Bots convert too. So ClickLens scores the conversion.
Bots make up the majority of web traffic, 51% in 2024, with malicious bots at 37%[1]. A blocked click costs you one click. A fake conversion costs you again every day, because your bidding algorithm reads it as a win and buys more of the traffic that produced it. ClickLens grades each conversion before it becomes truth in your reporting.
Key takeaways
- Bots are the majority of web traffic — 51% in 2024, 37% of it malicious (Imperva) — and the ones that convert train automated bidding to buy more of the traffic that produced them, so a fake conversion costs you long after the click.
- ClickLens grades every conversion on seven provenance signals — trusted submit, pointer path, fill timing, field-fill entropy — without reading a single field value.
- Each conversion gets one verdict: pass (do nothing), downweight (restate its value down), or retract (remove it). Absence of evidence always maps to pass.
- On Google and Microsoft Ads, ClickLens restates or retracts fake conversions keyed by click id, under a measured rollout with a 10% holdout. Meta and TikTok have no adjustment API, so retractions there are report-only.
A fake conversion poisons the algorithm that buys your traffic
Target CPA, target ROAS, Maximise Conversions, Advantage+: every automated bidding product works by looking at which clicks became conversions and buying more clicks like those. It has no way to ask whether a conversion was a person or a script that filled four fields in 90 milliseconds. Feed it fakes and it optimises toward the source of the fakes.
Blocking the click cannot fix this. The conversion has already fired and trained the bidder by the time any IP block lands. The only place to intervene is the conversion itself.
Why a conversion pixel can't tell
A conversion pixel fires when the thank-you page loads. It records that a conversion happened. It cannot record how it happened, because it never watched the form being filled or the journey that reached it. Two conversions that look identical to a pixel can be a customer and a headless browser.
ClickLens sits in the page as a first-party tag, so it observes the gesture that produced the conversion and the path that led there. That is the signal no impression-side tool can capture.
Seven provenance signals, and not one of them reads your forms
Provenance is meta-timing and structure: how the conversion came to exist, never what was entered. A human pasting into a form is focused on that field; a script is not. A person fills fields in a varied order; a bulk assignment has zero entropy.
Trusted submit
Whether the form-submit gesture was browser-trusted (event.isTrusted) or dispatched by a script.
Preceding pointer path
Whether any real pointer movement was sampled before the conversion fired.
Load-to-conversion time
Milliseconds from page load to the conversion call. A sub-second form fill is suspect.
Paste-without-focus count
Paste events that fired with no field focused, or with isTrusted false: a programmatic fill, never a person typing.
Keystroke field count
How many distinct fields actually received keystrokes.
Field-fill order entropy
The Shannon entropy of the fill sequence. A script assigning four fields at once has zero entropy; a person has measurable spread.
Interaction count
The total number of field interactions recorded during the session.
The privacy line is in the code, not the policy. The provenance block has no field for a value, a field name, or any user-entered text. Programmatic-paste detection and scripted-submit detection are contradiction-grade; soft signals such as an instant fill or a missing pointer path inform the score but never condemn a conversion on their own, because each has a real innocent cause.
The journey has to make sense too
Real purchase intent produces a coherent journey: dwell proportional to the content, a path that progresses rather than loops, no teleport straight to checkout. Weaponised automation either jumps to the high-intent page with no engagement or replays one identical path. ClickLens scores the shape of the journey, not any single page.
A single-page bounce carries no sequence to judge, so it is exempt and never penalised. A looped identical path or robotically uniform behaviour across pages is a contradiction. The same discipline applies whether the visitor is a person or a customer's own AI shopping agent: a coherent journey passes, an incoherent one is what reveals automation that has been hijacked.
Three verdicts, weighted by cost of error
Suspicion is not binary, so the action is not either. Each conversion resolves to one of three graded verdicts, and the bar rises with how much damage a mistake would do.
Pass
A coherent, trusted conversion, or one with no evidence against it. Pass means do no harm: the conversion stands and nothing is written back. Absence of signal always maps here, never to a suppression, because a false suppression starves real bidding signal.
Downweight
Positive suspicion, but not multi-signal-confirmed. The conversion is kept and its value restated downward, so the bidder stops over-valuing it. This is the default whenever ClickLens suspects but cannot prove.
Retract
At least two independent contradiction classes and a confidence above the 0.7 floor. The conversion is removed entirely. Retraction carries the highest bar in the engine because a false retraction is the costliest error: it deletes a real lead.
What counts as proof
Retraction needs at least two independent contradiction classes, not two flags. Three funnel flags are still one class. Counting classes is what makes "multi-signal" mean something:
The engine’s own judgement
The session scored as a bot, or it carries a cross-layer trust contradiction (a forged beacon, an inconsistent client-hint chain).
Conversion provenance
A programmatic paste into an unfocused field, or a fully scripted submit with no pointer path and no keystrokes.
Funnel coherence
A journey shape no human produces: the same URL looped across three or more pages, or robotically identical behaviour on every page.
