ClickCease review 2026: pricing, the 500-IP ceiling and where the vendor argues with itself

This ClickCease review answers one question: what do you buy when you pay for “click fraud protection”, and where does the method stop? Everything below comes from the vendor’s help centre and pricing page plus Google Ads Help — no testimonials, no numbers absent from a primary source. Short version: the product does one technical thing, it runs into a hard Google limit, and the most honest description of that limit sits on the vendor’s own blog.

What ClickCease actually does

ClickCease is sold as protection against invalid traffic: install a tag, connect the ad account, and the service monitors every visit and “blocks” fraudulent clicks. The mechanism behind that sentence is documented by the vendor itself: once the system decides an IP is fraudulent, it “adds the IP to your IP exclusion list on Google” — it writes the address into your Google Ads IP exclusion list over the API.

Understand that before you look at the price. The tool does not cancel the click, recover the money or touch the auction: it automates a setting you already have for free. Everything else — detection, reports, WordPress bot protection — serves one decision: which address goes on the list. The architecture has two layers, an HTML tag plus a connection to the Google Ads or Facebook Ads dashboard. On Meta the user is excluded from the audience, not the IP from a list.

Who owns it: ClickCease, CHEQ and the naming mess

ClickCease is an Israeli product CHEQ acquired in September 2020. The announcement is blunt — “We are excited to announce that ClickCease has been acquired by Cheq.ai” — and promises that “The ClickCease that has been protecting you thus far isn’t going anywhere”. Terms were never published: trade press wrote “Terms of the deal were not disclosed” and quoted CHEQ’s CEO saying the product would become the SMB flagship and “will remain under the ClickCease brand”.

Then the names start moving. One vendor page is headed “CHEQ Essentials is now ClickCease”; another says “Same ClickCease, new logo!” and adds that the product “is also now part of the CHEQ suite of fraud defence tools, alongside Paradome”. Software directories still list it as CHEQ Essentials. Takeaway: the two names can mean the same thing, and prices filed under them describe one product in different years. No page gives a rename date — only a “© ClickCease.com 2026” footer.

The mechanism in four steps

1. Connect. The service account is linked to the Google Ads or Facebook (Meta) Ads pixel; the tag goes in through Google Tag Manager, the WordPress plugin, or pasted code.
2. Collect. Per click the vendor records “the clicker’s behavior, their historical trend, what device they used and more”.
3. Decide. The IP runs against “dozens of different tests and challenges”: VPNs, proxies, known blacklists, how many ad clicks that IP has made, and behavioural signals. The FAQ claims “over 2,000 real-time behavioral tests on each visit” and a speed of “under 3 seconds”.
4. Write. “we send a request to Google via our certified API to include the fraudulent IP in your account’s IP Exclusion List” — and it is “instant and automatic as soon as the malicious IP is detected”.

Note the asymmetry: many tests, one possible output — an IP address on an exclusion list. Its worth depends on the list, not on the test count.

The ceiling of the whole category: 500 IP exclusions

Google Ads Help puts the limit in one line: “You can exclude up to 500 IP addresses per campaign”. A range is written with a wildcard — “use an asterisk (*) to replace the last 3 digits”.

The vendor acknowledges it: “Google Ads limits any of their users with an IP Exclusion list of up to 500 IP addresses”. However many tests run, only a finite number of addresses reaches the account — a ceiling on the entire “block-by-IP” category, not on one product. The account’s other hard numbers sit in our piece on Google Ads account limits.

The service automates a setting capped at 500 rows per campaign. “Two thousand tests versus manual work” changes nothing: the output is still a 500-line list.

List rotation, and why manual exclusions cost more than they look

Because the list is finite, the product keeps it alive. The help centre calls this the refresh rate: “As we keep on the IP Exclusion List dynamic, when the list fills up, old IP’s are removed and new IP’s are inserted”. The setting ranges from 50 to 500 addresses, 500 being recommended “In accordance with Google’s maximum IP list capacity/limit”.

