Facebook and Instagram ads: fake clicks and bot traffic

In Google Ads, a suspicious click at least gives you an IP exclusion setting to reach for. Move over to Facebook and Instagram ads and that reflex no longer works: Meta Ads Manager has no IP exclusion setting. That doesn't make Meta ads defenseless against bots and fake clicks — it just means protection has to be built with different tools.

This article covers where low-quality traffic on Meta comes from, how to spot it, and the three levers that replace IP lists: audience exclusions, Conversions API signal quality and placement control.

What fake clicks look like on Meta

On Meta, fake or low-quality traffic tends to come less from one competitor clicking repeatedly and more from poor placements and automated engagement. Typical symptoms:

• High link clicks but noticeably fewer landing page views.
• Sessions that end within seconds, with no scrolling or interaction.
• One placement (often Audience Network) with a much higher click-through rate than the others but close to zero conversions.
• Lead ads full of fake names, invalid phone numbers or duplicate submissions.
• Automated engagement from spam accounts in comments and messages.

None of these alone means "bots" — poor targeting or a slow landing page can produce a similar picture. The first rule of diagnosis is to look at patterns, not single metrics. Our article on how to detect fake clicks is a good starting point for general methods.

Diagnose first: which reports to check

Customize the columns in Ads Manager to put "Link clicks", "Landing page views" and your own conversion events side by side. Then use the Breakdown menu to look at placement, device and platform one at a time. Healthy accounts show differences between placements, but a placement that dominates clicks while barely appearing in results is worth investigating.

Check the same traffic in your site analytics as well. Separate Meta sessions with UTM parameters and look at session duration, page depth and engagement. There will always be a gap between Meta's click count and your analytics sessions, because some people leave before the page loads. What matters is the size of the gap and the placement where it concentrates.

• How does the link click to landing page view ratio vary by placement?
• Which placement has clearly shorter sessions than the rest?
• How many lead form submissions come from people you can actually reach?
• Is the suspicious spike tied to a specific ad set or creative?

Why Meta has no IP exclusion

Meta's ad system is built around logged-in user accounts, not IP addresses. An ad is delivered to a person through their Facebook or Instagram account, so targeting and exclusion tools work at the person and audience level too. In practice, instead of maintaining an IP list, you focus on three areas.

1. Excluding with Custom Audiences

A Custom Audience is built from people who visited your website, submitted a form or engaged with your page. Used as an exclusion, people in that audience won't see your ad set. Practical scenarios against fake traffic:

• Excluding your own employees and agency team with a customer list.
• Collecting people who previously submitted invalid or fake leads into an audience and excluding it.
• Putting visitors with suspicious on-site behavior (for example very short, interaction-free sessions) into a separate website audience and excluding it.
• Removing existing customers from acquisition campaigns.

The limit of this method: an audience only works as far as Meta can match the people in it. Match rates depend on the quality of the data you send — which is where the second lever comes in.

2. Conversions API (CAPI) and signal quality

Meta's delivery system learns who to show ads to largely from the conversion events you send. The browser pixel alone can miss events because of ad blockers, browser restrictions and cookie consent. The Conversions API sends events directly from your server to Meta; used together with the pixel, events are deduplicated.

Here's why that matters for fake clicks: the more clearly you tell the algorithm which visits are valuable, the less similar low-quality traffic you end up buying. Sending only verified events server-side — for example a lead with a real phone number that passed a quality check — moves optimization away from rewarding bots and spam forms.

Event match quality

In Events Manager each event shows an "event match quality" score. It reflects how well the customer information you send (hashed email, phone, click ID and so on) matches Meta accounts. A low score means both measurement and exclusion audiences work poorly.

Which events to send

One of the most effective changes against fake traffic is moving your optimization goal to a deeper event. Shallow goals such as link clicks or page views are easy to generate and can therefore reward low-quality traffic. Purchases, qualified leads or completed calls are much harder signals to fake.

