Click fraud detection for local service ads: how ClickBeagle flags wasted Google Ads clicks
ClickBeagle records every paid visit to your site (a Google Ads, Microsoft Ads or Meta click id, or a paid UTM medium), scores it with seven explainable rules and groups risky clicks from one IP into a daily review case. Every flag shows which rule fired and why. Nothing is blocked automatically: you review the evidence, and ClickBeagle prepares a Google Ads IP exclusion only when you ask for one.
Why local service ads attract wasted clicks
Plumbers, roofers, HVAC companies and cleaners buy some of the most expensive clicks in search, in small areas, often against the same few competitors. That combination makes repeat clicks, automated traffic and out-of-area clicks more painful than in most industries: a handful of bad clicks can be a large share of a small daily budget. Google filters much invalid activity on its own side, but it does not show you per-visit evidence on your website. ClickBeagle looks at what each paid visitor actually did on the site.
What counts as a paid click
A visit is treated as a paid arrival when its landing URL carries a click id (gclid, gbraid, wbraid, fbclid or msclkid) or when utm_medium says it is paid (cpc, ppc, paid search, paid social, display, cpm, retargeting). The same click id reloaded in the same browser is counted once.
The rules and their weights
Each paid arrival gets a score from the rules below. Every fired rule is stored with its input, its data source, its weight and the rule version, so the score can always be explained.
| Rule | What it checks | Weight |
|---|---|---|
| Repeat IP | Paid arrivals from the same IP in 24 hours reach your threshold (3 by default) | +35, or +50 at twice the threshold |
| Automation | The browser reports automation (navigator.webdriver) or a headless user agent | +45 |
| Click id reuse | One ad click id shows up in more than one browser | +30 |
| Hosting or VPN network | The IP belongs to a cloud host or VPN provider (AWS, Azure, DigitalOcean, OVH, Hetzner, NordVPN and similar) | +20 |
| Outside your market | The visitor's country is not one of the countries you advertise in (approximate, from the IP) | +15 |
| Instant exit | One page, under 3 seconds of activity, no further interaction | +10 |
| Lead in the visit | The visitor sent a form or your CRM reported a conversion for the visit | −40 (counter-signal) |
From score to risk level
- High: score of 50 or more, with at least one strong rule (weight 20 or more).
- Review: score of 30 or more, with at least one strong rule.
- Low: everything else. A single weak signal, such as a VPN or a short visit, is never enough for review on its own.
- Insufficient data: no IP and no automation signal, so there is nothing to judge.
- Allowlisted: the IP, campaign or source is on your allowlist.
Engagement is only known after a visit ends, so arrivals from the last day are re-scored every hour. A visit that later turns into a lead drops in risk, and a case that contains a confirmed lead gets no exclusion proposal without a separate review.
Review cases: what you do with a flag
Review and high arrivals from the same IP on the same day are grouped into one case, together with that IP's earlier low-risk arrivals, so you see the whole pattern instead of scattered rows. For each case you can:
- mark it reviewed or a false positive;
- allow the IP for 30 days (your own office, a regular customer, an agency checking ads);
- propose an IP exclusion for Google Ads, which prepares the exclusion with the affected campaigns but applies nothing by itself.
Every action needs a short reason, which stays with the case, and allowlist entries and exclusion proposals are written to the audit log, so a second person can see why an IP was excluded or allowed.
Why explainable rules beat a black-box score
Many visitors share IP addresses: mobile carriers, offices and apartment buildings put many people behind one address. A tool that silently blocks “bad” IPs can quietly exclude real customers. ClickBeagle runs in observe mode: rules flag and explain, and a person decides. That is slower than automatic blocking, and it is deliberate. Suspicion is an inference from your site's data, not a verdict from Google.
Privacy of IP data
Full IP addresses are stored encrypted and removed after 7 days; matching uses a keyed hash. The dashboard and the MCP server show IPs masked (for example 203.0.113.*).
What ClickBeagle does not claim
- It does not estimate “money saved”. Your ad platform knows the real cost of each click; ClickBeagle shows evidence per visit.
- It only sees clicks whose landing page loaded the ClickBeagle counter. Clicks that never reach your site are invisible to it.
- Country matching is approximate, so the market rule has a low weight and is off until you set your markets.
To see how click scoring fits next to lead attribution and session replay, read our comparison of analytics tools for local businesses, or see the feature overview.
FAQ
Does ClickBeagle block fraudulent clicks automatically?
No. It flags and explains risky clicks and prepares Google Ads IP exclusions only when you propose one. Nothing is applied by itself.
What makes a click high risk?
A score of 50 or more that includes at least one strong signal, such as repeat clicks from one IP, browser automation or a reused click id. A lead in the same visit lowers the score by 40.
Can a real customer be flagged?
Yes, especially on shared IPs. That is why a single weak signal never triggers review, a lead lowers the risk, and you can mark false positives or allow an IP for 30 days.
Does it work for Meta and Microsoft Ads too?
Paid arrivals with fbclid or msclkid, or with a paid utm_medium, are scored the same way. Exclusion proposals are prepared for Google Ads.
How long are IP addresses kept?
Full IPs are stored encrypted and removed after 7 days. Matching uses a keyed hash and the dashboard shows masked IPs.
See which ads bring real customers
Leads with their source, session replay, click checks and bot analytics. Set up in 2 minutes, free while in beta.
Start free