To make money with Google Ads, you must position yourself as the strategic manager of Google's AI ecosystem rather than a manual keyword bidder. Success relies on high-quality first-party data, strict conversion tracking, and AI-driven automation tools like Performance Max.

1. Choose a monetization model

• E-commerce: Sell physical goods via Shopify or WooCommerce using Google Merchant Center Next. Target high-margin, niche items where you can absorb initial ad costs.
• Lead generation: Generate phone calls or form submissions for high-ticket local service businesses (e.g., roofers, lawyers, HVAC). Sell these leads directly to providers or earn a flat retainer.
• Affiliate marketing: Drive targeted traffic to high-commission digital products, software-as-a-service (SaaS) platforms, or financial services. Ensure landing pages strictly comply with Google Ads Editorial Policies.
• Agency services: Manage campaigns for traditional brick-and-mortar businesses. Charge a flat monthly retainer or a percentage of their total monthly ad spend (typically 10% to 20%).

Diving Deeper Into Products to Sell:

1. Service businesses: Pay-per-lead or monthly retainers. Local or national service businesses (e.g., HVAC, legal, coaching) thrive on immediate, high-intent phone calls and form fills.

• Best model: Flat-fee lead generation or percentage-of-ad-spend management retainers.
• Campaign setup: Use Search Campaigns featuring explicit "Call Only" or "Asset Extension" formats. Target high-intent keywords like emergency plumber near me or corporate tax attorney pricing.
• Key metric: Cost per acquisition (CPA). Optimize for phone call duration over raw website clicks.

2. Digital products: Direct-response e-commerceDigital products (e.g., SaaS, courses, downloadable templates) offer near-100% profit margins, allowing you to bid aggressively on competitor terms.

• Best model: Direct sales via value-based tier structures (e.g., monthly subscriptions or one-time lifetime access).
• Campaign setup: Deploy Search Campaigns targeting competitor brand names (e.g., alternatives to [Competitor SaaS]) alongside Performance Max campaigns utilizing strict audience signals built from your current customer list.
• Key metric: Customer lifetime value (LTV) to CPA ratio. Aim for an initial break-even on day one, then capitalize on long-term subscription retention.

3. Physical products: Target ROAS e-commerce physical goods face tight product margins, shipping overhead, and intense market competition.

• Best model: High-volume retail sales driven by automated asset matching.
• Campaign setup: Utilize Performance Max integrated directly with Google Merchant Center Next. Segment your inventory into distinct product buckets: place your top 20% highest-margin best-sellers into a dedicated high-budget campaign, and relegate "zombie" products to a low-budget, high-ROAS campaign.
• Key metric: Return on ad spend (ROAS). Your minimum profitable ROAS must exceed your cost of goods sold (COGS) and operational expenses.

4. Consulting: High-ticket client acquisition consulting relies on trust, authority, and relationship building. Cold traffic rarely buys high-ticket consulting packages directly from an ad.

• Best model: Multi-step funnel monetization (advertising an un-gated asset or low-friction event to book an intake call).
• Campaign setup: Drive high-intent Search traffic to a value-first landing page (e.g., a free case study, video masterclass, or whitepaper). Once users engage, deploy a dedicated YouTube and Display Remarketing campaign to keep your brand top-of-mind until they book a consultation.
• Key metric: Earnings per click (EPC) and application submission rate.

2. Execute the setup sequence

[Deep Conversion Tracking Setup] ──> [Exact Match Testing Campaign] ──> [Scale via Performance Max & AI]

1. Deploy advanced tracking: Install the Google tag and configure Enhanced Conversions. If you run lead generation, set up offline conversion tracking to feed CRM data back to Google.
2. Launch an exact-match test: Start with an explicit, tight list of exact-match keywords to gather clean data. This blocks Google's AI from wasting your budget on loose, irrelevant search terms early on.
3. Transition to smart bidding: Once your campaign generates 30+ conversions within 30 days, change your bidding strategy to Target CPA or Target ROAS to let the algorithm find profitable audiences.

