Block reasons explained: what each label means
On this page
Every invalid click Tapper records carries a block reason, a short label such as Bot, VPN or Ad click limit exceeded that says why the visitor was flagged. A visitor can carry more than one reason.
Where you see block reasons
| Where | What it shows |
|---|---|
| Clicks page | The Block reason column and filter, one row per ad click |
| Exclusions page | The Block reason column per excluded visitor, and the Block reason field in the visitor drawer (No block reason when none was recorded) |
| Dashboard | The Block reason filter under Add filter; on Overview, the Clicks vs invalid traffic types over time chart; on the Invalid traffic tab, the Block reason trend chart and the Blocked traffic by block reason card; on Conversions, the Top Block Reason column of Keyword by conversion |
| Monthly reports | The Invalid Traffic Types section, one per platform |
| Refunds page | The Block reason tiers you pick for a Google refund report, and the reasons column in the file |
On a monitor-only workspace the reason labels stay the same, but the wording around them changes:
- Dashboard: the filter reads Invalid traffic reason, the two block reason cards become Invalid traffic reasons trend and Invalid traffic by invalid traffic type, and Top Block Reason reads Top Invalid Traffic Reason.
- The Exclusions page is titled Flagged traffic, in the sidebar and on the page.
- On the Clicks and Exclusions pages the column is named Invalid traffic, and the drawer field reads Invalid traffic type.
The reasons you see most
Suspicious click behavior
Our models found that the visit differs from how normal visitors behave on your site. It is a model's judgment, not a fixed rule.
Repeat suspicious clicks
Our model predicts that this visitor will keep clicking your ads without converting, like past visitors who did. It is a prediction, so it can flag a first visit.
Known threat
Our IP data provider marks the IP address as a threat, meaning it is linked to malicious activity such as attacks or abuse. To protect real customers on shared networks, Tapper does not flag a threat IP whose visit shows a lot of activity on your page.
Known threat is about the network address. Tampered device is about the device.
Location mismatch
The IP address is in a country your country rule excludes: on your block list, or missing from your allow list. Tapper reads the country from the IP address. A visitor on a VPN is judged on location only when Block VPN traffic is on. See Block or allow clicks by country.
Tampered device
The device's fingerprint contradicts itself. A browser reports its operating system, browser version, screen, graphics, fonts, language and time zone, and on a real device these fit together. Tapper flags details that cannot all be true at once, such as a browser claiming one operating system while its other signals belong to another. Emulators, anti-detect browsers and spoofing tools leave these contradictions when they disguise one machine as many visitors.
Other
The visitor was added to Tapper's invalid traffic audience in your ad account, but no reason could be matched to it for that day. It is still a flagged visitor, counted once under Other.
Reasons from your detection rules
You can change how often these fire, in a rule set (Setup > Rule sets).
| Label | What it means | Setting behind it |
|---|---|---|
| Ad click limit exceeded | The same visitor clicked your ads more times within a period than the ad click limits allow, for example more than 3 clicks within 10 minutes. Every IP address the visitor used carries this reason. See Set invalid click thresholds | Ad click limits (Click limits tab) |
| Suspicious ad click | The same visitor reached your suspicious ad clicks limit: that many recent visits with no activity on the page. Every IP address the visitor used carries this reason | Suspicious ad clicks |
| Instant bounce | Several of the visitor's recent visits were shorter than your minimum seconds on site. One short visit on its own is not enough | Minimum seconds on site |
| JavaScript disabled | A browser with JavaScript disabled clicked your ad | Block JavaScript-disabled browsers |
| VPN | The click came through a VPN | Block VPN traffic |
| Location mismatch | The IP is in a country your country rule excludes | Block by country (Countries tab) |
| Suspicious click behavior | Our models found that the visit differs from how normal visitors behave on your site. It is a model's judgment, not a fixed rule | Block suspicious click behavior |
| Blocked on another platform | The visitor was flagged on another ad platform | Block across ad platforms |
For each setting, see How Tapper decides a click is invalid.
Reasons that apply to every account
| Label | What it means |
|---|---|
| Aborted ad click | Most of the recent Google Ads clicks from this IP address never loaded your page. This check is the same for every account and skips mobile carrier addresses |
Reasons from IP intelligence
These have no switch of their own.
| Label | What it means |
|---|---|
| Data center | The IP belongs to a hosting or cloud provider, not a home, office or mobile connection |
| Proxy | The click came through a proxy service |
| Tor | The click came through a Tor exit node, which hides the visitor's real address |
| iCloud Private Relay | The click came through Apple's iCloud Private Relay |
| Anonymous | The IP belongs to a service that hides where the visitor really is |
| Known attacker | Blocklists list the IP as a source of attacks, malware or botnet traffic |
| Known abuser | Blocklists list the IP as a source of spam, harvesting, registration bots or other abuse |
| Known threat | Our IP data provider marks the IP address as a threat, meaning it is linked to malicious activity such as attacks or abuse |
| Unassigned IP address | The address is unallocated or reserved space that should never appear on the public internet |
| Suspicious network | The network the IP belongs to (its ASN, the block of addresses one operator runs) is associated with invalid traffic |
Reasons from device and browser signals
| Label | What it means |
|---|---|
| Bot | The visit shows signs of automation, such as a headless browser or an automation tool |
| Fake user agent | The browser identifies itself as something it is not |
| Suspicious screen resolution | The reported screen size is not one a real device has |
| Tampered device | The device's fingerprint contradicts itself, a sign of emulators and spoofing tools |
Other labels
- Aggregated range: when a Google campaign reaches Google's limit of 500 IP exclusions, Tapper can combine many excluded addresses that sit close together into one range exclusion, which carries this label. See The 500 IP exclusions per campaign limit in Google Ads.
- General labels such as Invalid traffic, Suspicious IP or Aggressive clicking: if one appears on a visitor you need to understand, contact support with the visitor id (see How to get help from Tapper).
Block reasons in the refund report
On the Refunds page, Block reason tiers group the reasons by how strong the evidence is for a Google Ads claim:
- Tier 1 - High confidence (Bot, Data center, Known attacker, Click fraud, Location mismatch): the only tier checked by default.
- Tier 2 - Supporting evidence (VPN, Proxy, Tor, Suspicious IP)
- Tier 3 - Weak signals (Suspicious click behavior, JavaScript disabled, Instant bounce)
Each tier holds more reasons than its label names. See Generate a Google Ads refund report.
Related
Was this helpful?
Still need help?
Chat with our team and mention this article.