Validation settings reference

Reference for Tune the validation settings. On screen the settings are grouped by event: Impressions (Impression signature check with its three time windows, Impression deduplication, Impressions validation, Video impressions: suspected-IP check, Match impressions with ad request), Clicks (Click signature check with its time window, Click deduplication, Clicks validation, Match clicks with ad request), Conversions (Conversion deduplication (S2S), Do not record the same user sequential conversions, Conversion per IP time frame, Match conversions with ad request), Click IDs (Ad request ID in click IDs, User IP in click IDs) and All events (IP blacklist check). Each event lists its checks in the same order: signature, duplicates, fraud patterns, then matching with the ad request. Hover the ⓘ beside a setting for what it does.

The three modes

Every check is a selector with three modes:

• Off — the check does not run.
• Monitor — the check runs and labels what it catches with a Rejection Reason, but the event still counts: it stays in the General report, the delivery limits and billing. Group the Advanced report by Rejection Reason to see how much enforcing would remove. Start here.
• Enforce — what the check catches is refused: kept out of the General report, limits and billing, and counted under the Rejected columns with its reason. This is how the old ticked box behaved.

A box that was ticked before the upgrade comes up as Enforce, an unticked one as Off — nothing changes until you pick Monitor. The legacy admin page still shows these as boxes; ticking one there brings the check back in the mode it was last in. Every setting is network-wide and applies from the moment you save; none of them reprocesses past data.

Checks that change what is counted

Selector	What it catches	Reason	Default
Impression signature check	An impression whose beacon signature is missing, forged or older than the signature windows. A beacon carries one signature, bound to the ad request it was rendered for (th), and since release 154 that is the only one checked: a beacon without it, or with one minted for another ad request, does not count. Off signs nothing and refuses nothing	INVALID_SIGNATURE, EXPIRED_SIGNATURE	Enforce
Impressions validation	Web impressions from an address with too many impressions or user agents. Enforce refuses them and bans the worst addresses into the IP blacklist; Monitor only labels them and bans nothing. Needs IP blacklist check on as well. A web impression whose address belongs to a mobile carrier is left to its signature instead — thousands of subscribers share one carrier address, so its count says nothing about any one of them. A video impression from such an address is judged by the next selector instead.	SUSPECTED_IP	Enforce
Video impressions: suspected-IP check	A video impression from an address Impressions validation suspects. CTV players, server-side ad insertion stitchers and mobile carriers send many viewers’ beacons from one address, so while this is Off a video impression counts on its signature alone. Monitor labels it, Enforce refuses it — never more than Impressions validation does itself, so it acts only while that check is on. Since release 154 it judges every video beacon, signed or not: the age-only pass an unsigned video beacon used to get is gone. Until you pick a mode it follows the ad-serving configuration.	SUSPECTED_IP	Off
Clicks validation	Fraudulent clicks: no user cookie where one is expected, or too many clicks from one address or user on a banner. It also runs the IP blacklist on clicks — such a click is refused only while both this check and IP blacklist check enforce.	CLICK_FRAUD, IP_BLACKLIST	Enforce
Conversion deduplication (S2S) (Conversions validation on the legacy admin page)	Duplicate conversions — server-to-server only, and only for actions that also have their own Reject duplicate conversions switch on. The pixel path uses a separate server-side setting (ask Epom support or your account manager), which this selector does not change.	DUPLICATE	Off
Do not record the same user sequential conversions	A conversion for a banner or campaign that this user’s capping or a realtime limit already rules out. A reached cap on one conversion action rules out only conversions of that action. Cookie and mixed conversion caps also hold server-side, so the check works on S2S postbacks too. An IP conversion cap is checked against the tracker’s address on an S2S postback	SEQUENTIAL_CONVERSION	Off
Conversion per IP time frame	A conversion caught by one of the two per-IP windows set on its conversion action	IP_TIME_FRAME	Enforce
IP blacklist check	Impressions, clicks, conversions and passbacks from an address on the Ban & white-listed IPs tab; white-listed ranges always pass. Off stops the matching at once. A passback carries the reason since release 155; one refused earlier has none.	IP_BLACKLIST	Enforce

The user-agent blacklist on clicks is not part of Clicks validation — a click from a blacklisted user agent is refused whatever mode the selector is in.