The verdict is a pure function of stored signals: the session score, the provenance block, and the page-view journey. That means it is exactly recomputable, and every verdict on your dashboard lists the contradictions that produced it. There is no opaque model to take on faith.
The submit-time score is a prediction. Your CRM has the answer.
Whether a human filled the form is not the same question as whether the lead was worth money. A form-fill looks identical whether it becomes a customer or gets thrown out as spam. When your CRM marks a lead closed-won or disqualified, post that outcome to the ClickLens webhook and it reconciles against the conversion it already scored.
A disqualified lead becomes a retraction candidate so the bidder stops chasing junk. A closed-won lead cancels any pending suppression, so a real lead is never removed. That is unbiased ground truth the score could only predict. The webhook is signed with HMAC-SHA256 and verified in constant time.
Measured against ground truth, daily
Precision, recall and F1 are computed every day against verified outcomes: CRM-confirmed leads, disputes you file, honeypot catches and manually verified sessions. A conversion never overturns a stronger label, so a converting bot cannot whitewash itself into your ground truth.
A 10% holdout proves the lift
One in ten conversions is held out of any adjustment, untouched, as a control. Comparing the protected cohort against the holdout is how the effect of conversion protection is measured on your own account, rather than asserted.
No new detector touches your data on day one
Every gate ships in shadow mode first. It runs on real traffic, emits its flags and computes its verdicts, all visible on your dashboard, but it does not change a single platform conversion. Only after its false-positive rate has been measured on live traffic does enforcement turn on.
So today you can see the conversion verdicts and the adjustment ClickLens would make. The write-back that restates and retracts conversions on Google and Microsoft Ads is rolling out under exactly this discipline. We would rather show you a verdict we are not yet acting on than act on a verdict we have not yet proven.
What each platform allows
A verdict is only as useful as the platform's willingness to act on it. ClickLens reports honestly on what each ad platform's API can and cannot do.
| Platform | Adjustment API | What ClickLens can do |
|---|---|---|
| Google Ads | Documented click-id adjustment | Restate or retract, keyed by gclid |
| Microsoft Ads | Documented click-id adjustment | Restate or retract, keyed by msclkid (rolling out, not yet live in production) |
| Meta | Conversions API (forward-only) | Report-only — no per-click retraction exists |
| TikTok | Events API (forward-only) | Report-only — no per-click retraction exists |
Google and Microsoft expose a documented advertiser-side retract and restate keyed by click-id. Meta's Conversions API and TikTok's Events API are forward-only ingestion with no per-click retraction, so a retraction there is reported on your dashboard but cannot be synced. Write-back on the supported platforms is in measured rollout, as described above.
Conversion protection FAQ
What is conversion fraud?
Conversion fraud is a bot or script completing the action you optimise for: a form fill, a sign-up, an add-to-cart, a purchase. With bots now the majority of web traffic (Imperva put them at 51% in 2024), a share of completed conversions are automated rather than human. The damage is not the single wasted action; it is that your automated bidding reads the fake conversion as a success and steers more budget toward the source that produced it.
Why can’t a conversion pixel tell a fake conversion from a real one?
A pixel fires when the thank-you page loads. It records that a conversion happened, not how it happened. It cannot see whether a script pasted four fields in 90 milliseconds, whether a pointer ever moved, or whether the visitor teleported straight to checkout. ClickLens scores the conversion event itself and the journey that led to it.
Does conversion scoring read what visitors type into my forms?
No. ClickLens records meta-timing and structure only: whether the submit was browser-trusted, whether a pointer path preceded it, time from load to conversion, paste-without-focus events, how many fields received keystrokes, the entropy of the fill order, and the interaction count. There is deliberately no place in the data for a field value, a field name, or any user-entered text.
When is a conversion retracted rather than just downweighted?
Retraction requires at least two independent contradiction classes (the engine’s own bot or trust judgement, the conversion’s DOM provenance, and the funnel shape) plus a fraud confidence above 0.7. Two classes alone sit just under the floor, so corroboration from a bot-leaning session score is needed to tip into retraction. A strongly human-scored session resists it. Anything short of that bar downweights instead of retracting.
Does ClickLens change my Google or Meta conversion data today?
Every conversion is scored and its verdict is visible in your dashboard now. The write-back that restates or retracts conversions on Google and Microsoft Ads is rolling out under measured discipline: each new gate runs in shadow mode first, where the dashboard shows the adjustment it would make, and verdicts only change platform data once the false-positive rate has been measured on real traffic with a 10% holdout. Meta and TikTok have no per-click adjustment API, so retractions there are report-only, permanently.
Sources
- Imperva (Thales), “2025 Imperva Bad Bot Report” , 2025. Accessed 26 June 2026. imperva.com
See your conversions graded
Install the tag, report your conversions, and watch each one resolve to a verdict you can inspect. Start free with 1,000 sessions a month, no credit card required.