3. Protect your profit margins

• Calculate unit economics: Never run ads without knowing your target metrics. Use the formula below to find your maximum allowable cost-per-click before spending money:
  \(\text{Max\ CPC}=\text{Product\ Profit\ Margin}\times \text{Website\ Conversion\ Rate}\)
• Audit search terms daily: Check your search terms report every 24 hours. Aggressively add non-converting or irrelevant phrases to your account-level negative keyword list.
• Diversify ad assets: When using Performance Max, supply high-resolution images, 4K vertical video assets, and highly specific text headlines. Low-quality creative assets degrade your ad placements and increase your costs.

Core Strategies for Google Ads

1. Build a bottom-up funnel
--

Prioritize the highest-converting segments first.

• Bottom: Launch high-intent Search or Shopping campaigns focusing on your best-selling, highest-margin product or service.
• Middle: Layer in remarketing and Performance Max campaigns to re-engage past website visitors.
• Top: Introduce Demand Gen or video campaigns once lower-funnel tactics are consistently profitable.

2. Guide AI smart bidding with data

Google's automated bidding is powerful, but it requires strategic guardrails.

• Conversion tracking: Ensure deep tracking is functional so the algorithm optimizes for actual revenue rather than cheap clicks.
• Target ROAS/CPA: Transition from "Maximize Conversions" to Target CPA or Target ROAS once you accumulate 30+ conversions. Set realistic targets based on actual profit margins.
• Value-based bidding: For B2B lead generation, import offline conversion data using GCLID (Google Click ID) to teach AI to bid on qualified leads over raw form fills.

3. Implement strict match type segmentation

Avoid blending all match types into a single ad group, which leads to budget dilution.

• Isolate broad match: Keep broad match keywords in separate, standalone campaigns. Pair them with strict Target CPA constraints so the algorithm does not bid on irrelevant terms.
• Exact match testing: Utilize exact match in new campaigns with restricted budgets to maintain full control over your initial search terms.

4. Optimize the "Zombie Product" approach for e-commerceMaximize standard shopping or Performance Max campaign budgets using product segmentation.

• Best sellers: Allocate 70% to 80% of your budget to your top-performing, highly profitable items.
• Zombie products: Place low-performing or zero-click products into a separate campaign with a small budget allocation (10% to 20%) and high ROAS restrictions. This forces Google to give them impressions without harming your main campaign performance.

5. Prioritize ad relevance and quality scoreA higher Quality Score directly lowers your cost-per-click (CPC).

• Ad copy specificity: Write responsive search ads with natural, benefits-focused copy. Avoid generic call-to-actions.
• Keyword integration: Ensure the primary keyword triggers clear headline matches.
• Landing pages: Never send all traffic to the homepage. Align the search term directly with a dedicated, fast-loading landing page to maximize conversion rates

The Ideal Funnel with Google Ads

The most effective conversion-optimized funnel follows a three-stage visual architecture that minimizes friction and maximizes user intent. [1, 2]

1. Top of funnel: The landing page layout your landing page must load in under two seconds and pass the "five-second test" (a user must understand what you offer immediately).

• The hero section (Above the fold):
  • Primary headline: Focus strictly on the core benefit or outcome (e.g., "Double Your Inbound Leads Without Increasing Ad Spend").
  • Sub-headline: Explain how you deliver that benefit in one short sentence.
  • Hero media: A high-context image of your product, a 60-second explainer video, or a preview of the digital asset.
  • Primary call-to-action (CTA): A high-contrast button featuring action-oriented text (e.g., "Get My Free Strategy Plan"). Place a single, low-friction form field (email or phone) directly next to or inside it.
• Middle section (Social proof & value):
  • Social proof banner: Display recognizable client logos or 5-star review badges directly below the hero section.
  • The 3-benefit matrix: Use three parallel, icon-based columns detailing your unique selling propositions (USPs). Keep text under 15 words per column.
  • Deep social proof: Embed screenshot-style reviews or short video testimonials highlighting specific revenue, time, or cost savings.
• Bottom section (Friction reduction):
  • Frequently asked questions (FAQ): Use an accordion-style dropdown to address the top 4 to 5 common sales objections.
  • Secondary CTA: Repeat the primary hero button at the very bottom of the page to eliminate scrolling.

