Title: Clicksora Click Fraud Protection
Author: clicksora
Published: <strong>3 avril 2026</strong>
Last modified: 29 juillet 2026

---

Recherche d’extensions

![](https://ps.w.org/clicksora-click-fraud-protection/assets/banner-772x250.png?
rev=3626552)

![](https://ps.w.org/clicksora-click-fraud-protection/assets/icon-256x256.png?rev
=3626552)

# Clicksora Click Fraud Protection

 Par [clicksora](https://profiles.wordpress.org/clicksora/)

[Télécharger](https://downloads.wordpress.org/plugin/clicksora-click-fraud-protection.1.9.0.zip)

 * [Détails](https://fr.wordpress.org/plugins/clicksora-click-fraud-protection/#description)
 * [Avis](https://fr.wordpress.org/plugins/clicksora-click-fraud-protection/#reviews)
 *  [Installation](https://fr.wordpress.org/plugins/clicksora-click-fraud-protection/#installation)
 * [Développement](https://fr.wordpress.org/plugins/clicksora-click-fraud-protection/#developers)

 [Support](https://wordpress.org/support/plugin/clicksora-click-fraud-protection/)

## Description

**Clicksora** is the easiest way to protect your PPC ad campaigns from click fraud,
bots, and competitors wasting your ad budget.

This official WordPress plugin automatically injects the Clicksora tracking snippet
into your site. Simply enter your Tracking ID and your ads are protected — no code
editing required.

#### Key Features

 * **Real-time click fraud detection** — Identifies fraudulent clicks the moment
   they happen
 * **Automatic IP blocking** — Blocks bad IPs and syncs exclusions to your Google
   Ads account
 * **Bot detection** — Filters out automated bot traffic before it costs you money
 * **Lightweight** — Only 3KB tracking script loaded in the page head, minimal impact
   on page speed
 * **Cache-safe** — Works correctly behind full-page caches (WP Rocket, W3TC, LiteSpeed,
   Cloudflare APO); your own admin visits are filtered out by Clicksora server-side,
   so the page HTML never varies by login state
 * **WooCommerce compatible** — Tracks real purchases on the order-received page
   and reports order value + currency to Clicksora
 * **One-click setup** — Just paste your Tracking ID and save

#### How It Works

 1. Install and activate the plugin
 2. Enter your Clicksora Tracking ID (found in your [Clicksora Dashboard](https://app.clicksora.com))
 3. The tracking script loads automatically on every page
 4. Clicks from ads are analyzed in real-time
 5. Fraudulent IPs are blocked and synced to your Google Ads
 6. View everything in your [Clicksora Dashboard](https://app.clicksora.com)

#### Who Is This For?

 * Businesses running Google Ads campaigns
 * Marketing agencies managing PPC for clients
 * E-commerce stores protecting their ad spend
 * Anyone who wants to stop paying for fake clicks

**A Clicksora account is required.** Sign up at [clicksora.com](https://clicksora.com)—
all plans include a 14-day money-back guarantee.

### External Services

This plugin connects to the following external services operated by Clicksora:

#### Clicksora Tracking API

 * **Service:** [Clicksora](https://clicksora.com)
 * **What it does:** The plugin loads a lightweight tracking script (`https://app.
   clicksora.com/t.js`) on your site’s frontend pages. This script analyzes incoming
   ad clicks to detect click fraud in real-time. It communicates with the following
   Clicksora endpoints:
    - `https://app.clicksora.com/api/track/click` — click, page-load and page-exit
      signals used for fraud analysis.
    - `https://app.clicksora.com/api/track/pixel` — a `<noscript>` fallback pixel
      for visitors with JavaScript disabled.
    - `https://app.clicksora.com/api/track/config` — read on each page load to determine
      whether session replay is enabled for your account.
    - `https://app.clicksora.com/api/track/conversion` — conversion events (for 
      example WooCommerce purchases) when you or the plugin fire them.
    - `https://app.clicksora.com/api/track/session-recording` — links a session 
      replay to its click when replay is enabled.
 * **Data transmitted:** Click and device metadata including IP address, user agent,
   referrer URL, UTM/GCLID ad parameters, a lightweight browser fingerprint, on-
   page interaction signals (scroll depth, mouse/keyboard activity), and timestamps.
   For WooCommerce conversions, the order total, currency and order ID are sent.
   No names, emails, or passwords are collected by the plugin.
 * **When data is sent:** On every frontend page load. The tracker is emitted for
   all visitors (including logged-in admins) so it stays correct behind full-page
   caches; Clicksora filters out your own administrator self-clicks server-side.
 * **Terms of Service:** [https://clicksora.com/terms](https://clicksora.com/terms)
 * **Privacy Policy:** [https://clicksora.com/privacy](https://clicksora.com/privacy)

