Pay less per click – and nothing for clicks that were never going to buy

What protection does for Shopping traffic

The protection hooks into clicks that land on your product pages. Every visit coming via an ad is checked: where it came from, how it behaves, if the pattern repeats. Suspicious IP addresses are then automatically added to your Google Ads account's exclusion list.

Automatically is the crucial part here. Doing the same work manually means: reading logs, noting down IPs, adding them to your account, then a week later realising the bot is using different addresses. No one can keep that up for months.

• Bots and crawlers: automated accesses that scrape prices and availability, incurring click costs.
• Click farms: many clicks from a few networks, often within seconds and with no interaction on the page.
• Recurring competitor clicks: the same source, always the same products, never a basket.

Standard Shopping: where blocking fully applies

In classic Shopping campaigns, the chain works right to the end. An IP is recognised, added to the exclusion list, and the user no longer sees the ad. No impression, no click, no cost. This happens in real-time, not as a monthly report.

In practice, this means if you have a campaign with a high CPC and weak conversion rate, you'll see the effect there first. The number of clicks will drop slightly, the conversion rate will rise, and the budget will be distributed to visits that actually might buy.

Performance Max and Smart Shopping: detection yes, blocking only partial

We need to be honest here. Invalid traffic is also detected and logged in Performance Max. However, Google Ads doesn't allow IP exclusion lists at campaign level for Performance Max and Smart Shopping. Google sets this limit, not the protection.

What still happens: the suspicious IPs go into the account-wide exclusion list. This means those users are excluded from your Search and Display campaigns, so they won't find you via the next channel. Plus, you get logs you can use to claim refunds for invalid clicks directly from Google.

If you primarily work with Performance Max, you should understand this: the benefit is less about immediate blocking, and more about visibility into traffic and refunds. For an account with classic Shopping campaigns, the effect is more direct.

What to set up in your shop

Three things need to come together, otherwise the protection lacks data. Setup is part of the booking, but you should know what's involved.

1. 1Account-level tracking template: this appends parameters to ad clicks so each visit can be assigned to the correct campaign. Be careful if there's already a template in the account, for example from an Analytics setup: it needs to be merged, not overwritten.
2. 2Tracking code in your shop: a script in the template that records visitor behaviour on the page. In Shopify, WooCommerce, or Magento, this takes minutes; for custom systems, you'll need a developer once.
3. 3API connection to your Google Ads account: this is how exclusions are set without anyone manually entering IPs. Without this connection, the protection remains a reporting tool.

Allow one to two weeks for reliable evaluation. Before that, the system simply doesn't know what constitutes normal visitor behaviour in your shop. A furniture retailer with long consideration times looks different from a shop selling consumables.

Why the combination achieves more than each half alone

Through our CSS, you enter the same auction with around 20% more bidding power, because the margin Google usually retains stays in your bid. This lowers the price per click. Protection reduces the number of clicks that bring you no value. Both tackle the same thing – your budget – but from two sides.

An example with round numbers: £5,000 Shopping budget per month, £1 CPC, so 5,000 clicks. With CSS, you pay about £0.80 for the same visibility and get 6,250 clicks. If 8% of these are invalid traffic and are removed, you're left with about 5,750 genuine visits instead of 4,600 in the initial state. The percentages are examples; the mechanism is always the same.

The order is still clear: CSS first, because it works immediately and without campaign changes. Protection comes in if traffic gives reason, which you usually spot by visit duration.

Where to start

1. 1Link your Merchant Center to the CSS; campaigns continue to run unchanged.
2. 2Collect two weeks of reference data: note CPC, conversion rate, and visit duration per campaign.
3. 3Mark suspicious campaigns, usually those with a high CPC and bounce rate over 90%.
4. 4Add protection, install the tracking template and code, establish the API connection.
5. 5After two weeks, check the exclusions: which networks were blocked, has the proportion changed for Standard Shopping.
6. 6Review logs for Performance Max and submit refund requests to Google if the volume makes it worthwhile.

Frequently Asked Questions