Spam in leads: a full guide to protecting forms
What OWASP calls form spam, why a captcha and a single trap field do not close a submission, and the order to put on a form without expecting a refund from Direct.
10 min read
Blog
Articles about protecting ads from bots and click fraud
Leads and inquiries
Fraud in CPA networks: how partners fake leads
The OWASP catalog separates spam, metric skewing, and inflation of paid volume. How to mark a spam order in a CRM upload, and why mass signups are not password guessing.
6 min readUnqualified leads and how they relate to traffic quality
Yandex Direct does not treat an off-target form as invalid traffic. How to separate that lead from metric skewing, and what Metrica goals and CRM actually show.
5 min readWhat a honeypot field in a form actually does
A hidden empty field and a blocked robots.txt path are cheap OWASP checks. Why one of them is not a form defense, and where a visible captcha fits.
7 min readHow to protect a form from bots without a captcha
Three OWASP layers, a hidden field, email confirmation, and Turnstile. Where a captcha stays a fallback, and what a computational task does not undo.
6 min read
Click fraud basics
Protecting an online store’s ads: where the money goes
Where a store’s spend stays in the account: live shoppers with no interest, a repeat Thank-you page, a bad contact and a form filled for a bonus. What has already returned to the shared balance.
11 min readMyths about click fraud: what holds and what does not
Four persistent myths: a live person with no interest, a click spike, the Invalid clicks column, and the promise that a check catches everything.
12 min readCompetitors are click-fraudding the ads: what to do, step by step
What to do when clicks look like competitors: what Direct returns to the balance, what to send support, and why the Russian competition law does not name click fraud.
11 min read
Protection in ad accounts
Protecting YAN ads: a full guide
How to block YAN placements from the report, where the list limit sits, why the help text calls a manual review irrational, and how network CTR relates to the search price.
12 min read
Website bot protection
What a WAF is and how it differs from bot protection
A WAF is a rule set for the HTTP conversation, usually against XSS and SQL injection. Why Cloudflare documents bots on another page, and why one edge filter is not enough.
5 min readDDoS and bot traffic: what is different
A distributed network outage and automated application traffic are different events. Where the OWASP catalog draws the line, how NIST defines DDoS, and what the Cloudflare product covers.
5 min readScalper bots: buying out stock and booking slots
Scalping takes scarce goods in a way a person cannot repeat by hand. How that differs from a cart left unpaid, and the first controls OWASP names.
6 min readHow to protect prices and a catalog from scraping
robots.txt asks compliant clients to skip some addresses and does not control access. What a 429 does for Yandex's crawler, and which OWASP measures apply to scarce stock.
6 min read
Analytics and solutions
How to judge the effect of protection, before and after
Binetro's documents do not set a way to measure the effect on ad spend before and after. What end-to-end analytics can compare, and how observation differs from protection.
5 min readFalse positives: what to do when a real client is blocked
Binetro treats a wrong decision against a real person as worse than a missed bot. When a visit is allowed on failure, and how to lift a repeat-visit ban.
6 min readDoes a protection script slow the page down
The LCP, INP, and CLS thresholds are about page experience, not about a protection script. What the check does when no answer arrives, and why no time budget is set for the script.
7 min read
Bots and technology
Why a captcha does not stop bots
A captcha in Yandex Direct and in the OWASP catalog slows automation, but the test can be solved. How that differs from a browser proof-of-work task.
6 min readHow click bots that imitate behavior work
In public descriptions a click bot is a program that imitates an ordinary browse for a click or an impression. How that differs from a windowless browser, a botnet, and repeated human clicks.
6 min readWhat a bot farm is
In the MRC standard a click farm is organized non-robotic activity through many people or machines. How SIVT differs from routine GIVT, and why a solved captcha does not prove a person.
5 min read
Metrics and calculations
How to calculate a conversion
In Yandex Metrica, conversion is the share of goal visits, not a count of leads. How a visit differs from a goal completion, and how Direct labels CR and CPA.
7 min read