#### PostHog Session Replay (optional)

 * **Service:** [PostHog](https://posthog.com), loaded on Clicksora’s behalf.
 * **What it does:** If — and only if — session replay is enabled server-side for
   your account (Pro/Enterprise plans), `t.js` additionally loads the PostHog recording
   library from `https://us-assets.i.posthog.com` and sends masked session recordings
   to `https://us.i.posthog.com` (or the PostHog host returned by `/api/track/config`).
   Recordings mask all input fields by default. If replay is disabled for your account,
   PostHog is never loaded.
 * **Data transmitted (when enabled):** Masked session recordings — page interactions,
   clicks, scrolls and network metadata — with input values masked. Controlled entirely
   from your Clicksora dashboard.
 * **Privacy Policy:** [https://posthog.com/privacy](https://posthog.com/privacy)

## Installation

 1. Upload the `clicksora-click-fraud-protection` folder to the `/wp-content/plugins/`
    directory, or install directly through the WordPress plugins screen.
 2. Activate the plugin through the **Plugins** screen in WordPress.
 3. Go to **Settings  Clicksora** in the WordPress admin.
 4. Enter your Tracking ID (a 16-character code such as `aB3dEf6hJ9kLmN2p`). Find it
    in your [Clicksora Dashboard](https://app.clicksora.com/dashboard/settings)  Settings
    Protected Domains.
 5. Click **Save Tracking ID** — you’re protected!

## FAQ

### Do I need a Clicksora account?

Yes. The plugin connects your WordPress site to Clicksora’s fraud detection engine.
Sign up at [clicksora.com](https://clicksora.com).

### Where do I find my Tracking ID?

Log into your [Clicksora Dashboard](https://app.clicksora.com), go to Settings  
Protected Domains, and copy the Tracking ID for your domain.

### Does this slow down my site?

No. The tracking script is only 3KB and loads in the page head to ensure every ad
click is captured — even from visitors who bounce quickly.

### Does this track my own visits?

Your own admin visits are filtered out by Clicksora’s server-side detection (by 
IP and known patterns) so your reports stay clean. The tracker itself is emitted
on every frontend page — this is deliberate, because stripping it for logged-in 
admins would break tracking on sites using a full-page cache (the admin’s cached
page would then be served to real visitors without the tracker).

### What ad platforms does Clicksora support?

Clicksora primarily protects Google Ads campaigns, with support for Microsoft Ads
and Facebook Ads coming soon.

### Is my data safe?

Yes. All data is encrypted in transit (TLS/SSL) and stored securely. See our [Privacy Policy](https://clicksora.com/privacy).

## Avis

Il n’y a aucun avis pour cette extension.

## Contributeurs/contributrices & développeurs/développeuses

« Clicksora Click Fraud Protection » est un logiciel libre. Les personnes suivantes
ont contribué à cette extension.

Contributeurs

 *   [ clicksora ](https://profiles.wordpress.org/clicksora/)

[Traduisez « Clicksora Click Fraud Protection » dans votre langue.](https://translate.wordpress.org/projects/wp-plugins/clicksora-click-fraud-protection)

### Le développement vous intéresse ?

[Parcourir le code](https://plugins.trac.wordpress.org/browser/clicksora-click-fraud-protection/),
consulter le [SVN dépôt](https://plugins.svn.wordpress.org/clicksora-click-fraud-protection/),
ou s’inscrire au [journal de développement](https://plugins.trac.wordpress.org/log/clicksora-click-fraud-protection/)
par [RSS](https://plugins.trac.wordpress.org/log/clicksora-click-fraud-protection/?limit=100&mode=stop_on_copy&format=rss).

## Journal des modifications

#### 1.9.0

 * Fixed: Tracker and noscript pixel no longer skip output for logged-in administrators.
   That skip made the emitted HTML vary by login state, so under a full-page cache(
   WP Rocket/W3TC/LiteSpeed/Cloudflare APO) an admin-primed page could strip tracking
   for all visitors. Admin self-clicks are filtered by Clicksora server-side instead.
 * Fixed: The tracking script is now skipped on AMP pages (which strip arbitrary
   scripts); the valid noscript pixel still covers AMP views.
 * Fixed: The settings status box no longer claims « Protection Active » for any
   non-empty value. It distinguishes Not Connected, an invalid-looking Tracking 
   ID, and a well-formed (but unverified) ID, and validates the real Tracking ID
   shape.
 * Fixed: Hardened option sanitization against a crafted array Tracking ID (prevents
   a PHP 8 TypeError).
 * Added: « Test Connection » button (admin-only, nonce-protected) that checks the
   Clicksora tracker is reachable and the Tracking ID is well-formed. It honestly
   notes it cannot verify the ID against your account.
 * Added: WooCommerce purchase conversion tracking on the order-received page (fires
   once per order via `window.alm.purchase`).
 * Added: `referrerpolicy="no-referrer-when-downgrade"` on the noscript pixel so
   GCLID/UTM attribution survives for no-JavaScript visitors.
 * Improved: External Services / privacy disclosure now documents all tracker endpoints
   and the optional PostHog session-replay hosts (`us.i.posthog.com`, `us-assets.
   i.posthog.com`).
 * Changed: « Requires at least » raised to WordPress 5.2 (required by `wp_body_open`).