• E-commerce: optimize for Purchase rather than add-to-cart, and send value where possible.
• Lead generation: instead of raw form submissions, send leads marked as qualified in your CRM from the server.
• Service businesses: count only booked appointments or completed calls as conversions.

With low volume the algorithm may learn more slowly; tracking an intermediate event as a secondary signal alongside the deeper one is a balanced approach.

3. Placement control: Audience Network and others

Beyond the Facebook and Instagram feeds, Meta ads can run in Messenger, Reels, Stories and Audience Network. Audience Network shows your ads in third-party apps and sites outside Meta. It extends reach, but you have less direct control over the quality of those apps and sites.

What you can do:

• Pull placement-level reports and review cost per result for each placement separately.
• Turn off placements that don't convert via manual placements.
• If you use Audience Network, exclude low-quality apps and sites with a block list.
• If you use Advantage+ placements, check results by placement breakdown regularly.

Meta's own protection and its limits

Like Google, Meta runs automated systems to detect invalid activity and fights fake accounts on an ongoing basis. They are good at removing obvious bot behavior and fake account networks platform-wide. What they don't know is what a "quality" visit means for your business: a click being policy-compliant doesn't make it likely to become a customer.

That's why most of the protection on Meta relies on the advertiser's own data. The algorithm finds whatever you teach it to find; the wrong signal grows the wrong audience.

Common mistakes

• Expecting sales from Traffic or link-click campaigns: those goals find the cheapest click, not the most valuable customer.
• Installing the pixel and skipping the Conversions API: the more events you lose, the blurrier the picture the algorithm learns from.
• Counting every lead as a conversion without quality checks: spam leads get taught as "success" too.
• Never looking at the placement report: the problem is often concentrated in a single placement.
• Creating exclusion audiences once and never updating them: website audiences work within a retention window; keep the rules current.

Where wall.click fits in

wall.click doesn't try to block IPs on Meta, because the platform doesn't allow it. Instead it scores visits to your site with behavioral, device and network signals, adds suspicious visitors to an exclusion audience and sends verified conversions to Meta via the Conversions API. Exclusion and optimization are fed from the same source. The general logic is on our how it works page, and bot detection is covered on the bot traffic solution page.

If you also run Google Ads, seeing suspicious traffic from both platforms in one dashboard makes diagnosis easier. For the IP limits on the Google side, see Google Ads IP blocking.

Actionable checklist

1. Set up the Conversions API alongside the pixel and verify deduplication.
2. Check your event match quality and fill in missing customer information fields.
3. Optimize only for events with real business value.
4. Add employees and suspicious visitors to exclusion audiences.
5. Review the placement report; turn off non-converting placements or use a block list.
6. Add a verification step to lead forms and measure lead quality.

Frequently asked questions

Can I block IPs on Facebook ads?

No. Meta Ads Manager has no IP exclusion setting. Exclusions are done with audience tools such as Custom Audiences.

Do I need a developer to set up the Conversions API?

Built-in integrations for platforms like Shopify and WooCommerce, or a server-side tag manager, make it easier. For custom software you'll usually need developer help.

Does Meta charge for invalid clicks?

Meta has its own invalid activity filters, and activity it detects is generally not charged. But those filters don't know your business-specific quality signal, which is why the quality of your conversion signal is decisive.

How quickly does an exclusion audience take effect?

Audiences take time to populate and apply; website audiences keep updating with new visitors. Because small audiences may match poorly, use exclusions together with signal quality and placement control rather than on their own.

Do these methods work with Advantage+ campaigns?

Yes. The more automation, the more the quality of your conversion signal matters, and exclusion audiences can be used in most setups.

Should I turn off Audience Network entirely?

There's no universal answer. If its cost per result is clearly worse than other placements, turning it off or using a block list makes sense.

How can I tell if my Instagram ads get bot traffic?

Look at the gap between link clicks and landing page views, on-site session duration and the placement breakdown. What matters is these signals degrading together, not one metric alone.