2. Middle of funnel: The frictionless checkout / intake layoutOnce a user clicks the CTA, transition them to a dedicated page designed exclusively to collect data or payment.

• For lead generation / consulting: Use a multi-step conditional form (e.g., Typeform or Typeflow) instead of a long single-page form.
  • Step 1: Ask an easy, low-friction question (e.g., "What is your current monthly revenue?").
  • Step 2: Ask the secondary qualifiers.
  • Step 3: Collect sensitive contact info (Name, Email, Phone) on the final step after they have already invested time.
• For e-commerce / digital products: Use a single-page 2-column checkout.
  • Left Column: Data entry (Shipping, Billing, Contact info) utilizing automated address auto-complete tools.
  • Right Column: Order summary containing security badges, a thumbnail of the item, and a clear breakdown of the total cost.

3. Bottom of funnel: The monetization boost layoutDo not send users to a generic "Thank You" page. Use the immediate post-purchase moment of maximum engagement to increase your average order value (AOV).

• Step 1: One-click upsell (OTO): Present a highly relevant, complementary offer before showing the final receipt page. The user can add it to their order with a single click without re-entering payment details.
• Step 2: The dynamic confirmation page:
  • Confirm the order details clearly at the top.
  • Embed a clear Next Steps checklist (e.g., "Check your inbox for your login details" or "Book your onboarding call on the calendar below").

Ultimately, scaling a profitable Google Ads framework in 2026 demands that you transition from a manual keyword bidder to a strategic manager of Google’s AI-driven ecosystem.

By aligning your monetization model—whether that means targeting high-intent phone calls for local services, scaling e-commerce via automated Performance Max "zombie product" segmentation, or driving multi-step consulting funnels —with a lightning-fast, conversion-optimized landing page, you secure a structural advantage over your competitors.

Success hinges on feeding Google's smart bidding algorithms immaculate, first-party data via Enhanced Conversions and strict value-based tracking while aggressively pruning your daily search terms report to insulate your profit margins.

A critical piece often left out of early campaign planning is the mandatory integration of Consent Mode V3 and strict privacy-compliant tracking loops, which are legally required to prevent data degradation and keep your audience signals accurate as machine learning scales your account.

Implement these guardrails, build your funnel from the bottom up, and let data-backed automation compounding over time do the heavy lifting for your business.

Replay attacks are a constant threat for websites currently protected by typical bot management solutions.

Back when we started research into these products two years ago, the obfuscation on multi-billion dollar companies' solutions was laughable - a simple array of strings, maybe with a small shuffle operation. Many companies used javascript-obfuscator. (1)

The packets sent to the server though? Very easy to replace. Often, there wasn't even a timestamp included, which means that you can for as long as you want reuse a given packet to regenerate bypass cookies.

In other words, the website was not protected at all.

Soon though, companies like HUMAN security (nothing says humanity like having to say it explicitly in your name) implemented key obfuscation per-version, which did mitigate some replay attacks. No longer could you send PX503 and the like, but you actually had to parse out each version using regex if you like waking up at strange hours and all your bypass breaking, and AST if you are sane.

^(.*?,){11}P

Beautiful.

But the story doesn't stop there. I started pushing for antibots (colloquially called bot managers by the uninitiated) to use Javascript Virtual Machines here. Around this time, there were reports of some big companies whose researchers were finally able to convince their bosses to do the switch:

Which is really good for everyone, if I'm being honest. Raising the bar makes good researchers better on all sides, and pushes the script kiddies further out.

Unfortunately the actual gathered data of these companies remained the same, and alas, as such, most are still vulnerable to replay attacks, advanced stealth browsers, and advanced request bots either parsing solver style, or executing in a crafted sandbox.

