---
title: "Validation settings reference"
description: "Every selector on the Validation settings page — what it catches, the Rejection Reason it writes, its default and the mode it follows — the three deduplication and signature selectors, the four time windows, the three flags that only label the event, what click IDs carry, and which impressions and clicks carry the signature."
type: "reference"
audience: [admin, developer]
keywords: [INVALID_SIGNATURE, EXPIRED_SIGNATURE, SUSPECTED_IP, CLICK_FRAUD, IP_BLACKLIST, DUPLICATE, EXPIRED_CLICK, SEQUENTIAL_CONVERSION, IP_TIME_FRAME, th signature, transaction id, signature max age, signature max lead, video impression max age, Match impressions with ad request, Ad request ID in click IDs, User IP in click IDs, $$SUB_ID, $$CLICK_ID$$, $$ACTION_DATA$$, which beacons are signed]
ui_path: "Admin → Validation & anti-fraud → Validation settings"
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Validation settings reference

Reference for [Tune the validation settings](https://epom.com/ad-server/docs/guides/admin/validation-settings.md). On screen the settings
are grouped by event: **Impressions** (Impression signature check with its three time windows,
Impression deduplication, Impressions validation, Video impressions: suspected-IP check, Match
impressions with ad request), **Clicks** (Click signature check with its time window, Click
deduplication, Clicks validation, Match clicks with ad request), **Conversions** (Conversion
deduplication (S2S), Do not record the same user sequential conversions, Conversion per IP time
frame, Match conversions with ad request), **Click IDs** (Ad request ID in click IDs, User IP in
click IDs) and **All events** (IP blacklist check). Each event lists its checks in the same order:
signature, duplicates, fraud patterns, then matching with the ad request. Hover the ⓘ beside a
setting for what it does.

## The three modes

Every check is a selector with three modes:

- **Off** — the check does not run.
- **Monitor** — the check runs and labels what it catches with a **Rejection Reason**, but the
  event still counts: it stays in the General report, the delivery limits and billing. Group the
  Advanced report by *Rejection Reason* to see how much enforcing would remove. Start here.
- **Enforce** — what the check catches is refused: kept out of the General report, limits and
  billing, and counted under the *Rejected* columns with its reason. This is how the old ticked
  box behaved.

A box that was ticked before the upgrade comes up as **Enforce**, an unticked one as **Off** —
nothing changes until you pick Monitor. The legacy admin page still shows these as boxes; ticking
one there brings the check back in the mode it was last in. Every setting is network-wide and
applies from the moment you save; none of them reprocesses past data.

## Checks that change what is counted

| Selector | What it catches | Reason | Default |
|---|---|---|---|
| **Impression signature check** | An impression whose beacon signature is missing, forged or older than the signature windows. A beacon carries one signature, bound to the ad request it was rendered for (`th`), and since release 154 that is the only one checked: a beacon without it, or with one minted for another ad request, does not count. Off signs nothing and refuses nothing | `INVALID_SIGNATURE`, `EXPIRED_SIGNATURE` | Enforce |
| **Impressions validation** | Web impressions from an address with too many impressions or user agents. Enforce refuses them and bans the worst addresses into the IP blacklist; **Monitor only labels them and bans nothing**. Needs *IP blacklist check* on as well. A web impression whose address belongs to a mobile carrier is left to its signature instead — thousands of subscribers share one carrier address, so its count says nothing about any one of them. A video impression from such an address is judged by the next selector instead. | `SUSPECTED_IP` | Enforce |
| **Video impressions: suspected-IP check** | A video impression from an address *Impressions validation* suspects. CTV players, server-side ad insertion stitchers and mobile carriers send many viewers' beacons from one address, so while this is **Off** a video impression counts on its signature alone. Monitor labels it, Enforce refuses it — never more than *Impressions validation* does itself, so it acts only while that check is on. Since release 154 it judges every video beacon, signed or not: the age-only pass an unsigned video beacon used to get is gone. Until you pick a mode it follows the ad-serving configuration. | `SUSPECTED_IP` | Off |
| **Clicks validation** | Fraudulent clicks: no user cookie where one is expected, or too many clicks from one address or user on a banner. It also runs the IP blacklist on clicks — such a click is refused only while both this check and *IP blacklist check* enforce. | `CLICK_FRAUD`, `IP_BLACKLIST` | Enforce |
| **Conversion deduplication (S2S)** (*Conversions validation* on the legacy admin page) | Duplicate conversions — **server-to-server only**, and only for actions that also have their own *Reject duplicate conversions* switch on. The pixel path uses a separate server-side setting (ask Epom support or your account manager), which this selector does not change. | `DUPLICATE` | Off |
| **Do not record the same user sequential conversions** | A conversion for a banner or campaign that this user's capping or a realtime limit already rules out. A reached cap on one conversion action rules out only conversions of that action. Cookie and mixed conversion caps also hold server-side, so the check works on S2S postbacks too. An IP conversion cap is checked against the tracker's address on an S2S postback | `SEQUENTIAL_CONVERSION` | Off |
| **Conversion per IP time frame** | A conversion caught by one of the two per-IP windows set on its conversion action | `IP_TIME_FRAME` | Enforce |
| **IP blacklist check** | Impressions, clicks, conversions and passbacks from an address on the **Ban & white-listed IPs** tab; white-listed ranges always pass. Off stops the matching at once. A passback carries the reason since release 155; one refused earlier has none. | `IP_BLACKLIST` | Enforce |

