Referral exclusions: your own domains and the payment gateway

Two problems that look alike#

Every visit has a referrer: the page the browser says the user came from. AdPix uses it to work out the acquisition channel. There are two cases where that referrer is not acquisition at all, and if you leave them alone they steal the credit for a sale from the campaign.

Both get the same treatment: instead of counting as fresh acquisition, that touch is demoted to Direct — (direct) / (none) — and the real earlier touch stays in place. But they are configured in two different places and each covers different ground.

Referrals from your own domains#

When one business spans several domains or subdomains — the shop, the blog, the customer panel, a checkout page — every hop between them is a referral as far as the browser is concerned. Without an exclusion, your own site becomes the biggest "referrer" in Traffic acquisition and every visitor is re-acquired halfway through their own journey.

AdPix already treats these hosts as internal:

• the domain of each web stream on the property (the one you entered when you created the stream);
• the property's primary domain, which is itself derived from the first web stream's domain;
• every condition you added to that stream's cross-domain linking configuration.

A referrer matching any of those is not acquisition. On top of that, whenever the referrer's root domain equals the current page's root domain it counts as internal with no configuration at all — so navigation between subdomains of one domain is correct from day one.

Adding your other domains#

There are five match types. For your own domains Exactly matches is almost always the right one:

The return from a payment gateway#

This is the one that hits revenue directly. The customer clicks a Google ad, picks a product, is sent to the bank's gateway, pays, and the bank returns them to your "payment successful" page. The browser reports that return as a fresh referral from sep.shaparak.ir — and the last touch of the very visit that converts was being overwritten with it.

For anyone setting budget the consequence is severe: the ad channel looks unprofitable, an imaginary "referral" channel looks like the star performer, and the budget decision follows the wrong number.

AdPix carries a built-in list of payment processors. It is keyed by function, not geography — Iran's Shaparak switch sits alongside Stripe and PayPal and nothing in it is specific to one market:

Matching is on the root domain and covers sub-hosts, so the single entry shaparak.ir covers every bank switch behind it — sep, pep, sadad, asan and the rest.

Where the real campaign comes back from#

Demoting the gateway is not enough on its own: throw the referral away and the conversion is left with no campaign at all and falls into Direct, which is just another way of losing the credit.

So AdPix keeps each anonymous visitor's last touch server-side, and restores it whenever the current touch carries no real acquisition signal. The rule is short:

• First touch: first write wins, and is never replaced.
• Last touch: last write wins, but only for a touch that genuinely signals acquisition — a campaign or an ad click ID. Direct traffic, an own-domain referral and a gateway return all fail that test, so none of them can erase the stored campaign.

In practice: a purchase that began with a Google ad click and came back through Shaparak sits under that Google campaign in Attribution, and no longer opens a new "Referral" session for the bank in Traffic acquisition.

Adding your own hosts to the exclusion list#

If you use a gateway or payment intermediary that is not in the built-in list — or a partner who returns the user to you after an identity check or a signed contract — you can add its host to the property's own list. It is unioned on top of the built-in one.

There is no console screen for this yet; it is API-only, and like the rest of Fraud Protection it is gated on the plan.

Reading the list is open to any viewer of the property; adding and removing require edit access and both are written to the audit log. The host is stored lowercased and trimmed, and like the built-in list it matches sub-hosts too.

The same list keeps your fraud report clean#

A payment-gateway return is the opposite of fraud: it is a session that paid you money. Its statistical shape is odd all the same — a source that appears out of nowhere, single-page, with a uniform pattern — and an unguided detection engine reads that as an anomaly.

That is why Fraud Protection reads the same list as an allowlist: a source whose host matches a built-in gateway or one of the property's own exclusions always stays Clean and is never flagged. Alongside it, the business's own identifiers — the property's primary domain, the property name and the organization name — get the same protection automatically, so your own brand and internal traffic is not reported as fraud.

How to confirm it works#

If nearly all of your traffic has fallen into Direct — not just conversions — the cause is somewhere else, and Attribution is a better place to start looking.

Frequently asked questions#

Related#