /wp-content/plugins/ directory, or install directly through the WordPress plugins screen.
  2. Activate the plugin through the Plugins screen in WordPress.
  3. Go to Settings Clicksora in the WordPress admin.
  4. Enter your Tracking ID (a 16-character code such as aB3dEf6hJ9kLmN2p). Find it in your Clicksora Dashboard Settings Protected Domains.
  5. Click Save Tracking ID — you’re protected!

FAQ

Do I need a Clicksora account?

Yes. The plugin connects your WordPress site to Clicksora’s fraud detection engine. Sign up at clicksora.com.

Where do I find my Tracking ID?

Log into your Clicksora Dashboard, go to Settings Protected Domains, and copy the Tracking ID for your domain.

Does this slow down my site?

No. The tracking script is only 3KB and loads in the page head to ensure every ad click is captured — even from visitors who bounce quickly.

Does this track my own visits?

Your own admin visits are filtered out by Clicksora’s server-side detection (by IP and known patterns) so your reports stay clean. The tracker itself is emitted on every frontend page — this is deliberate, because stripping it for logged-in admins would break tracking on sites using a full-page cache (the admin’s cached page would then be served to real visitors without the tracker).

What ad platforms does Clicksora support?

Clicksora primarily protects Google Ads campaigns, with support for Microsoft Ads and Facebook Ads coming soon.

Is my data safe?

Yes. All data is encrypted in transit (TLS/SSL) and stored securely. See our Privacy Policy.

후기

이 플러그인에 대한 평가가 없습니다.

기여자 & 개발자

“Clicksora Click Fraud Protection”(은)는 오픈 소스 소프트웨어입니다. 다음의 사람들이 이 플러그인에 기여하였습니다.

기여자

자국어로 “Clicksora Click Fraud Protection”(을)를 번역하세요.

개발에 관심이 있으십니까?

코드 탐색하기는, SVN 저장소를 확인하시거나, 개발 기록을 RSS로 구독하세요.

변경이력

1.9.0

  • Fixed: Tracker and noscript pixel no longer skip output for logged-in administrators. That skip made the emitted HTML vary by login state, so under a full-page cache (WP Rocket/W3TC/LiteSpeed/Cloudflare APO) an admin-primed page could strip tracking for all visitors. Admin self-clicks are filtered by Clicksora server-side instead.
  • Fixed: The tracking script is now skipped on AMP pages (which strip arbitrary scripts); the valid noscript pixel still covers AMP views.
  • Fixed: The settings status box no longer claims “Protection Active” for any non-empty value. It distinguishes Not Connected, an invalid-looking Tracking ID, and a well-formed (but unverified) ID, and validates the real Tracking ID shape.
  • Fixed: Hardened option sanitization against a crafted array Tracking ID (prevents a PHP 8 TypeError).
  • Added: “Test Connection” button (admin-only, nonce-protected) that checks the Clicksora tracker is reachable and the Tracking ID is well-formed. It honestly notes it cannot verify the ID against your account.
  • Added: WooCommerce purchase conversion tracking on the order-received page (fires once per order via window.alm.purchase).
  • Added: referrerpolicy="no-referrer-when-downgrade" on the noscript pixel so GCLID/UTM attribution survives for no-JavaScript visitors.
  • Improved: External Services / privacy disclosure now documents all tracker endpoints and the optional PostHog session-replay hosts (us.i.posthog.com, us-assets.i.posthog.com).
  • Changed: “Requires at least” raised to WordPress 5.2 (required by wp_body_open).

1.8.0

  • Removed: Deprecated load_plugin_textdomain() call — WordPress.org auto-loads translations since WP 4.6
  • Improved: Plugin Check passes clean with zero errors

1.7.0

  • Added: load_plugin_textdomain() for proper translation loading
  • Added: Security index.php files to prevent directory listing
  • Fixed: Translation template .pot file updated with all translatable strings
  • Fixed: Readme “free trial” corrected to “14-day money-back guarantee”
  • Improved: Full WordPress Plugin Check compliance

1.6.0

  • Fixed: Constants now wrapped in defined() checks to prevent fatal errors
  • Fixed: Removed unnecessary escaping in wp_enqueue_script() and wp_enqueue_style() parameters
  • Fixed: Settings section callback now uses a proper named function
  • Fixed: Added wp_unslash() before sanitizing form input
  • Fixed: Noscript pixel moved from wp_head to wp_body_open with wp_footer fallback
  • Fixed: Uninstall cleanup now uses uninstall.php instead of register_uninstall_hook()
  • Fixed: CSS version synced with plugin version, removed duplicate header comments
  • Fixed: Removed frontend CSS class from admin-only stylesheet
  • Improved: Added @package PHPDoc tag to all files

1.5.0

  • CRITICAL FIX: Removed defer script loading strategy — deferred scripts execute AFTER HTML parsing, causing fast-bouncing ad visitors to leave before tracking activates (ghost clicks). Script now loads in <head> for immediate execution.
  • Fixed: Tracking script URL reference updated to app.clicksora.com/t.js
  • Fixed: Pixel URL updated to app.clicksora.com/api/track/pixel

1.3.0

  • Fixed: Text domain now correctly uses clicksora-click-fraud-protection throughout
  • Fixed: All output is properly escaped using esc_html(), esc_attr(), and esc_url()
  • Fixed: Script injection now uses wp_enqueue_script() instead of direct HTML output
  • Fixed: Inline styles replaced with external CSS file (css/admin.css)
  • Fixed: Added rel="noopener noreferrer" to all external links
  • Fixed: PHPDoc blocks added to all functions
  • Fixed: register_setting() now uses array configuration format
  • Improved: Sanitization uses sanitize_text_field() in addition to regex
  • Improved: Added proper width and height attributes to noscript pixel image

1.2.0

  • Added: Admin tracking skip — logged-in administrators are excluded from tracking
  • Added: defer attribute for non-blocking script loading
  • Added: Settings link on the Plugins page for quick access
  • Added: How-it-works guide panel on settings page
  • Added: Privacy policy link and version footer
  • Added: Uninstall cleanup — removes all options when plugin is deleted
  • Improved: Better input sanitization for Tracking ID

1.1.0

  • Added: Noscript pixel fallback for visitors with JavaScript disabled
  • Improved: Settings page UI with status indicator

1.0.0

  • Initial release
  • Tracking script injection via data-id attribute
  • Settings page with Tracking ID input

기초

평점

아직 제출된 리뷰가 없습니다.

Your review

모든 리뷰 보기

기여자

지원

할 말 있으신가요? 도움이 필요하신가요?

지원 포럼 보기