# Protection settings: mode, industry preset and thresholds

The Settings tab decides what AdPix does with suspicious paid clicks: only label them or block them automatically, against which thresholds, for how many days, and who is never flagged. Every website starts in Monitor, and nothing is blocked until you change that.

## Two doors, one setting

These settings open from two places, and both save the same thing:

- on **Fraud Protection** (`/integrity`), the **Settings** tab;
- in **Admin**, under the **Website** group, **Fraud protection** — the direct link is `/admin?sel=fraud-settings`.

The only difference: the **Sensitivity dial** sits at the bottom of the Settings tab only, not in the Admin pane. The Admin pane works on the active website; if none is selected, pick one in the picker at the top of the console first.

The **Save settings** button on the **Protection mode** card saves everything at once: mode, preset, expiry, auto-push and your threshold overrides. The allowlist is separate — each entry is saved the moment you add or remove it. The real-time check picks up new settings within a minute. Saving needs the Editor role or higher on the website.

## Protection mode

| Mode | What happens |
| --- | --- |
| Off | no real-time check. Paid clicks are still recorded, with the verdict Not assessed. The nightly analysis still runs |
| Monitor | every paid click is checked and labelled. No block is created automatically and nothing is pushed automatically |
| Block | a Confirmed verdict — from the real-time check, from browser signals or from the nightly analysis — creates a block automatically. Only Confirmed; Potential and Review never do |

Every website starts in Monitor. That is also the page's own advice: watch the verdicts on the **Clicks** tab for a week or two, and move to Block once you agree with them.

In Block mode the click's IPv4 address is blocked, or its `/64` range for IPv6. When the verdict is about the device itself — a replayed click ID, an automated browser or IP rotation — the device is blocked too. Shared mobile and carrier addresses are never blocked, whatever the verdict.

> **A block never touches your site**
>
> A block in AdPix is a row on the exclusion list kept for your ad platforms. No visitor is ever turned away from your site. The real effect starts only when that list reaches Google Ads, a firewall or another destination — through [push destinations](analytics/fraud/blocks-and-exclusions) or the files on the **Evidence** tab.

### When the plan does not include blocking

On Starter the **Block** option and the auto-push switch are disabled and carry the Pro badge. If the website was in Block mode before, the page shows the mode that actually runs (Monitor) with the message "Blocking is paused on this plan". Your stored setting is kept on every save until you pick another mode; upgrade to Pro and blocking resumes.

## Industry preset

The **Industry preset** is the starting point for the thresholds. Each preset's numbers:

| Preset | Clicks per address in 10 minutes / 7 days / 30 days | Networks per device in 7 days | Paid arrivals per network in 1 hour | Identical clicks per minute | Block expiry |
| --- | --- | --- | --- | --- | --- |
| General | 3 / 7 / 10 | 8 | 8 | 3 | 30 days |
| E-commerce | 3 / 7 / 10 | 8 | 8 | 3 | 30 days |
| Lead generation | 2 / 5 / 8 | 6 | 6 | 3 | 45 days |
| B2B | 4 / 10 / 15 | 10 | 12 | 4 | 30 days |
| Local services | 2 / 4 / 6 | 6 | 6 | 2 | 60 days |
| Custom | as General, with the values you change | | | | 30 days |

The hint under the field gives each preset's reasoning: Lead generation is stricter, because a visitor usually comes once and fills a form; B2B is looser, because offices put many real buyers behind one IP; Local services is the strictest, with the longest blocks, because competitors clicking your ads is the main risk.

E-commerce currently carries exactly the same numbers as General. The conversion-timing check (Abnormal conversion timing) runs in the nightly analysis for every website, whichever preset you pick.

Changing the preset resets two things to that preset's defaults: every threshold you had overridden, and **Block expiry (days)**.

## Thresholds and what "exceeding" means

The **Thresholds** card makes every preset number editable. Each threshold is an allowance: its reason is raised only when the count, including the current click, **exceeds** it. With a threshold of 3 for 10 minutes, the first three clicks from an address carry no reason and the fourth gets Repeat clicks (10 min). Counts are kept per IPv4 address, and per `/64` range for IPv6.

| Field | Reason it raises | Where it is checked |
| --- | --- | --- |
| Clicks per address in 10 minutes | Repeat clicks (10 min) | real time |
| Clicks per address in 7 days | Repeat clicks (7 days) | real time |
| Clicks per address in 30 days | Repeat clicks (30 days) | real time |
| Networks per device in 7 days | IP rotation — not for mobiles, tablets or carrier addresses | real time |
| Paid arrivals per network in 1 hour | Click burst, counted per `/24` network — not for carrier addresses | real time |
| Identical clicks per minute | Duplicate clicks: one network, one user agent and one campaign inside a minute | nightly analysis |

The card has one more threshold, **Off-target share (0.5–1)**, 0.7 in every preset, and under it the **Target countries** field: the countries your ads are meant to run in, as two-letter codes separated by commas (`IR, AE`). The nightly analysis raises Outside target countries for a campaign when at least that share of its clicks with a known country (10 or more) comes from elsewhere. Leave Target countries empty and geography is not checked at all; the same list also drives the geo check on the Networks tab.

