RESOURCES · EXPERTINI ATS

Click Fraud Protection

What actually happens to a click before it's counted as billable — and what's flagged rather than blocked, deliberately.

3 min read · Updated July 2026 · Expertini Editorial

Invalid traffic is a real, well-documented problem in digital advertising generally — industry estimates from the Association of National Advertisers put invalid programmatic traffic somewhere around 14–22% of the total, and click fraud is regularly estimated in the tens of billions of dollars annually worldwide. This page covers the general shape of that problem, then describes concretely what happens to a click on an Expertini Programmatic Job Ads campaign before it's counted as billable.

▶ Watch the 30-second overview — no sign-up needed

14–22%of programmatic ad traffic industry-wide estimated invalid, ANA 2023

6distinct checks a click passes through before being counted as billable

24hour deduplication window before a repeat click can be recharged

0charge applied for clicks flagged as bot traffic, duplicates, or exhausted/expired orders

01The general problem

Invalid clicks come from several sources: automated crawlers and bots that follow links across pages regardless of intent, duplicate clicks from the same visitor within a short window, and deliberately obscured traffic through Tor or commercial VPN services. None of these represent a genuine candidate evaluating a job — a platform that charges for them is charging for traffic that can't produce an application.

02What a click actually passes through before it's counted

A click on a Programmatic Job Ads order goes through a sequence of checks before it's marked delivered: the order must be active with budget and clicks remaining and not past its expiry date; the User-Agent is checked against a blocklist of known bot, crawler, and scraper signatures and must contain a recognised browser identifier; the visitor's IP must be a real, non-private address; and a SHA-256 hash of the IP, job, and campaign is checked against a 24-hour deduplication window so a repeat click from the same source within that window redirects the candidate without being recharged. That's six distinct checks a click passes through, not a single pass/fail gate.

03What's flagged rather than blocked, and why

Traffic from Tor exit nodes or VPN services is logged and flagged, not automatically blocked — because using a VPN isn't inherently fraudulent, and blocking it outright would reject legitimate candidates alongside anyone actually trying to game the system. Similarly, a click from a country different than the order's targeted country is logged for visibility rather than charged, since geographic mismatches can have innocent explanations. The system errs toward not charging for traffic it can't confidently verify, rather than either charging everything or blocking aggressively.

04What this protection doesn't cover

This click-verification pipeline applies to the Programmatic Job Ads tool specifically. Campaigns run through the Google Ads Connector or Microsoft Ads Integration live inside your own Google Ads or Microsoft Advertising account and are billed and protected by those platforms' own invalid-click detection systems, not this one — a structurally different arrangement worth understanding if you're running both types of campaigns side by side.

Frequently asked questions

Will I be charged for bot or crawler clicks?⌄

No — clicks are checked against a blocklist of known bot, crawler, and scraper User-Agent signatures, and traffic without a recognisable browser identifier is redirected without being counted or charged.

What counts as a duplicate click?⌄

A second click from the same IP address on the same job within a 24-hour window is treated as a duplicate — it's redirected to the job page but not recharged against the order.

Does using a VPN mean my click won't count?⌄

Not automatically. VPN and Tor traffic is logged and flagged for visibility, not blocked outright, since using a VPN isn't inherently fraudulent and blocking it would also reject legitimate candidates.

Does this protection apply to my Google Ads or Microsoft Ads campaigns too?⌄

No — those campaigns run inside your own Google Ads or Microsoft Advertising account and are covered by each platform's own invalid-click detection, not by this pipeline, which applies specifically to the Programmatic Job Ads tool.

At a glance

Six distinct checks before a click is counted as billable
Bot/crawler User-Agent blocklist rejects non-browser traffic before it's charged
SHA-256, 24-hour deduplication prevents repeat-click recharging
Tor/VPN traffic flagged for visibility, not auto-blocked — not inherently fraudulent
Foreign-country clicks logged, not charged, since mismatches can be innocent
Applies to Programmatic Job Ads specifically — Google/Microsoft campaigns use their own protection

See click fraud protection on your own hiring.

Bring a real job description to a 30-minute demo — free trial included.

Book a demo