The user-agent blacklist on clicks is not part of *Clicks validation* — a click from a blacklisted
user agent is refused whatever mode the selector is in.

An event two checks catch carries one reason. A refused event shows the reason of the check that
refused it; one that counts shows the first check that labelled it. A repeated click, or one on an
expired or edited link, also trips *Clicks validation* (same visitor, same banner, seconds apart):
when both refuse it, or both only monitor, it reads `DUPLICATE` or `EXPIRED_CLICK`, the more exact
reason, so *Duplicate clicks* and *Expired clicks* still count it.

## Tracking validation

Three selectors — one in the Impressions group, two in the Clicks group — catch impressions and
clicks that arrive more than once, and click links that are too old. Each takes **Off**,
**Monitor** or **Enforce**.

| Selector | What it catches | Recognised for |
|---|---|---|
| **Impression deduplication** | A second impression of the same render of a banner — same ad request, placement and render time. A placement rotation that serves the banner again is a new render, not a repeat | *Signature max age* plus a minute for a banner (about 11 minutes by default), *Video impression max age* for a video (5 hours) — how long the original impression could still be accepted |
| **Click signature check** | A click on a link that carries a signature (`th`) which is forged or was made for another ad request, or on a signed link older than the Clicks group's *Signature max age* — see [below](#which-impressions-and-clicks-carry-the-signature) | — |
| **Click deduplication** | A second click on the same render of a banner — same ad request, placement and render time | The Clicks group's *Signature max age*, 24 hours by default |

- **Monitor** counts the event as usual and labels it, so **Duplicate impressions**, **Duplicate
  clicks** and **Expired clicks** on the Advanced report show what enforcing would remove. Start
  here. These columns are in the report's [Extended view](https://epom.com/ad-server/docs/reference/metrics.md#extended-view)
  — switch to it under **Preferences → Advanced analytics view**; the Simple view has no
  per-reason columns, only the *Rejection Reason* grouping.
- **Enforce** keeps the event out of the General report, delivery limits and billing; it is
  counted under the Rejected columns instead.
- Until you change one, each selector shows the mode the ad-serving configuration gives — **Off**
  for all three as shipped — and keeps following that configuration when you save the page
  without touching it. Once you pick a mode, yours applies.

To see why events were refused, group the Advanced report, or the Impressions or Clicks log, by
**Rejection Reason**.

Ads after the first in one VAST response (a pod or a repeat) are numbered, so their impressions
and clicks are different ones, not duplicates.

## Time windows

Four fields set how long an impression beacon or a click link stays acceptable. All four are in
seconds; leave one empty to use the default, which its placeholder shows (*Default: 600*). The
defaults come from the ad-server configuration — ask Epom support or your account manager to
change them for every account at once.

| Field | Group | What it sets | Default | Allowed |
|---|---|---|---|---|
| **Signature max age** | Impressions | How old a banner impression beacon may be and still count | 600 (10 minutes) | 30 – 3,600 |
| **Signature max lead** | Impressions | How far ahead of the server clock a beacon may be, to absorb clock drift between servers | 60 | 0 – 600 |
| **Video impression max age** | Impressions | How long after the VAST response a video impression may still arrive | 18,000 (5 hours) | 60 – 86,400 |
| **Signature max age** | Clicks | How long a click link stays valid for *Click signature check*, and how long a click is remembered for *Click deduplication* | 86,400 (24 hours) | 60 – 2,592,000 (30 days) |

The signature windows apply whenever *Impression signature check* is on — they are not new, only
editable here now. A value outside the allowed range is refused with a message under its field,
and nothing on the form is saved until it is fixed. Shortening *Signature max age* also shortens
how long a header-bidding quote is valid — the bid's expiry is taken from the same window, so a
bid rendered after it counts for nothing.

## Flags that only label the event

| Checkbox | What it actually does | Default |
|---|---|---|
| **Match impressions with ad request** | Stamps a validation marker on the raw impression record. | Off |
| **Match clicks with ad request** | Same, for clicks. | Off |
| **Match conversions with ad request** | Same, for conversions, using the per-action *Match conversions with request* setting. | Off |

These three **reject nothing**. They mark the raw log record; whether an event is then treated as
invalid is decided later in analytics processing, not by the ad server. They will not change your
General-report numbers.