When the cap is hit, the system “will begin to remove old, potentially no longer harmful IPs”, because an address caught two months ago “will not necessarily be used for the same activity nowadays” — with the promise that “If a newly released IP clicks your ads again it would be blocked again immediately”.

• No block is permanent. On busy accounts addresses drop out as the list fills, and the selection rule for “old” is never described.
• Manual entries are expensive. They are “blocked permanently across all of your campaigns, until it is manually removed” and outrank automatic ones, but share the same slots: 100 manual rows leave “only 400 slots to rotate IPs in and out of your exclusion lists”.
• You cannot edit the list in two places. The vendor asks you to “do not attempt to add IPs directly to your exclusion lists on Google Ads” — your own entries get overwritten.

That last point is the real operational price: control of a field inside your own ad account moves to the vendor.

Where IP exclusions work — and Google’s own contradiction

The vendor sets two conditions: the campaign must send the click to a landing page and must have an exclusion list.

Campaign type	ClickCease documentation	What it means in practice
Search	Both conditions met — blocking works	The scenario the product is built for
Google Display Network	Both conditions met	Works, though the fraud pattern here differs
Shopping (not Smart Shopping)	Both conditions met	Works for standard shopping campaigns
Performance Max, Demand Gen, Smart, YouTube Video, Local Services	“No exclusion list” — IPs land in other campaigns’ lists	No direct blocking; the effect is indirect and hard to predict
App campaigns, call-only ads and call extensions	No landing page, so the tag never fires	Out of scope by definition

Clicks from the uncovered types, the vendor says, “are not counted towards your ClickCease usage plan”.

Now the contradiction inside a single Google Help page. At campaign level, “IP exclusions aren’t available for video campaigns, hotel campaigns, app campaigns, Performance Max campaigns and Smart Display campaigns”. At account level (Admin → Account settings → IP exclusions) they apply “across all campaigns in your account, including Performance Max, Demand Gen, Search, Shopping, Display, Discover and YouTube”. Performance Max appears in both lists with opposite answers, unreconciled. No maximum is stated for the account-level list; lists add up — “Google Ads will merge the exclusion lists” — and account-level exclusions cannot be removed from inside a campaign.

Two consequences. The vendor’s documentation covers campaign-level lists only and never mentions the account level, so it appears to lag behind the interface. And if you need addresses blocked in Performance Max, Google documents a built-in route that needs no subscription.

Threshold rules, and the one-click setting the vendor talks you out of

The core setting is the Click Fraud Threshold: “how many times are we allowing an IP to click on our ads before blocking them”. Up to five rules, under Domain Settings → Manage Detection Rules → Click Fraud Threshold. The only published defaults are for e-commerce: “3 times in 10 minutes, 7 times in 7 days and 10 times in 30 days”. On-demand services get a recommended one-click threshold; other verticals have no numbers.

Advanced Mode changes the scope: off, account level; on, campaign level, so an IP is excluded only from the campaign it triggered. Up to 50 campaign groups, five rules each, plus an “Excluded Campaigns” group that drops a campaign from protection and is labelled “not recommended” by the vendor. Google Ads only.

A separate article covers the one-click threshold — a rare case of a vendor arguing against its own setting. At that threshold “every click done by any IP address (be it genuine or fraudulent) would have that IP blocked immediately”, and then plainly: “This setting is not recommended for most of the industries and businesses”, because “You may be blocking genuine traffic for sure after their first click”. The second argument is the same ceiling: “The maximum amount of IP’s that can be blocked at any one time is 500”. The audience it suits is on-demand services with high CPCs.

There is also a tension inside the vendor’s own numbers: its FAQ says roughly 90% of traffic clicks an ad only once. If so, a model built on repeat clicks cannot see most visits, while the threshold that would see them is not recommended. That is not a flaw — it is the boundary of the method, worth knowing before you pay.

Pricing: you are billed for visits, not clicks

The important thing is the billing unit. Despite the product name, you are billed per website visit, not per click: the table calls the metric “the number of monthly website visits”, and traffic is “any user activity on your website that CHEQ detects or blocks”.

