Click Fraud IP Blocklist Generator

Where to put this

Paste the IP addresses or CIDR ranges you have identified as sources of fraudulent clicks (from your ad platform's reports or server logs), choose your server type, and this generates the correctly formatted block rule - Apache 2.4's Require not ip syntax, the older Apache 2.2 Deny from syntax, or Nginx's deny directive. Add the Apache snippet to your site's .htaccess file, or the Nginx snippet to the relevant location or server block and reload Nginx.

Why blocking an IP at your own server only solves half the problem

A server-level block stops that specific IP from loading your pages at all going forward, which protects your site and its resources - but it has no effect on how an ad network's own fraud-detection system scores past or future clicks from that IP on their end. Both server-side blocking and reporting suspected fraud to the ad platform address genuinely different parts of the problem, which is why doing one doesn't substitute for the other.

Why Apache 2.4, Apache 2.2, and Nginx each need their own distinct syntax

Access control directives changed meaningfully between Apache versions (the newer Require syntax replaced the older Order/Deny syntax), and Nginx uses an entirely different configuration language from either - pasting Apache syntax into an Nginx config, or vice versa, simply won't work, which is why getting the server type right before generating the rule matters.

Why CIDR ranges matter alongside individual IP addresses

A fraud source is often not a single IP but a whole block controlled by the same proxy service or data-center provider - blocking a CIDR range (like 198.51.100.0/24) covers an entire block of addresses in one rule, which is far more effective against a persistent source than blocking individual IPs one at a time as they rotate within that same range.

Frequently asked questions

Will this stop click fraud from ad networks like Google Ads?

This only blocks those IPs from reaching your own server - it does not affect how an ad network itself detects and credits invalid clicks. Report suspected click fraud to your ad platform separately so they can issue credits.

How do I find which IPs to block?

Check your ad platform's click reports and your server access logs for IPs with unusually high click volume, no meaningful engagement, or requests from known data-center/proxy ranges.

Why do I need to pick the right server type before generating the rule?

Apache and Nginx use entirely different configuration syntax, and even Apache's own syntax changed between versions 2.2 and 2.4 - pasting the wrong format into your config simply won't work.

Why block a whole CIDR range instead of just the specific IP?

A persistent fraud source often controls or rotates through an entire block of addresses from the same proxy or data-center provider - blocking the whole range in one rule is more effective than chasing individual IPs as they rotate.

Do I need to restart my server after adding this to Nginx?

Yes - Nginx needs a reload (or restart) to pick up configuration changes, while Apache's .htaccess changes typically take effect on the next request without a restart.