#### 1.8.0

 * Removed: Deprecated `load_plugin_textdomain()` call — WordPress.org auto-loads
   translations since WP 4.6
 * Improved: Plugin Check passes clean with zero errors

#### 1.7.0

 * Added: `load_plugin_textdomain()` for proper translation loading
 * Added: Security `index.php` files to prevent directory listing
 * Fixed: Translation template `.pot` file updated with all translatable strings
 * Fixed: Readme « free trial » corrected to « 14-day money-back guarantee »
 * Improved: Full WordPress Plugin Check compliance

#### 1.6.0

 * Fixed: Constants now wrapped in `defined()` checks to prevent fatal errors
 * Fixed: Removed unnecessary escaping in `wp_enqueue_script()` and `wp_enqueue_style()`
   parameters
 * Fixed: Settings section callback now uses a proper named function
 * Fixed: Added `wp_unslash()` before sanitizing form input
 * Fixed: Noscript pixel moved from `wp_head` to `wp_body_open` with `wp_footer`
   fallback
 * Fixed: Uninstall cleanup now uses `uninstall.php` instead of `register_uninstall_hook()`
 * Fixed: CSS version synced with plugin version, removed duplicate header comments
 * Fixed: Removed frontend CSS class from admin-only stylesheet
 * Improved: Added `@package` PHPDoc tag to all files

#### 1.5.0

 * CRITICAL FIX: Removed `defer` script loading strategy — deferred scripts execute
   AFTER HTML parsing, causing fast-bouncing ad visitors to leave before tracking
   activates (ghost clicks). Script now loads in `<head>` for immediate execution.
 * Fixed: Tracking script URL reference updated to `app.clicksora.com/t.js`
 * Fixed: Pixel URL updated to `app.clicksora.com/api/track/pixel`

#### 1.3.0

 * Fixed: Text domain now correctly uses `clicksora-click-fraud-protection` throughout
 * Fixed: All output is properly escaped using `esc_html()`, `esc_attr()`, and `
   esc_url()`
 * Fixed: Script injection now uses `wp_enqueue_script()` instead of direct HTML
   output
 * Fixed: Inline styles replaced with external CSS file (`css/admin.css`)
 * Fixed: Added `rel="noopener noreferrer"` to all external links
 * Fixed: PHPDoc blocks added to all functions
 * Fixed: `register_setting()` now uses array configuration format
 * Improved: Sanitization uses `sanitize_text_field()` in addition to regex
 * Improved: Added proper `width` and `height` attributes to noscript pixel image

#### 1.2.0

 * Added: Admin tracking skip — logged-in administrators are excluded from tracking
 * Added: `defer` attribute for non-blocking script loading
 * Added: Settings link on the Plugins page for quick access
 * Added: How-it-works guide panel on settings page
 * Added: Privacy policy link and version footer
 * Added: Uninstall cleanup — removes all options when plugin is deleted
 * Improved: Better input sanitization for Tracking ID

#### 1.1.0

 * Added: Noscript pixel fallback for visitors with JavaScript disabled
 * Improved: Settings page UI with status indicator

#### 1.0.0

 * Initial release
 * Tracking script injection via data-id attribute
 * Settings page with Tracking ID input

## Méta

 *  Version **1.9.0**
 *  Dernière mise à jour **il y a 3 mois**
 *  Installations actives **Moins de 10**
 *  Version de WordPress ** 5.2 ou plus **
 *  Testé jusqu’à **6.9.10**
 *  Version de PHP ** 7.4 ou plus **
 *  Langue
 * [English (US)](https://wordpress.org/plugins/clicksora-click-fraud-protection/)
 * Étiquettes
 * [ad protection](https://fr.wordpress.org/plugins/tags/ad-protection/)[click-fraud](https://fr.wordpress.org/plugins/tags/click-fraud/)
   [fraud detection](https://fr.wordpress.org/plugins/tags/fraud-detection/)[google ads](https://fr.wordpress.org/plugins/tags/google-ads/)
   [ppc protection](https://fr.wordpress.org/plugins/tags/ppc-protection/)
 *  [Vue avancée](https://fr.wordpress.org/plugins/clicksora-click-fraud-protection/advanced/)

## Évaluations

Aucun avis n’a encore été envoyé.

[Votre avis](https://wordpress.org/support/plugin/clicksora-click-fraud-protection/reviews/#new-post)

[Tout voir](https://wordpress.org/support/plugin/clicksora-click-fraud-protection/reviews/)

## Contributeurs

 *   [ clicksora ](https://profiles.wordpress.org/clicksora/)

## Support

Quelque chose à dire ? Besoin d’aide ?

 [Voir le forum de support](https://wordpress.org/support/plugin/clicksora-click-fraud-protection/)