| 开发者 | clicksora |
|---|---|
| 更新时间 | 2026年11月12日 23:01 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
clicksora-click-fraud-protection folder to the /wp-content/plugins/ directory, or install directly through the WordPress plugins screen.aB3dEf6hJ9kLmN2p). Find it in your Clicksora Dashboard → Settings → Protected Domains.Yes. The plugin connects your site to Clicksora's detection engine; the dashboard, the blocking and the Google Ads sync live there. Start at clicksora.com.
Log in to your Clicksora dashboard, open Settings → Protected Domains, and copy the 16-character Tracking ID for the domain this WordPress site serves.
The tracker is about 4 KB compressed and is loaded in the page head so that a visitor who bounces in under a second is still recorded. Clicksora's own marketing pages, which carry the same tracker, score 90+ on mobile in Lighthouse; the plugin adds no styles, fonts or images to the front end.
No. The plugin records; Clicksora decides; Google Ads does the blocking through IP exclusions, which stop the same address from being served (and billed for) your ad again. Your pages are never altered and no visitor is turned away by the plugin.
Clicksora is built around not doing that. A click from a home or mobile address inside your target market is never blocked on one click alone; it needs hard evidence (a hosting network, a replayed click ID, a repeat pattern you set), and a verified conversion from an address lifts a block. The dashboard shows the reason for every block so you can judge it.
The tracker is emitted for everyone, including logged-in administrators, so that cached pages stay identical for all visitors. Your own addresses are filtered on Clicksora's side: add them under IP Management → Internal IPs in the dashboard and they are recorded as internal traffic, never scored and never synced.
Google Ads (including the Google Ads IP exclusion sync), Meta Ads, Microsoft Ads, TikTok Ads and LinkedIn Ads clicks are recognised by their click parameters. Automatic exclusions are written to Google Ads; the other platforms are reported.
Yes. On the order-received page the plugin reports the order total, currency and order number to Clicksora once per order, so a purchase can be verified against the click that produced it.
Yes. The tracker is emitted for every visitor, so WP Rocket, W3 Total Cache, LiteSpeed Cache, Cloudflare APO and similar full-page caches serve the same HTML to everyone and protection is never stripped.
The tracker records click and device metadata (IP address, user agent, referrer, ad click parameters, on-page interaction) for fraud prevention, which is a legitimate-interest purpose; no contact details are read from your pages, and lead identifiers you choose to pass are hashed before storage. Session replay is off unless you enable it in the dashboard, and inputs are masked when it is on. Review Clicksora's privacy policy and your own notice before enabling it.
Data is encrypted in transit and at rest and is only ever shown in your own dashboard. See the privacy policy and the security page.
No. The plugin can check that the Tracking ID is well-formed and that the tracker is reachable (the Test Connection button); it cannot check that the ID belongs to your account. Confirm that in the Clicksora dashboard, where your domain shows its first clicks within minutes of installing.
window.alm.purchase).referrerpolicy="no-referrer-when-downgrade" on the noscript pixel so GCLID/UTM attribution survives for no-JavaScript visitors.us.i.posthog.com, us-assets.i.posthog.com).wp_body_open).load_plugin_textdomain() call — WordPress.org auto-loads translations since WP 4.6load_plugin_textdomain() for proper translation loadingindex.php files to prevent directory listing.pot file updated with all translatable stringsdefined() checks to prevent fatal errorswp_enqueue_script() and wp_enqueue_style() parameterswp_unslash() before sanitizing form inputwp_head to wp_body_open with wp_footer fallbackuninstall.php instead of register_uninstall_hook()@package PHPDoc tag to all filesdefer script loading strategy — deferred scripts execute AFTER HTML parsing, causing fast-bouncing ad visitors to leave before tracking activates (ghost clicks). Script now loads in <head> for immediate execution.app.clicksora.com/t.jsapp.clicksora.com/api/track/pixelclicksora-click-fraud-protection throughoutesc_html(), esc_attr(), and esc_url()wp_enqueue_script() instead of direct HTML outputcss/admin.css)rel="noopener noreferrer" to all external linksregister_setting() now uses array configuration formatsanitize_text_field() in addition to regexwidth and height attributes to noscript pixel imagedefer attribute for non-blocking script loading