Seatext library / BotRefund evidence

Setting Up Clean Attribution Resistant to Browser Plugins

Use server-side first-party cookies, signed tokens, and fingerprint-based session stitching, then validate every conversion against the original touchpoint. Add BotRefund telemetry to detect and block late-set referral cookies from extensions.

✓ Built for advertisers who need clear, refund-ready traffic evidence.

Direct answer

Set up clean attribution by storing the marketing source on your server, not in a JavaScript cookie. Use a signed first-party cookie, a device fingerprint, and a validation step at checkout. Reject any referral that appears after the customer has already started checkout. Add telemetry to prove when a browser extension overrides the source.

In short: trust the server, sign the values, watch the timeline.

What clean attribution means

Clean attribution records the real marketing source of a sale without letting third-party scripts or browser extensions change it. It uses data the merchant controls. The source is locked before the user reaches the checkout page.

Unclean attribution is easy to spot. A user clicks a paid ad and lands on your store. Later, at checkout, a coupon extension injects its own affiliate link. The extension becomes the last click. Your paid campaign gets no credit, and you may pay a commission to the extension.

Clean attribution does not try to block coupon extensions completely. Instead, it makes their late changes worthless. The server already knows the source. Any new referral that arrives after checkout started is simply ignored.

Why browser plugins override attribution

Browser plugins like Honey and Capital One Shopping look for checkout pages and coupon fields. When they find one, they show an overlay that offers to apply coupons. In the background, the extension runs its own affiliate redirect URL.

That background call overwrites the tracking cookies in the browser. The extension takes last-click credit. The merchant ends up paying a commission to the extension on top of giving the customer a discount. This is double-dipping on the transaction margin.

The process is silent. Customers see only a discount offer. Merchants see a sudden jump in direct or unknown conversions. Their paid campaign data becomes unreliable.

Core components of a resilient setup

A clean attribution system has five pieces. Each one addresses a different way extensions can cheat.

  • Server-side first-party cookies - Set the cookie after an ad click, before page scripts run. Extensions running later find it harder to replace.
  • Signed token parameters - Encode source ID, click ID, timestamp, and an HMAC signature. The server can verify the cookie was not changed.
  • Fingerprint-based session stitching - Combine IP, user agent, and a short-lived device hash. This links visits even when cookies are missing or deleted.
  • Conversion validation - Compare the stored touchpoint with the incoming request at checkout. If the referral appears after cart items were added, discard it.
  • Timeline telemetry - Record the exact millisecond when any referral cookie changes. This gives you evidence to decline invalid payouts.

These pieces work together. The cookie carries the source. The signature proves it was not altered. The fingerprint covers cookie loss. The validation rule removes late claims. Telemetry turns the attack into a documented record.

Step-by-step implementation

1. Build a server-side tracking endpoint

When a user clicks your ad, send them to a URL on your domain, such as /track?src=google&cid=abc123. The endpoint creates a signed first-party cookie and then redirects to the landing page.

Node.js example:

const crypto = require('crypto');
function sign(data) {
  return crypto.createHmac('sha256', process.env.SECRET).update(data).digest('hex');
}
app.get('/track', (req, res) => {
  const payload = req.query.src + '|' + req.query.cid + '|' + Date.now();
  res.cookie('attr', payload + '|' + sign(payload), {
    httpOnly: true, sameSite: 'Lax', secure: true
  });
  res.redirect('/');
});

Python example with Flask:

import hmac, hashlib, time
from flask import request, make_response, redirect

def sign(data):
    return hmac.new(secret.encode(), data.encode(), hashlib.sha256).hexdigest()

@app.route('/track')
def track():
    payload = request.args.get('src') + '|' + request.args.get('cid') + '|' + str(int(time.time()))
    resp = make_response(redirect('/'))
    resp.set_cookie('attr', payload + '|' + sign(payload), httponly=True, samesite='Lax', secure=True)
    return resp

PHP example:

<?php
function sign($data) { return hash_hmac('sha256', $data, getenv('SECRET')); }
$payload = $_GET['src'] . '|' . $_GET['cid'] . '|' . time();
setcookie('attr', $payload . '|' . sign($payload), 0, '/', '', true, true);
header('Location: /');
?>

Use the secret from an environment variable. Never hardcode it in the client. Rotate the secret regularly. The cookie requires HTTPS.

2. Enforce a strict Content Security Policy

Set a strict CSP on your checkout page. This stops unauthorized scripts and frames from loading. The first line of defense is to allow only your own resources.

Content-Security-Policy: default-src 'self'; script-src 'self'; frame-src 'self'

Do not use 'unsafe-inline' for scripts. If you must load third-party scripts, whitelist only their exact hosts.