When you change a value, **Preset value: …** appears under the field so you can see how far you have moved. Clear the field or type the preset value back and the override is removed; the field follows the preset again. Counts accept 1 to 1000 and the off-target share 0.5 to 1; anything outside those ranges is not saved.

A single reason only takes a click to Review; the full tier table is in [Paid clicks and the evidence behind each one](analytics/fraud/paid-click-log).

> **Before loosening a threshold, try the allowlist**
>
> If your office, with dozens of people behind one IP, keeps collecting Repeat clicks, raising the threshold for everyone also means looking away from click farms. Add that IP or range to the allowlist instead, and keep the thresholds for the rest of the world.

## Block expiry

**Block expiry (days)** is the lifetime of every new block, between 1 and 365 days. Its default comes from the preset and resets to the new preset's default when you change presets. Manual blocks get the same lifetime.

In Block mode, each new Confirmed verdict on the same value pushes the expiry later and never pulls it earlier; an address that keeps misbehaving stays blocked. An expired block also comes back to life when the same value earns a Confirmed verdict again.

## Auto-push

**Push blocks automatically** sends the exclusion list to the website's push destinations — a webhook or Google Ads — without you pressing anything. It has three conditions:

1. The protection mode is Block. In Monitor and Off the switch is saved but does nothing.
2. The website has at least one enabled push destination. Creating one is covered in [Blocks and exclusion pushes](analytics/fraud/blocks-and-exclusions).
3. The list has changed since the last push. Every hour AdPix compares the list with what it last sent to each destination, and never resends an identical list.

In every other case, **Push now** on the **Blocks** tab does the same thing by hand.

## The allowlist

Addresses, ranges and devices on the **Allowlist** are always treated as real visitors: their verdict is Clean with the Allowlisted label, they are never blocked automatically, and they never appear in the list that gets pushed.

| Type | What the Identifier must be |
| --- | --- |
| IP address | one IPv4 or IPv6 address |
| IP range (CIDR) | a range in CIDR notation, such as `203.0.113.0/24` |
| Device | the device fingerprint ID |

**Reason** is optional, but whoever reviews the list later reads from it why each entry is there. Add an entry with **Add to allowlist** and take it off with **Remove**.

Use the list for your office, your own testers and your partners. The simplest way to allowlist a specific device is **Not fraud: allowlist this device** in that click's evidence drawer; you never have to find the ID by hand.

The allowlist does not rewrite past verdicts. It applies to new clicks from about a minute later, and it takes the value off the pushed list straight away.

## The sensitivity dial

The **Sensitivity dial** — Conservative, Balanced, Aggressive — used to sit on the Overview tab and now sits at the bottom of the Settings tab, with its own **Save sensitivity** button. Its job has not changed: it tunes the nightly scoring of sources and networks. It has no effect on the real-time click verdict, the thresholds on this page or the protection mode. When and why to move it is covered in [Sensitivity and false positives](analytics/fraud/sensitivity-and-false-positives).

## Frequently asked questions

### Does Monitor mode block anything?

Not automatically. Every paid click is checked and labelled, but no block is created automatically and nothing is pushed automatically. You can still block by hand, or send the list yourself with Push now.

### Does Block mode stop visitors from reaching my site?

No. A block in AdPix is a row on the exclusion list kept for your ad platforms. No visitor is turned away from your site; the address is only excluded from seeing your ads, and only once the list reaches the platform.

### I switched on Push blocks automatically but nothing is sent. Why?

The switch works only in Block mode and needs at least one push destination. AdPix compares the list with the last push every hour and sends again only when something changed.

### Where did the sensitivity dial go?

To the bottom of the Settings tab on `/integrity`. It does what it always did — tunes the nightly scoring of sources — and has no effect on the real-time click verdict or the thresholds on this page. It is not in the Admin pane.

## Related

- [Paid clicks and the evidence behind each one](https://docs.adpix.io/en/analytics/fraud/paid-click-log/)
- [Blocks and exclusion pushes](https://docs.adpix.io/en/analytics/fraud/blocks-and-exclusions/)
- [Sensitivity and false positives](https://docs.adpix.io/en/analytics/fraud/sensitivity-and-false-positives/)
- [Overview and severity tiers](https://docs.adpix.io/en/analytics/fraud/overview-and-severity/)

---

[Docs](https://docs.adpix.io/en/analytics/fraud/protection-settings/) · AdPix