內容簡介
Redkirin Ad Click Verification 是一款輕量級的廣告詐欺防範外掛，專注於確保轉換的完整性。它能驗證點擊是否來自真實用戶，避免自動化點擊被計入轉換數據中。
【主要功能】
• 驗證人類信號：記錄滑鼠移動、滾動及鍵盤活動
• 機器人信號檢測：識別自動化工具及爬蟲
• 點擊攔截：未驗證的點擊在窗口捕捉階段被阻止
• 表單提交驗證：確保表單提交來自真實用戶
• 應用內瀏覽器檢測：根據應用分類登陸
外掛標籤
開發者團隊
② 後台搜尋「Redkirin Ad Click Verification」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
日本語: 電話・LINE・メールのクリック、フォーム送信、広告着地を bot の不正クリックから守るアドフラウド対策プラグインです。管理画面は日本語に対応しています。
Headless browsers and ad-platform crawlers execute JavaScript and click links. When a site measures phone (tel:), LINE, email or other link clicks as GA4 events or Google Ads conversions (for example through a Google Tag Manager “Just Links” trigger), those automated clicks are counted as conversions. GA4’s built-in bot filtering is based on known bot lists and does not catch them.
Redkirin Ad Click Verification is a lightweight ad fraud countermeasure focused on conversion integrity. It verifies that a click comes from a real person before it reaches your tags:
Human signals – records mouse movement, scrolling, touch and keyboard activity plus time on page from the moment the page starts loading. A long stay on the page (default 5 s) counts as one signal, so a visitor who reads and then taps a fixed call button is measured while instant taps are not.
Bot signals – navigator.webdriver, headless / crawler user agents (editable regex list), automation tool globals, missing language settings, and Google’s published crawler IP ranges.
Click interception – unverified clicks are stopped at the window capture phase, before Google Tag Manager click triggers or inline onclick handlers see them. The navigation itself (dialing, opening LINE, following the link) is performed by the plugin, so visitors are never blocked.
dataLayer guard – gtm.linkClick / gtm.click and any event names you specify are dropped from dataLayer.push while the visitor is unverified.
Form submission verification – the same human verification applies to form submissions. Hidden fields carry the verdict for your CRM, verified submissions push rkacv_form_submit, submissions with definite bot signals are stopped (Contact Form 7 marks them as spam, WPForms rejects them), and thank-you pages only count when a verified form was submitted in the same session.
In-app browser detection – landings are classified by app (Yahoo! JAPAN, LINE, Facebook, Instagram, X, Google app, TikTok, generic WebView, …), so you can see which apps bot traffic comes from even without ValueTrack placements.
Wasted spend estimate – enter an average CPC (or per campaign) and the report shows bot landings x CPC per campaign and in total.
Evidence export – CSV of bot landings and blocked clicks for the Google Ads invalid click claim form.
Alerts – hourly check with email when the bot share of ad landings or repeated conversions from one click ID exceed your thresholds; optional daily digest.
Country restriction – allow-list or block-list of countries (all ISO countries, grouped by region, searchable). Measurement of phone / LINE / form clicks and verified events is withheld for restricted countries, optionally with an HTTP 403. The country comes from the Internet registries (RDAP) or a CDN country header, not from a third-party geolocation API; unknown countries are measured by default.
Page view protection – obvious bots (webdriver, bot user agents, automation globals) get no tags at all: every dataLayer push is dropped, so GTM and gtag.js send nothing, not even page_view. Once a visitor is verified, a rkacv_verified_pageview event is pushed that you can use as a key event instead of page_view (thank-you pages, landing pages).
Verified events – verified clicks push rkacv_verified_click to the dataLayer (with rkacv_link_type, rkacv_link_url, rkacv_link_text, rkacv_element_id), and can optionally call gtag('event', ...) directly.
Scope – protect only matched links (phone / LINE / email by default), every link, or every click including buttons.
Deny page access to bots (optional, off by default) – return HTTP 403 to IP ranges you registered and to headless browsers, automation tools and HTTP libraries. Search engine and ad review crawlers are never blocked. Optionally hide the page in the browser when navigator.webdriver is detected.