An event two checks catch carries one reason. A refused event shows the reason of the check that refused it; one that counts shows the first check that labelled it. A repeated click, or one on an expired or edited link, also trips Clicks validation (same visitor, same banner, seconds apart): when both refuse it, or both only monitor, it reads DUPLICATE or EXPIRED_CLICK, the more exact reason, so Duplicate clicks and Expired clicks still count it.

Tracking validation

Three selectors — one in the Impressions group, two in the Clicks group — catch impressions and clicks that arrive more than once, and click links that are too old. Each takes Off, Monitor or Enforce.

Selector	What it catches	Recognised for
Impression deduplication	A second impression of the same render of a banner — same ad request, placement and render time. A placement rotation that serves the banner again is a new render, not a repeat	Signature max age plus a minute for a banner (about 11 minutes by default), Video impression max age for a video (5 hours) — how long the original impression could still be accepted
Click signature check	A click on a link that carries a signature (th) which is forged or was made for another ad request, or on a signed link older than the Clicks group’s Signature max age — see below	—
Click deduplication	A second click on the same render of a banner — same ad request, placement and render time	The Clicks group’s Signature max age, 24 hours by default

• Monitor counts the event as usual and labels it, so Duplicate impressions, Duplicate clicks and Expired clicks on the Advanced report show what enforcing would remove. Start here. These columns are in the report’s Extended view — switch to it under Preferences → Advanced analytics view; the Simple view has no per-reason columns, only the Rejection Reason grouping.
• Enforce keeps the event out of the General report, delivery limits and billing; it is counted under the Rejected columns instead.
• Until you change one, each selector shows the mode the ad-serving configuration gives — Off for all three as shipped — and keeps following that configuration when you save the page without touching it. Once you pick a mode, yours applies.

To see why events were refused, group the Advanced report, or the Impressions or Clicks log, by Rejection Reason.

Ads after the first in one VAST response (a pod or a repeat) are numbered, so their impressions and clicks are different ones, not duplicates.

Time windows

Four fields set how long an impression beacon or a click link stays acceptable. All four are in seconds; leave one empty to use the default, which its placeholder shows (Default: 600). The defaults come from the ad-server configuration — ask Epom support or your account manager to change them for every account at once.

Field	Group	What it sets	Default	Allowed
Signature max age	Impressions	How old a banner impression beacon may be and still count	600 (10 minutes)	30 – 3,600
Signature max lead	Impressions	How far ahead of the server clock a beacon may be, to absorb clock drift between servers	60	0 – 600
Video impression max age	Impressions	How long after the VAST response a video impression may still arrive	18,000 (5 hours)	60 – 86,400
Signature max age	Clicks	How long a click link stays valid for Click signature check, and how long a click is remembered for Click deduplication	86,400 (24 hours)	60 – 2,592,000 (30 days)

The signature windows apply whenever Impression signature check is on — they are not new, only editable here now. A value outside the allowed range is refused with a message under its field, and nothing on the form is saved until it is fixed. Shortening Signature max age also shortens how long a header-bidding quote is valid — the bid’s expiry is taken from the same window, so a bid rendered after it counts for nothing.

Flags that only label the event

Checkbox	What it actually does	Default
Match impressions with ad request	Stamps a validation marker on the raw impression record.	Off
Match clicks with ad request	Same, for clicks.	Off
Match conversions with ad request	Same, for conversions, using the per-action Match conversions with request setting.	Off

These three reject nothing. They mark the raw log record; whether an event is then treated as invalid is decided later in analytics processing, not by the ad server. They will not change your General-report numbers.

