Blocking an IP address stops nobody — turning mobile data off and on defeats it in seconds. ClickHelm identifies the device itself, so someone you block stays blocked after they switch browser, clear their storage, or move to a different connection entirely.
No card required. Works on any WordPress site.
A competitor clicking your ad daily, a bot cycling through addresses, a click farm working a keyword. None of them ever buy, and all of them cost the same as a real customer. What makes them expensive is not the first click — it is the fortieth, from someone your tool decided it had already dealt with.
Identity comes from a device fingerprint worked out on your own server. Clearing cookies does not change it. Switching from Chrome to Safari does not change it. Moving from WiFi to mobile data does not change it.
The plugin ranks every visitor, explains its reasoning in plain language, and waits. You decide. Automatic blocking exists and stays switched off until you turn it on, because a wrongly blocked customer costs more than the click did.
Order values are read from the actual order on your server, so revenue counts even when a shopper blocks scripts. That is what makes genuine profit per campaign possible rather than a guess built from click counts.
Anyone can put a fake click id on a URL and make a campaign look like it is burning money. ClickHelm checks the shape of every click id, spots the same one replayed for different people, and keeps what it does not believe out of your figures — then tells you it happened.
Every visitor arrives with a score and the evidence behind it. No black box, no risk rating you have to take on faith.
Illustration of the ClickHelm dashboard. Layout is the real product; the figures are examples.
These are not categories borrowed from an industry glossary. Each one is a check the plugin runs on your own traffic, and each one is visible on the visitor it flagged, with the evidence beside it.
A competitor clicking your ad every morning. Blocking their address stops them for as long as it takes to turn mobile data off and on again — so ClickHelm identifies the device instead, and the block survives a new network, a new browser and cleared storage.
Ordinary customers do not arrive through a datacenter. Traffic that does is named — VPN, proxy, Tor, hosting — along with the network operator behind it, so you can see whether a spike came from a person or a rack.
Google charged you for a click and nobody ever loaded a page. Only your own site can know that, and only if something is watching. ClickHelm matches every charged click to the visitor it became, by the click id Google itself issued.
A user agent is a string anyone can send. ClickHelm compares what a crawler claims against who actually owns the address it came from, so a rented server calling itself Googlebot is named as an impostor rather than waved through.
A second on the page, no scrolling, no interaction, gone. Measured on your site, where it can be measured — no tool watching from outside can tell you what somebody did after the click.
The least ambiguous pattern there is: the same person clicking your ads several times inside a few minutes. You set the limit. Passing it raises their risk and flags them, and blocks them only if you explicitly ask for that.
Because a refund and a block are different things, and only one of them happens before the budget is spent.
Included with every account
On top of it, not instead of it
A WordPress plugin like any other. Paste your licence key and it starts recording immediately. No tags to add, no DNS to change, and no traffic routed through anybody else.
One authorisation and it reads your campaign names and what you were actually charged. Switch them on and it also adds its tracking template and keeps your exclusion list up to date. It never changes a campaign, a budget or a bid.
Visitors are scored and ranked with the reasons shown beside them. Blocking is your decision, one visitor at a time — or a rule you write, if you would rather it were automatic.
Four plans sized by how much traffic your site sees. You can move between them at any time, and the plan you are on never decides which protections you get.
Fingerprint blocking, the Google Ads figures, automatic exclusions, rules and reports are in every plan including the smallest. Nothing that matters is held back for a larger tier.
A clinic, a cleaning company, a law firm doing eight hundred visits a month is not being overcharged by the rest of this industry. It is not being sold to at all. Click fraud does not scale with your traffic — one competitor clicking your ad every morning costs a small advertiser proportionally far more than a large one.
On a budget of a thousand a month, losing twelve per cent is more than the plan costs. The same twelve per cent on a large account is an accounting note. Small budgets are where this arithmetic actually bites.
Fingerprint blocking, the Google Ads figures, automatic exclusions, rules and reports are in every plan including the first one. The plan decides how much traffic it covers, never which protections you get.
A large advertiser is fighting bot networks and click farms. A local business is usually fighting one person who knows exactly who you are — and that is the case device fingerprinting was built for, because they will come back on a different phone.
The Local plan is $29 a month for up to 2,000 visits. It exists because nothing else in this category is priced for a business that size, and because those are the accounts where a wasted click is felt.
Published measurements put wasted ad clicks between 6% and 20% of spend for most accounts — around 8.5% on average across the major platforms, nearer 6% in retail, higher in competitive categories. Put your monthly ad spend in and see the range you are exposed to.
–
is what that range comes to on your spend — money going to clicks that were never going to become a customer.
A range, not a prediction. It is an industry figure applied to your number, not a measurement of your account — the only thing that can measure your account is something watching your own traffic. Nothing here is sent anywhere; the arithmetic runs in your browser.
Everything in this category is sold on what it stops. Here is the other half, so you find out now rather than in month two.
The clicks you have already paid for are gone, and nothing recovers them. What changes is tomorrow. ClickHelm starts recording the day it is installed, so the week you spend deciding is a week you will never be able to look at.
There is no history to import and no backfill. Every day without it is a day of your own traffic you will never be able to examine — including the repeat clicker you do not know about yet.
Google only says which campaign a click came from if you ask it to, using a tracking template inside your Google Ads account. Clicks that arrive before you set it are counted as visits but never as campaign spend, and that month cannot be filled in afterwards.
The check runs against your own database on your own server, with no request to anybody else while a page loads. Classifying the visitor’s network does call out, and it happens in the background after the visitor has already been served — so it never costs a reader a millisecond.
No. Everything recorded stays in your WordPress database. The one thing that leaves is a visitor’s address, sent to be classified as a VPN, proxy or data centre — we relay it, keep none of them, and record only how many were classified. Mention it in your privacy policy.
Nothing is switched off and nothing is charged. Everyone you have blocked stays blocked and recording carries on. Blocking anyone new pauses until the month resets or you move up a plan, and you are told on screen before it becomes a surprise.
Everyone you have already blocked stays blocked, nothing you have recorded is deleted, and the plugin keeps watching. What stops is blocking anyone new, along with reports, rules and the Google Ads screens. The plugin says exactly that, in that much detail, on its own licence screen.
The campaign figures and the click matching are Google Ads. The detection and the blocking work on any traffic that reaches your site, whatever sent it — including Meta and Microsoft ads, though without their campaign data.
Nothing is blocked automatically unless you write a rule that says so. The plugin ranks and explains; you decide. And if a fingerprint match ever catches the wrong person, rejecting it on the Possible duplicates screen lifts the block immediately.
Google’s own screen will say “See, edit, create and delete your Google Ads accounts and data”, and that wording is Google’s rather than ours. The Google Ads API has one permission covering the whole account and no read-only version of it, so every tool that reads your campaigns has to ask for that same one — what differs is what each does with it. ClickHelm reads your reporting, and changes two things only if you switch them on: its tracking template, and an IP exclusion list of the visitors you blocked. Our server refuses any other kind of change. Exactly what is read and written is on the Google Ads data page.
No card, no call, no demo to sit through. Install it, watch a week of your own traffic, and decide with your own numbers in front of you.