Plan	Price on the page, USD/mo	Websites	Monthly visits	HubSpot leads
Starter (Standard in the table)	69 and 99 (“Billed annually” next to 99)	1	up to 5k	up to 250
Pro	104 and 149	up to 10	up to 40k	up to 2,000
Advanced	244 and 349	up to 20	up to 80k	up to 7,000
Enterprise	“Custom pricing”, contact sales	not stated	not stated	not stated

All plans include ad protection for Google, Meta and Microsoft, WordPress bot protection, Lead Shield for HubSpot, Consent Mode, the Pixel Guard Connector, “Unlimited Google Ads accounts” and 24/7 support. Pro and above add multi-domain setup, agency permissions and white-label reporting; Advanced adds onboarding. There is a 7-day trial, “Cancel anytime”, a “30% off your first 3 months” promotion for new customers and “Save 15%” on annual billing.

And now the part you only see by reading one page carefully:

• The plan cards and the comparison table disagree. Cards show 5k, 10k and 40k, 50k and “+140k” visits; the table shows 5k/40k/80k. Which figure is binding is never explained.
• Month versus year. The table counts visits per month, while the FAQ on the same page refers to a “prepaid annual amount of visits”.
• The overage rate is unpublished. Go over and “you’ll be charged according to your actual total usage and our rates based the plan you choose” — the rate itself is absent. In the product’s favour: “We will never stop detecting invalid traffic and will never upgrade your plan without notifying you first”.
• Which of the two prices is monthly is unclear. The 30%-off-for-three-cycles footnote hints the lower figure is promotional, but the page does not say so.

We saw the same pattern in our Supermetrics connector review: with SaaS the question is not “what does it cost” but “what unit is counted”. Here the unit is site visits, so a seasonal organic spike raises the bill for protecting your ads.

What Google already does for free

Without this section the review is useless. Google filters invalid traffic itself with “automated filters, machine learning, and manual reviews”, in two stages.

Before you are billed. Traffic identified before the cycle closes is removed from metrics and billing — you are not charged, and, as the Help centre puts it, no refunds are necessary. Those clicks show in the “Invalid clicks” column, and the money returns to the budget.

After billing. Anything found later is credited “where appropriate and possible” in the next cycle as a billing adjustment. The amounts appear as “Invalid activity” on invoices and in transactions (Billing → Summary → Adjustments), and Google warns they are not directly related to the invalid-clicks column, since campaign metrics freeze at month end. The dedicated report is the Invalid Activity Credit Report in Report Editor, Search and Performance Max only.

How to work those reports is covered in our piece on invalid clicks in Google Ads, and why a click spike without a conversion spike is usually an edit rather than a competitor is covered in the change history walkthrough.

On third-party tools Google is careful but clear: they “might flag traffic as invalid” that Google already filtered and never billed; “Google cannot evaluate third-party reports because Google doesn’t know their detection criteria”, and no click-by-click comparison is offered. A gap between your fraud counter and Google’s is not evidence of overpayment.

“Claim your money back”: what the tool gives you, what Google decides

The category’s most attractive promise is a refund, and here the documentation is unexpectedly honest. The flow: Tools → Apply for Google Refund, pick a range, hit “Download Full Clicks Report”, and the file arrives by email. Four sheets: web logs per click (IP, URL, date and time, user agent, OS, browser, campaign ID, geo, ISP), IPs by click count with detection, conversion and blockage status, IP ranges by clicks, and devices by addresses used.

Then the limits the vendor lists itself: Google “only allows a refund claim to be submitted by the Google ads account owner”, and third parties can no longer file on a client’s behalf, although external reports are accepted; the FAQ says “Google allows you to put in claims for invalid traffic once every 60 days”; and the outcome is not guaranteed, because “Google is the final decision maker in this process”.

Google’s side matches. Investigations go through the Click Quality Form, cover the last 60 days, and require exactly what the export provides: the 10-digit customer ID, the range, campaign and ad group names, suspicious keywords, server logs with IPs, device data and GCLIDs, a lead spreadsheet with your assessment, and a trend note such as a “300% spike in clicks without more conversions”. Review “typically takes several business days”, and Google will not confirm the status of individual clicks.