What click IDs carry

Two selectors in the Click IDs group decide what goes into every click ID the ad server mints — the $$SUB_ID(…)$$, $$CLICK_ID$$ / $$ACTION_DATA$$ values an advertiser sends back with a conversion. Each is Default, Included or Left out. Default follows the ad-serving configuration and says what that is, for example Default: Left out; choosing it again hands a selector you changed back to the configuration.

Selector	What it carries	Default
Ad request ID in click IDs	The transaction ID of the ad request the click came from, in the click and view cookies too. Conversion deduplication tells one ad request from another by it, so leave it in unless click IDs must be as short as possible.	Included
User IP in click IDs	The visitor’s IP and origin (LES) IP, so a conversion action with Apply the click’s user IP to server-to-server conversions ticked judges its postbacks by the visitor rather than by the advertiser’s server — see Create and edit conversion actions. Goes only into encrypted (version 2) click IDs; while your network mints the older format, a note under the selector says so and the IP stays out. Without the visitor’s consent only what the logs keep goes in: an IPv4 address without its last octet, an IPv6 address cut to its /48. A private, loopback, link-local, carrier-grade NAT, reserved or documentation address names no visitor and is never put in. Adds about seven characters to a click ID. The click ID travels in landing URLs and postbacks, and its encryption keeps the IP from casual view, not from a determined party holding the click ID: include it only where your privacy terms allow handing the visitor’s IP to the advertisers whose conversions you track.	Left out

A change applies to click IDs minted from then on; those already in landing pages and postback templates keep what they were minted with.

Which impressions and clicks carry the signature

An impression beacon without the release-153 signature (th), or with one minted for another ad request, is INVALID_SIGNATURE under Impression signature check — refused while that check enforces, labelled while it monitors; the older per-second signature is no longer read. Video impressions: suspected-IP check judges every video beacon, signed or not.

	Signed (while a matching check is on)	Never signed
Impressions	Banner beacons and the $$IMPRESSION_IMG_URL$$ / $$IMPRESSION_TAG_JS$$ macros, impression redirects (/ir, the $$IMPRESSION_REDIRECT_URL$$ macro), mobile-SDK and API beacons, native impression trackers, VAST <Impression> (ours and a DSP’s VAST), no-impression beacons	The click-through placement’s static impression pixel, e-mail placements (counted with the ad request)
Clicks	click.gif (the $$CLICK_URL$$ macro, SDK click beacons, VAST click tracking), /cr redirects (the $$CLICK_REDIRECT_URL$$ macros, native links, API ads, DSP markup, VAST click-through)	The click-through placement’s static links (console tab and the tracking-urls REST call — exempt from both click checks), e-mail clicks

Beacons and links rendered while the matching checks were off carry no signature either. Click signature check refuses a click only for a signature that matches no key the network has used (on a link that still has its transaction id), or for a correctly signed link older than the Clicks group’s Signature max age. A signature also names the kind of hit it was made for, so an impression’s never passes as a click’s.

A click link carries a signature only while Click signature check or Click deduplication is on (Monitor or Enforce), and an impression beacon while Impression signature check or Impression deduplication is. Links rendered while those were off carry none. Impression beacons are the exception: switching Impression signature check from Off to Monitor or Enforce flags or refuses every beacon rendered while it was off, because a beacon without th is INVALID_SIGNATURE — for as long as such beacons keep arriving, which is up to the impression signature window for web beacons and up to the video window for VAST. Switch it on outside peak hours, or go through Monitor first.

The signing key is a server setting. When Epom support changes it, links and beacons signed with the old key keep verifying for a day, while the old key is kept as the previous one. Each rotation of a placement (its refresh interval in the ad tag) is a new ad request with its own transaction id, unless the publisher passes their own id in the tag (data-trx-id), which every rotation keeps sending. Since release 153 the Unique view’s direct requests, impressions, clicks and conversions therefore count each rotation separately.

Related

• Tune the validation settings
• Moderate banners, sites and traffic quality
• Conversion actions
• Metrics reference
• Invalid traffic (IVT) and how Epom flags it