## What click IDs carry

Two selectors in the **Click IDs** group decide what goes into every click ID the ad server mints
— the `$$SUB_ID(…)$$`, `$$CLICK_ID$$` / `$$ACTION_DATA$$` values an advertiser sends back with a
conversion. Each is **Default**, **Included** or **Left out**. **Default** follows the ad-serving
configuration and says what that is, for example *Default: Left out*; choosing it again hands a
selector you changed back to the configuration.

| Selector | What it carries | Default |
|---|---|---|
| **Ad request ID in click IDs** | The transaction ID of the ad request the click came from, in the click and view cookies too. *Conversion deduplication* tells one ad request from another by it, so leave it in unless click IDs must be as short as possible. | Included |
| **User IP in click IDs** | The visitor's IP and origin (LES) IP, so a conversion action with **Apply the click's user IP to server-to-server conversions** ticked judges its postbacks by the visitor rather than by the advertiser's server — see [Create and edit conversion actions](https://epom.com/ad-server/docs/guides/conversions/conversion-actions.md#options-and-fields). Goes only into encrypted (version 2) click IDs; while your network mints the older format, a note under the selector says so and the IP stays out. Without the visitor's consent only what the logs keep goes in: an IPv4 address without its last octet, an IPv6 address cut to its /48. A private, loopback, link-local, carrier-grade NAT, reserved or documentation address names no visitor and is never put in. Adds about seven characters to a click ID. The click ID travels in landing URLs and postbacks, and its encryption keeps the IP from casual view, not from a determined party holding the click ID: include it only where your privacy terms allow handing the visitor's IP to the advertisers whose conversions you track. | Left out |

A change applies to click IDs minted from then on; those already in landing pages and postback
templates keep what they were minted with.

## Which impressions and clicks carry the signature

An impression beacon without the release-153 signature (`th`), or with one minted for another ad
request, is `INVALID_SIGNATURE` under *Impression signature check* — refused while that check
enforces, labelled while it monitors; the older per-second signature is no longer read. *Video
impressions: suspected-IP check* judges every video beacon, signed or not.

| | Signed (while a matching check is on) | Never signed |
|---|---|---|
| Impressions | Banner beacons and the `$$IMPRESSION_IMG_URL$$` / `$$IMPRESSION_TAG_JS$$` macros, impression redirects (`/ir`, the `$$IMPRESSION_REDIRECT_URL$$` macro), mobile-SDK and API beacons, native impression trackers, VAST `<Impression>` (ours and a DSP's VAST), no-impression beacons | The click-through placement's static impression pixel, e-mail placements (counted with the ad request) |
| Clicks | `click.gif` (the `$$CLICK_URL$$` macro, SDK click beacons, VAST click tracking), `/cr` redirects (the `$$CLICK_REDIRECT_URL$$` macros, native links, API ads, DSP markup, VAST click-through) | The click-through placement's static links (console tab and the tracking-urls REST call — exempt from both click checks), e-mail clicks |

Beacons and links rendered while the matching checks were off carry no signature either. *Click
signature check* refuses a click only for a signature that matches no key the network has used (on
a link that still has its transaction id), or for a correctly signed link older than the Clicks
group's *Signature max age*. A signature also names the kind of hit it was made for, so an
impression's never passes as a click's.

A click link carries a signature only while *Click signature check* or *Click deduplication* is on
(Monitor or Enforce), and an impression beacon while *Impression signature check* or *Impression
deduplication* is. Links rendered while those were off carry none. **Impression beacons are the
exception:** switching *Impression signature check* from Off
to Monitor or Enforce flags or refuses every beacon rendered while it was off, because a beacon
without `th` is `INVALID_SIGNATURE` — for as long as such beacons keep arriving, which is up to the
impression signature window for web beacons and up to the video window for VAST. Switch it on
outside peak hours, or go through Monitor first.

The signing key is a server setting. When Epom support changes it, links and beacons signed with
the old key keep verifying for a day, while the old key is kept as the previous one. Each rotation
of a placement (its refresh interval in the ad tag) is a new ad request with its own transaction
id, unless the publisher passes their own id in the tag (`data-trx-id`), which every rotation keeps
sending. Since release 153 the Unique view's direct requests, impressions, clicks and conversions
therefore count each rotation separately.

## Related

- [Tune the validation settings](https://epom.com/ad-server/docs/guides/admin/validation-settings.md)
- [Moderate banners, sites and traffic quality](https://epom.com/ad-server/docs/guides/admin/moderation-and-quality.md)
- [Conversion actions](https://epom.com/ad-server/docs/guides/conversions/conversion-actions.md)
- [Metrics reference](https://epom.com/ad-server/docs/reference/metrics.md)
- [Invalid traffic (IVT) and how Epom flags it](https://epom.com/ad-server/docs/concepts/invalid-traffic-and-risk-scoring.md)