Automations

Automations are custom rules you write. Each rule watches some kind of traffic (source) hitting some part of your account (target), and when a threshold condition is met, runs one or more actions. They sit on top of the built-in detection — useful for catching patterns specific to your business that the AI doesn't know about.

When to use automations

The built-in detection in Protection settings handles common cases (bots, VPNs, suspicious behavior). Reach for automations when:

• A specific pattern keeps slipping through and you can describe it as a rule.
• You want to label fraudulent clicks for reporting without blocking them.
• You're an agency and want one client's protection to be stricter than another's.
• You want a custom delay before action (e.g. wait 5 minutes to confirm the pattern persists before acting).

The rule model

Every rule has the same parts:

Source — what to track

Target — where the activity is happening

Criteria — the threshold type

The form's Criteria dropdown has three choices, each pairing differently with your Source and Target:

Threshold + period

How many events (e.g. 3 clicks), what period (e.g. 1 hour). For Share of bad traffic exceeds threshold rules, also a share value (e.g. 50% of at least 10 clicks).

Actions — what happens when the rule fires

Pick one or more:

Resolve status (optional)

Override what the system marks the final session as. Options: Suspicious (yellow) or Bad (red). Leave default to let the AI decide.

Resolve classification (optional)

Tag the threat type for reporting. Options: Click farm, Competitor, Abusive, Bots, Threat, Bounced, Outside geo. Leave default to let the AI decide.

Delay (optional)

Wait N seconds after the threshold is met before actions fire. Useful when you want a brief grace period to avoid acting on transient bursts.

Creating a rule

Five worked examples

Copy any of these directly into the form. Each is a real pattern teams use.

Example 1 — Velocity fraud (IP clicking too fast)

The most common pattern: one IP hammering your campaigns.

Rule sentence: When the same IP address causes 5 clicks on the campaign within 1 hour, block for 7 days and label as velocity-fraud.

Tune: if real users in shared offices are getting caught, raise the threshold to 8–10 or drop the period to 30 minutes. If fraud still slips through, lower the threshold to 3.

Example 2 — Campaign volume spike (observe-only)

Detect sudden bursts; label without blocking so you can investigate first.

Rule sentence: When the campaign receives 50 clicks within 10 minutes, label as bulk-spike.

Use case: great as a first rule. Run it for a week to see how often you get spikes. If clusters of bulk-spike clicks look fraudulent, convert it to a Block rule.

Example 3 — Device-level repeat (catches VPN-rotating IPs)

When attackers rotate IPs via VPN, device fingerprint stays stable. Track by device, not IP.

Rule sentence: When the same device causes 3 clicks on the ad group within 6 hours, exclude IP for 24 hours, exclude from audience, and classify as click farm.

Use case: if you've seen device-based fraud in Click Traffic (one device, several IPs, same browser fingerprint).

Example 4 — Low-engagement campaign (percentage-based)

Flag campaigns where most clicks have no engagement — often a sign of bot traffic on a specific campaign.

Rule sentence: When more than 30% of clicks (of at least 10) on the campaign match within 24 hours, label as low-engagement and mark as suspicious.

Use case: observe-only rule for campaigns you suspect have bot traffic. Confirm via Click Traffic before turning the label into a Block action.

Example 5 — Placement exclusion (Display Network)

Block specific Display Network sites or apps that keep sending bad traffic.

Rule sentence: When the same placement causes 20 clicks on the campaign within 12 hours, block for 14 days.

Use case: Display Network has dramatically higher invalid-traffic rates than Search. Pair this with the Placement Exclusion manual check.

Where rules live in the scope tree

A rule applies at whatever scope was selected when you created it:

• Website-level rule — watches all ad accounts and campaigns on that site.
• Ad-account-level rule — watches only that one Google Ads account.
• Campaign-level rule — watches only that one campaign.

Narrower beats broader if both match the same event.

Managing rules

The Automations page lists every rule with status, trigger count, and last-fired timestamp. Click any row to edit, toggle on/off, or delete. Click the executions drawer icon to see the rule's recent firings — useful for tuning.

Best practices

1. Start with Labels. Run a new rule with Labels-only for a few days to see how often it fires before you switch to Block. Resolve status of "Suspicious" is also non-destructive.
2. One condition per rule. Multi-condition rules are harder to reason about. Make separate rules and let them stack.
3. Use the narrowest scope. A campaign-level rule won't affect other campaigns if it misfires.
4. Review weekly. Check trigger counts. A rule that never fires is dead weight; one that fires constantly is probably miscalibrated.
5. Use Resolve classification to tag fraud type — it makes your dashboards and reports much easier to read.

What happens next

• Exclusions — see what automations and the AI have currently blocked
• Settings — the AI-side controls that handle most cases
• Click Traffic — investigate clicks your rules flagged