Note the detail: “60 days” means different things in the two sources — a lookback window for Google, a filing frequency for the vendor. Nothing in the documentation lets you merge them into one rule.

So the tool does not sell a refund; it sells an evidence pack for a form you file yourself — valuable if you have never assembled such logs, close to worthless if you already have server logs and a GCLID export.

The first click is always yours

One documented fact rarely reaches marketing: to profile a visitor the system has to let them in. The product must “enable and analyze the first click”, and the block lands on the next one — “the first click might be from an invalid user and will be blocked in the future, as the 2nd click”. Worse, Google “might not see this first click as invalid”: “Some clicks can still be counted by Google’s algorithm as valid”.

So you always pay for the first click from every new address — two if your threshold is three. And if the fraud is a botnet of thousands of addresses clicking once each, a repeat-click model never fires while the 500-row list fills with noise. For lead generation, blocking matters less than lead quality — see our breakdown of fake leads and form checks.

The vendor versus its own blog

The strongest document in this review was written by the vendor. A ClickCease blog post dated 29 July 2026 explains why excluded IPs keep slipping past Google Ads exclusions — that is, the very mechanism the product is built on:

• an IP is “a temporary network identifier, not a permanent device signature”, and residential addresses change “sometimes multiple times a day”;
• proxies and VPNs rotate addresses, “rendering any static blocklist almost immediately obsolete”;
• Google caps exclusions at “a maximum of 500 IP exclusions”, and “A moderately sophisticated botnet can exhaust this limit in a single hour”;
• “an IP added to an exclusion list is not blocked instantaneously”;
• blocking a residential address “is not only difficult but also risky” — “you could inadvertently block a real potential customer”;
• blocking repeat offenders “misses the scale” of one-and-done clicks, and IPv6 “makes manual IP blocking strategically obsolete”;
• the verdict: “Relying on the Google Ads IP exclusion feature as a primary defense against click fraud is an inadequate strategy”.

Formally the post criticises manual list work. But the same help centre describes the product as automatic writes into that same list, rotating inside those same 500 rows: the vendor sells the method and publicly explains its weakness, reconciling the two with a line about real-time behavioural bot mitigation. Read that gap literally, without picking a side — it is the product’s honest boundary.

Does it pay off? A napkin formula

No primary source publishes savings figures, so do the maths yourself. The subscription is justified when:

C × k × S > P + L, where C is your average CPC, k the share of blocked clicks Google would not have filtered itself, S the monthly count of such clicks, P the subscription price and L the loss from blocking real people.

• Do not put the vendor’s headline share into k (its FAQ offers roughly 15% of clicks as a benchmark): part of that was never billed anyway. Only the overlap of “blocked by the tool” and “would have been charged” counts.
• L is not zero: aggressive thresholds block live traffic, and residential addresses pass between people. One lost lead a month in an expensive niche eats the subscription whole.
• The first click from each address is always paid, so S counts repeat clicks, not every suspicious one.

Who it fits and who should wait

Profile	Verdict	Why
Search, high CPC, on-demand services	Worth a trial	Blocking works here and the click price makes savings visible
Performance Max and Demand Gen as the main volume	Doubtful	Those campaigns have no own lists, and account-level exclusions are free
Form-based lead generation	Fix lead quality first	Filtering submissions and feeding Smart Bidding beats blocking clicks
Large organic traffic	Price it first	Billing counts site visits, not ad clicks
App campaigns and call ads	Not applicable	No landing page, so the tag never fires
Agency with dozens of accounts	Check permissions and reporting	Multi-domain, agency permissions and white-label start at Pro

What the ClickCease documentation does not say

• the overage rate for extra visits or leads;
• the basis for the 15% annual-billing discount, and whether the trial needs a card;
• contract term, refund policy and what happens to data after cancellation;
• which rule decides that an “old” IP leaves a full list;
• how long an address stays blocked and when it may click again;
• default thresholds for any vertical other than e-commerce;
• IPv6 handling on the vendor’s side, and the method behind the “around 15%” figure;
• whether an IP allow-list exists — no page we read describes one;
• cookie-consent requirements under the claimed GDPR and CCPA compliance;
• account-level Google Ads exclusions, which the documentation never mentions.