But at least one battle won.

Till next time!

1. (which now has vibe-coded VM protection, which is a bit sad as their obfuscation is quite good if not overused).

Live Demo | FPScanner

See FPScanner in action. Collect your browser fingerprint and view the decrypted results.

FPScanner

The awesome Antonie Vastel focuses mostly in his research on reported browser javascript -level signal inconsistencies.

For instance, hasMismatchLanguages has been a favorite for datadome for some time (Antonie was the primary researcher up until recently there). It is often a problem for scrapers that they are using outdated or incorrect ip information, placing a given ip in Nebraska so the timezone will not match its real location in New York. This can help, but it's not a strong signal by itself.

There are often inconsistencies when using CDP to spoof the browser overrides, and this is something that is very old and Google has no incentive to fix it, as it is one of the primary means of detecting automation: https://issues.chromium.org/issues/40236995 (WorkerNavigator.platform still leaks original value, TL;DR)

You might notice going over the fingerprint json at fpscanner.com the automation signals - these are the strongest signals in the book - however, to implement this properly you need a lot more signals, for instance, nightmare is an indicator of https://github.com/segment-boneyard/nightmare.

These signals are great and all, but all of them can be spoofed in the hands of the right bypass researcher (yes, scraping has researchers: https://nullpt.rs/reverse-engineering-tiktok-vm-1).

If you're still blocking by IP and User-Agent, you are very, very behind.

Let's talk about the obvious.

CreepJS

Intro

If you don't know what this is, you don't really know how to block bots.

There are a lot of good sensors here - and it is very hard to spoof them all, perfectly.

But there's another issue here, and that is that if you're only blocking on signals like these, you end up with an ml nightmare classifier that gives you a bot score - a percentage likelihood.

These statistically based bot scores are not so useful without honeypots, because most of the internet access is now automated (Imperva Bot Report, 2025)

Browser Fingerprinting 101

Each section in the creepjs check page is a tool with which we can see bots. Which we do want to see, unless you like flying blind, wondering why half your users bounce with zero time interaction - even though they are from the United States rather than China.

The most obvious, and strongest signals, are those in this section (from a Linux Chrome browser):

Compare this to an emulated iOS based visit (browserstack):

And a Brave browser visit:

we already have some tools just from one section. It's really important when doing fingerprinting to know:

1. Where you are running - is it an ip that is compromised in some way, or low trust?
   1. Is it a datacenter ip?
   2. Is there some sort of indication of proxy usage, like tor or residential proxies?
   3. Most importantly, is it some trusted ip, like google's crawler ips? (One such range is here: https://developers.google.com/static/search/apis/ipranges/googlebot.json)
2. What claims does the browser environment have?
   1. Connection claims, like tls - is it really a browser? What type?
   2. Header claims, which can include ordering of headers and inconsistencies in content
   3. And most importantly for us, javascript / wasm claims. These are the most commonly spoofed, with tools like puppeteer stealth doing a lot of heavy lifting for you.

The rest is commentary.

The first rule about canvas fingerprinting is you don't talk about canvas fingerprinting.

Visualizing canvas fingerprinting

A look at some common JavaScript fingerprinting libraries, focusing on the specific images that they use in their canvas fingerprinting routines.

a blog by aleksejs

This is a post from Aleksejs Popovs - not my original work, though I am familiar with all the fingerprints except the very convoluted shape one.

Some notes!

F5 shape is spot on (I know from my decompilation with help from colleagues) which is very cool. (though I have some ideas on how to improve that pixel check)

My experience before I set out on the defense side was that pretty much everyone copies everything from each other. And it's not for a lack of good ideas! There are some some cool proposals out there. There are a few gems not mentioned here, but as it is obfuscated I'm not going to reveal them

Our approach is slightly different - we are making replay attacks far more difficult.

This is the bot blog, a brand new site by button ^ solutions that's just getting started. Things will be up and running here shortly, but you can subscribe in the meantime if you'd like to stay up to date and receive emails when new content is published!