The question before installing anything on a site that earns money is whether it will break it. This answers with names and version numbers, including the cases that need care and the ones nobody has tested yet.
Last updated 2026-08-19
Nothing unusual, and nothing installed on your server beyond the plugin itself:
Because nothing is routed through us, your site carries on exactly as it does now if our servers ever go down. A site whose licence has been valid keeps every feature for fourteen days while we are unreachable — generous on purpose, because an outage on our side must not degrade a site that is protecting money.
These matter more here than for most plugins, because a cached page is served without PHP running — and the decision about whether to block somebody is made in PHP. ClickHelm handles this explicitly for:
Ordinary pages are left cacheable, because they should be. The block page is the exception: what it says depends on who is asking, so it is kept out of every cache by several mechanisms at once, and the cache is cleared whenever you block or unblock somebody. This is not theoretical care — on a live site, LiteSpeed once stored a block page as the cached copy of the homepage, and everyone afterwards was served it with PHP never running at all.
If a cached page does reach somebody who should have been blocked, the second blocking layer still stops them: the request it makes is never cached.
Supported. When a site sits behind Cloudflare or another proxy, the address PHP sees is the proxy’s and not the visitor’s. ClickHelm reads the header Cloudflare adds, falls back to the standard forwarding header, and only then uses the connecting address.
This matters beyond correctness. Without it every visitor to the site would appear to share one address, and every check that looks at an address would be meaningless while appearing to work perfectly.
No theme is modified and no template is replaced. The recording runs on the front end of whatever your theme renders, and the blocking happens before your theme is reached at all — so a page builder, a custom theme or a heavily modified one makes no difference to either.
The screens the plugin adds live in the WordPress admin and carry their own styles, so an admin theme cannot break them and they cannot break your site.
Detection and blocking work on every visit to your site, whatever sent it — Meta, Microsoft Ads, TikTok, organic search or somebody typing your address. The device recognition, the network classification, the behaviour checks and your own rules all apply the same way.
What is specific to Google Ads is the money: the click identifiers, the spend, and matching charged clicks to visits. Those need an advertising account the plugin can read, and today that means Google.
Claiming compatibility with everything is how a plugin ends up breaking somebody’s site. These have not been through real testing, so if you depend on one, ask before you buy rather than after: