🛡️ Fraud Protection & Security

Every impression and click is checked before it's credited; a flagged event still renders normally for the visitor — flagging only withholds credit, it never breaks the visible ad.

Check	Catches
Rate limit	More than 30 requests/60s from one IP (configurable)
Duplicate fingerprint	Same IP+user-agent hitting the same slot within a 5-minute window
Bot user-agent	Known bot/crawler/script user-agent strings
Page-impression dedup	Multiple slots on one page view only credit the first
Stale impression	A click against an impression older than 24 hours
Self-traffic / duplicate click	An advertiser clicking their own ad; a click replayed against the same impression

Flagged events are written to a fraud log reviewable by admins at /admin/fraud-log.