Google leaves gaps too: no maximum for the account-level list, no explicit word on IPv6, and no update date on any Help page we read.

A free 30-minute check before you buy

1. Open the “Invalid clicks” column for the last 90 days by campaign — that is what Google filtered before billing.
2. Build the Invalid Activity Credit Report in Report Editor (Search and Performance Max) and read Credited amount by month.
3. Reconcile the “Invalid activity” lines against invoices: Billing → Summary → Adjustments.
4. Plot clicks and conversions by day: a click spike without a conversion spike is worth digging into, a flat line is a reason not to spend.
5. If there is a spike, check change history and settings first — match-type expansion, new placements or a lifted cap produce the same symptom.
6. Check geography and devices; anomalies can often be removed with built-in exclusions.
7. Only if the anomaly survives and traces back to repeat clicks from the same addresses is a trial worth it.

If the trail leads to account access and structure rather than traffic, see our services section and the page on Google Ads agency accounts.

ClickCease review: the short verdict

ClickCease is a competent product with an honestly documented mechanism: a site tag, behavioural scoring, and automatic writes of IPs into the Google Ads exclusion list inside 500 rotating slots. It saves manual work and produces an evidence pack for the Click Quality Form. What it does not do: cancel the first click, reach campaigns without exclusion lists, recover money by itself, or lift the 500-address cap its own blog says a botnet can exhaust in an hour.

Sensible order: free Google reports first, napkin maths second, trial third — and only if the first two showed money rather than anxiety. Same approach as in our Keitaro tracker review: a tool is judged by what it does and what it runs into.

The line this blog does not cross: we review tools that help advertisers measure and protect budget within platform rules. Evading review, cloaking traffic or dodging Google’s checks is not covered here.

Primary sources: Google Ads Help on excluding IP addresses, the ClickCease pricing page and the vendor’s own post on the limits of IP exclusions.

FAQ: ClickCease review and click fraud protection

What does ClickCease technically do with a fraudulent click?

Nothing to the click itself. Per the vendor’s documentation it writes the IP address into your Google Ads IP exclusion list over the API so that address stops seeing your ads. The click already happened and was already paid for.

How many IP addresses can you block in Google Ads?

Google Ads Help states a limit of 500 IP addresses per campaign, with ranges written using an asterisk in place of the last three digits. No maximum is stated for the account-level list.

What does ClickCease cost and what is billed?

The pricing page lists Starter, Pro and Advanced at 69 and 99, 104 and 149, 244 and 349 USD per month, plus Enterprise on request. Billing counts website visits rather than clicks: up to 5k, 40k and 80k per month.

Do you need a tool if Google already filters invalid clicks?

Google filters part of the traffic before billing and does not charge for it, then credits what it finds later in the next cycle. A tool can only add value on what Google did not filter, and that is what you should size up before paying.

Does blocking work in Performance Max and Demand Gen?

Per the vendor’s documentation those campaigns have no exclusion lists of their own, so there is no direct blocking — addresses land in other campaigns’ lists. Google, meanwhile, documents account-level exclusions that apply to all campaigns, Performance Max and Demand Gen included.

Can the tool get a refund from Google?

It prepares a click export with logs, IPs and statuses, but the account owner files through the Click Quality Form and Google decides. The vendor’s own documentation says Google is the final decision maker in that process.

How often can an invalid traffic claim be filed?

The vendor’s FAQ says a claim can be filed once every 60 days. Google’s Help centre separately notes that an investigation covers activity from the last 60 days — two different statements that should not be merged into one.

Why is the “block after the first click” setting risky?

The vendor itself does not recommend it for most industries: it blocks any address after a single click, real buyers included, and it exhausts the 500-address cap much faster.