3. Obfuscate coupon field names

Extensions find coupon fields by looking for names like coupon, promo, or discount. Change these to random strings. Use unique class names per page. This prevents auto-detection and delays any overlay.

4. Capture a lightweight device fingerprint

On the landing page, collect a short fingerprint. Combine user agent, language, timezone, screen size, and a canvas hash. Send it to your server and store it with the click record.

Do not store a full browsing history. Keep the fingerprint as a one-way hash with a short lifetime. This limits privacy exposure.

5. Validate every checkout conversion

When a customer starts checkout, read the stored attribution from your server. Compare the timestamp with the timestamp of the referral cookie. If the cookie was set after cart items were added, flag it.

Use this rule: a valid referral must arrive before the shopping session, not during the final step.

6. Integrate BotRefund telemetry

BotRefund runs client-side telemetry on checkout pages. It tracks the millisecond timing of every referral cookie change. If a coupon extension sets a cookie after the customer has already completed shopping steps, BotRefund flags the transaction.

You then have precise evidence to decline those payouts. This is the last line of defense, and it turns a hidden attack into an auditable record.

Trade-offs and limitations of clean attribution

No attribution setup is perfect. Start with privacy. Fingerprinting can identify users across sessions. Many regions require consent for non-essential cookies and fingerprinting. You must disclose this in your privacy policy. Keep the fingerprint to a short-lived hash instead of a persistent identifier.

Server-side cookies also have limitations. If a user blocks all cookies, the server cannot set a first-party cookie. If a user uses a VPN, the IP changes. The device hash may still match, but you should not rely on IP alone.

Browser extensions evolve. Some extensions remove httpOnly cookies or clear storage. Others run in a separate browser context that your page script cannot see. CSP blocks many injections, but it is not a silver bullet. Signed tokens help, but no single solution stops every plugin.

There is an operational cost. You need infrastructure to handle click endpoints, signing secrets, and logs. You also need someone to review edge cases. Clean attribution is a process, not a one-time fix.

Finally, clean attribution cannot repair bad upstream data. If your ad links are malformed or your click IDs are recycled, the signed cookie will carry that error. Audit your ad URLs before you deploy.

How to handle edge cases and follow-up questions

What if a user clears cookies?

Use the fingerprint. If it matches an earlier click, keep the original source. If not, treat the visit as a new session.

What if a user uses a VPN?

Do not reject a conversion just because the IP changed. Combine IP with device and browser signals. Set a low confidence threshold for VPN users.

What if the extension sets a cookie before the page loads?

Compare the cookie timestamp with the server-side click timestamp. If the extension cookie is older than the original click, it may be the first touchpoint. If it is newer, ignore it.

What if checkout runs inside an iframe?

An iframe may block access to the parent cookie. Set the cookie on the parent domain. Use postMessage to share the source between frames. Apply CSP to both pages.

Should I use third-party cookies?

No. Third-party cookies are blocked by most browsers. They are also easier for extensions to delete or forge. Use first-party only.

How do I handle consent?

If you store or access any tracker without consent, you risk fines. Get consent before setting the cookie or collecting a fingerprint. If consent is denied, run server-side validation without those signals.

How to verify your setup

After deployment, test with a clean browser. Install no extensions. Complete a test purchase. The log should show the original source and no override flag.

Then install a known coupon extension. Start checkout, trigger the overlay, and finish the purchase. Open the telemetry log. You should see a referral cookie set after the cart stage. The transaction should be flagged.

Repeat the test with cookie blocking, a VPN, and incognito mode. Record how the system behaves. Adjust your thresholds until false positives are rare.

Practical checklist for a busy buyer

  • Use a server-side first-party cookie for every click.
  • Sign the cookie with HMAC.
  • Set a strict CSP on checkout pages.
  • Obfuscate coupon field IDs.
  • Record the original touchpoint time when the user first clicks.
  • Validate every checkout against that timestamp.
  • Add telemetry that logs cookie changes by millisecond.
  • Decline payouts when the referral came after checkout started.
  • Review your privacy policy for cookie and fingerprint disclosure.
  • Audit your ad links before you deploy.

FAQ

Can I use only first-party cookies?

First-party cookies are necessary, but they must be set server-side and signed. Otherwise extensions can overwrite them.

Do I need a full fingerprint?

A short device hash combined with IP and user agent is enough. It reduces privacy risk while still helping.

What if a new extension appears?

Server-side validation catches late referrals automatically. Telemetry flags any cookie change, not just known extensions.

Is this approach GDPR-compliant?

Yes, if you disclose the first-party cookie and fingerprint in your privacy policy, and get consent where required.

How much does BotRefund cost?

Pricing details are on the BotRefund homepage. A free trial is available.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

Learn more

Visit the website for more information.

Learn more