Four things happen, in order, for every visitor to a site we protect — before any of it reaches your ad spend.
Every visitor is verified at the network edge, before your page loads — not by a JavaScript snippet your page runs after the fact. Traffic that never executes JavaScript stays invisible to snippet-based tools. It doesn’t stay invisible here.
A source showing invalid patterns is written to your Google Ads exclusion list automatically. That can’t undo the click that already happened — nothing can, once it’s billed. It stops that same source from reaching your page, and your budget, a second time.
Every block is kept with its date, campaign and keyword — the three fields an invalid traffic investigation asks you for. Continuously, not only once something looks wrong.
An invalid traffic investigation only reaches back sixty days. Past that, the traffic can’t be reviewed and a record can’t be built after the fact. When you open one, the dates, campaigns and keywords are already there.
What this doesn’t do: reverse a click that’s already happened. What it does: keep that source from reaching your page again, and keep the record so you’re not guessing when you ask Google to look at it.