Click tracking · Mobile attribution · Fraud protection
WhichClick is a Google-certified transparent click tracker with mobile install attribution and real-time click-fraud protection. One record per click, from the ad to lifetime value.
14-day trial · No credit card · Certification support included
GET /c/brand-search
302 Location: https://northwind.com/landing?wc_click_id=k3Zp9Qw1mR7t
Performance teams that switched to one platform
One platform
Most stacks pay an MMP for installs, a click tracker for search and a fraud tool for defence, then reconcile three reports. WhichClick scores, attributes and reports from the same click record.
Transparent redirects built to Google's click-tracker guidelines. Every ValueTrack dimension captured, parallel-tracking safe, under 30 ms.
iOS, Android and React Native SDKs. Deterministic and probabilistic install attribution, deferred deep linking, SKAdNetwork, cohorts and LTV.
Real-time risk scoring on every paid click: VPN, proxy, Tor and datacenter detection, automation and fingerprint checks, frequency caps, engagement verification.
How it works
No stitching an MMP, a click tracker and a fraud tool together. The same record that redirected the user is the one that scores, attributes and reports.
Paste the generated tracking template into Google Ads. Every click resolves the visible url hop, logs 20+ ValueTrack dimensions, is risk-scored and 302s the visitor — one request, no JavaScript.
https://go.northwind.com/c/{campaignid}?url={lpurl}&gclid={gclid}&kw={keyword}&mt={matchtype}&dev={device}
The SDK sends the first open with our click id, Android Install Referrer or gclid. We match deterministically, fall back to probabilistic or SKAdNetwork, and stream in-app events for retention, LTV and postbacks.
WhichClick.start(key: "sk_live_…")
WhichClick.track("purchase", value: 89)Import spend and every click becomes CPI and ROAS. Pivot by campaign, keyword, network, geo or creative. Export offline conversions back to Google Ads, or push to your warehouse and CRM.
| Campaign | Installs | CPI | ROAS |
|---|---|---|---|
| Brand — Search | 1,204 | $1.62 | 4.1× |
| App Install — iOS UAC | 3,318 | $2.05 | 3.4× |
| Summer Launch (DE) | 622 | $3.90 | 1.7× |
Offline conversions exported to Google Ads · 06:00 UTC daily
Protect
Competitors, bots, click farms and VPN-hopping scripts drain search budgets quietly. WhichClick scores every paid click before the redirect and closes the loop with Google Ads on its own.
Detect
20+ checks on every click
VPN, proxy, Tor and datacenter ranges. Headless and automation fingerprints. Device declared by ValueTrack versus the real user-agent.
Decide
A risk score, not a guess
Frequency caps per IP, hour and day. gclid replay, multi-campaign sweeps and landing-page engagement fold into one 0–100 score.
Act
Closed loop with Google Ads
Invalid IPs land in the campaign exclusion list automatically. Bursts trigger a webhook and pause the campaign until the attack passes.
Protected spend · 30d
$4,318+12% vs prior
1,061 invalid clicks × $4.07 avg CPC
Latest verdicts
scored in <30 ms · before redirect
| Source | Signals | Risk | Action |
|---|---|---|---|
| 185.220.101.7DE | tor_exit_node | 92 | Excluded |
| 3.91.44.120US | datacenter_ipheadless | 88 | Excluded |
| 78.180.23.9TR | click_frequency_hour | 48 | Watching |
| 73.162.8.201US | no risk signals | 6 | Passed |
Compare
Feature availability based on public documentation as of September 2026. Partial means available as an add-on, a separate product or with limits.
| Capability | WhichClick11/11 | 7/11 | 6/11 | 5/11 | 5/11 |
|---|---|---|---|---|---|
| Tracking | |||||
| Google-certified transparent click tracking | |||||
| EU data residency & private tracking edge | Partial | ||||
| Attribution | |||||
| Mobile install attribution (MMP) | |||||
| Deferred deep linking / smart links | |||||
| SKAdNetwork 4 postbacks | |||||
| Web + app in one attribution graph | Partial | ||||
| Cohorts, LTV, ROAS with cost import | Partial | ||||
| Protection | |||||
| Click fraud protection with IP exclusion sync | Partial | Partial | |||
| Attack detection + automatic campaign pause | |||||
| Landing-page engagement verification | |||||
| Commercial | |||||
| Transparent public pricing | Partial | ||||
AppsFlyer, Adjust, Branch and ClickGuard are trademarks of their respective owners; WhichClick is not affiliated with them.
Clicks, installs and events on a 10-second live feed; incidents within a minute.
CNAME any subdomain; certification inherited, TLS automated, EU/US edge.
Hashed IPs and device ids, no cookies on redirects, configurable retention, DPA.
REST + SDKs, postbacks, CSV/BI exports, cost import API, health endpoint.
Customers
−11%
invalid search spend in month one
“We replaced an MMP, a click tracker and a fraud tool. Invalid search spend dropped 11% in the first month and finance finally trusts ROAS.”
Head of Growth
Orbit Games
1st try
Google click-tracker certification
“The transparency self-test is the reason our Google certification passed first time. The compliance page reads like it was written by the reviewer.”
Paid Media Director
Halcyon Travel
Deterministic
Android attribution via Install Referrer
“Deferred deep links plus Install Referrer gave us deterministic attribution on Android we never had. Cohorts by campaign are now a weekly ritual.”
VP Marketing
Kestrel Bank
FAQ
Short answers to the questions that come up in every security review, vendor assessment and integration kickoff.
The redirect engine is engineered to the Transparent Click Tracker guidelines and ships with a self-test that mirrors Google's review. Certification is per tracking domain; we prepare and submit the annual application (September 1 – November 30) with you, and advertiser subdomains pointing at a certified domain inherit certification.
Deterministic signals first — our click id in the deep link, Android Install Referrer, gclid — then privacy-safe probabilistic matching inside a short window, then SKAdNetwork for aggregate iOS reporting. Every install shows which method matched it.
Each click is scored in real time. Above the block threshold the IP is added to your blocklist and, if connected, pushed to Google Ads as a negative IP criterion within seconds. A burst above your threshold opens an incident, fires your webhook and can auto-pause the campaign.
Raw IPs are never stored for valid clicks; we keep a salted daily hash. For flagged clicks the raw IP is retained only as long as your retention setting requires for exclusions and refund claims. Device identifiers are hashed before they leave the SDK.
Enterprise plans offer EU or US residency, a dedicated tracking edge and, for regulated customers, a private deployment.
Set up a tracking domain, generate compliant templates, install the SDK and run the transparency self-test — in an afternoon. Our solutions team files the application with you.