Repeat conversion suppression – one ad click (one gclid) can only produce a verified phone / LINE click once per link type within a window (default 30 minutes) and at most a daily limit per click ID (default 3) across tabs, devices and reloads. Stops manual or automated “conversion seeding” from a single paid click.
Every ad platform – click IDs from Google (gclid / gbraid / wbraid), Meta (fbclid), Yahoo! JAPAN (yclid), LINE (ldtag_cl), TikTok (ttclid), X (twclid) and Microsoft (msclkid) are recognised for ad landings and repeat suppression; the report breaks landings down by platform. A directly installed Meta Pixel or Yahoo tag is never loaded for obvious bots, and verified events can be sent to the Meta Pixel as custom events.
Ad traffic analysis – every visit arriving with an ad click parameter (gclid, gbraid, wbraid, …) is scored human / undetermined / bot and recorded with its campaign, placement and device (Google Ads ValueTrack parameters are read from the URL). The “Ad traffic” report shows the bot share per campaign and placement, repeat landings from the same IP or click ID, verified clicks per campaign, and an exportable list of IP ranges for Google Ads IP exclusions.
Dashboard widget – 7-day ad traffic (landings, bot share, undetermined, human, estimated waste, daily chart, top campaigns) and click summary with a daily chart, top block reasons and the latest blocked clicks.
Log – blocked and verified clicks are logged with the reason, so you can tune thresholds. IP addresses are anonymised by default. The log endpoint only accepts requests carrying a token signed by the site, is rate limited per IP and site-wide, and the table is capped and purged automatically.
Works with page caching plugins: nothing visitor-specific is embedded in the HTML. Server-side IP checks run through the REST API.
The admin UI is in English with a bundled Japanese translation (the plugin targets LINE-based lead generation common in Japan).
Google Analytics, Google Ads and Google Tag Manager are trademarks of Google LLC. LINE is a trademark of LY Corporation. This plugin is an independent product of Redkirin and is not affiliated with or endorsed by Google or LY Corporation; the names are used only to describe compatibility.
External services
This plugin can connect to three external services.
RDAP (network operator lookup) – When “Show the network operator next to IP addresses” is enabled (default: enabled), the plugin asks the public RDAP services of the Internet registries who the registered owner of an anonymised IP range is (mobile carrier, ISP, hosting provider, or the company holding a fixed-IP assignment) and caches the answer for 30 days. Japanese ranges are looked up at JPNIC (https://rdap.nic.ad.jp/ip/{range}, terms: https://www.nic.ad.jp/en/db/whois/), other ranges through https://rdap.org/ip/{range}, which forwards to the responsible regional registry. Only the anonymised /24 range (last octet zero) is sent, never a full visitor IP, and lookups happen on the server from WP-Cron or when an administrator opens the log. Service: https://about.rdap.org/ – registry terms: https://www.apnic.net/about-apnic/corporate-documents/documents/resource-management/apnic-whois-terms-and-conditions/
Google crawler IP ranges – When the “Google crawler IP check” option is enabled (default: enabled), the plugin downloads Google’s published crawler IP range lists once a day via WP-Cron, on plugin activation, and when an administrator clicks “Refresh” on the Log screen. The lists are cached in a transient. Only the server makes this request; no visitor data is sent to Google by the plugin.
https://developers.google.com/static/search/apis/ipranges/googlebot.json
https://developers.google.com/static/search/apis/ipranges/special-crawlers.json
https://developers.google.com/static/search/apis/ipranges/user-triggered-fetchers-google.json
Published by Google: https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot
Cloudflare IP ranges – Only when “Cloudflare mode” is enabled (default: off; the plugin offers it when it detects that the site is served through Cloudflare without the real visitor IP being restored), the plugin downloads Cloudflare’s published IP range list once a day from https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ and caches it for two days. No visitor data is sent; the list is used to verify that a request really comes from Cloudflare before the CF-Connecting-IP header is accepted as the visitor IP. Published by Cloudflare: https://www.cloudflare.com/ips/
Google terms of service: https://policies.google.com/terms – Privacy policy: https://policies.google.com/privacy
The plugin does not send anything to Google Analytics or Google Ads by itself; it only decides whether the tags you have already installed receive a click.
