For bookmakers · Theme 01 of 04

Do you know what’s running on your own landing pages?

Many affiliate fraud techniques work through your own website: the scripts you load, the tags other people can publish and the defences nobody switched on. Here are six questions to put to your web and marketing teams this week.

Q-01Question

Do you know what scripts are running on your landing pages?

Every third-party script on a landing page or registration flow can read the page, rewrite links and fire tracking pixels. Over time, sportsbook and casino landing pages collect tag after tag from agencies, affiliate platforms, CRM tools and retargeting vendors.

It only takes one misconfigured or malicious script to drop an affiliate cookie on a visitor who never clicked an affiliate link. When that visitor deposits, someone gets paid for a player who was already yours.

Red flagNobody can produce a current list of every script on your top landing pages, with a named owner for each.

What we checkA full script inventory per page and market, what each script does on load, and whether any of them sets or touches affiliate tracking.
Q-02Question

Who is responsible for your Google tags, and who looks after them?

Google Tag Manager containers often have dozens of users with publish rights: current and former staff, agencies, and sometimes “tracking support” from partners. Anyone who can publish can add a tag that fires affiliate pixels on organic traffic or injects a redirect.

If there isn’t a named guardian who reviews every change, nobody will notice when a tag starts doing something it shouldn’t.

Red flagYou don’t know who has publish access, or changes go live without anyone reviewing them.

What we checkContainer users and permissions, version history, tags that fire affiliate or partner pixels, and triggers that don’t match their stated purpose.
Q-03Question

Do you have a Content Security Policy?

A Content Security Policy (CSP) is a response header that tells the browser which scripts may run on your site and which sites may embed it. Without one, any script that gets onto your page runs with full access, and any site in the world can frame your pages.

It is one of the cheapest defences available, and one of the most often missing on operator sites.

Red flagNo CSP header at all, or one so permissive that it allows scripts from anywhere.

What we checkYour headers on every brand domain, market and white-label skin, plus a CSP and frame policy your developers can roll out safely.
Q-04Question

Can your website be loaded in an iframe?

If your site can be embedded, a fraudulent page can load it invisibly in a tiny or hidden frame. That is enough to set an affiliate cookie for a visitor who never saw your brand, or to lay your page beneath a decoy button (clickjacking).

When that visitor later registers and makes a first deposit, the affiliate is credited, and may keep earning revenue share on them for life.

Red flagYour homepage, landing pages or registration pages load inside an iframe on another domain.

What we checkFrame protection on every domain and subdomain, including old campaign and promotion domains that everyone has forgotten about.
Q-05Question

Do you know how to spot cookie stuffing?

Cookie stuffing means setting an affiliate tracking cookie on a device without a genuine click: hidden iframes, 1×1 images, pop-unders and forced redirects. The affiliate then simply waits for players who would have found you anyway.

Your back office won’t show anything unusual. It just shows an FTD with an affiliate tag on it.

Red flagAffiliates with high conversion volumes but little visible content or traffic, or conversions arriving long after a “click” nobody can find.

What we checkThe cookie writes themselves: when they happened, which page triggered them, and whether a real user click was behind them.
Q-06Question

Do you understand what click-hijacking is?

Click-hijacking intercepts a player who is already on their way to you and swaps in the hijacker’s tracking link, so last-click attribution goes to them. Common methods include browser extensions, ads on your brand name, lookalike domains, malware and rewriting other affiliates’ links.

The fraudster doesn’t bring you new players. They take credit for your organic traffic, your brand traffic and your honest affiliates’ traffic.

Red flagBrand search and direct traffic flatten while one affiliate’s FTDs climb, or honest affiliates tell you their clicks aren’t tracking.

What we checkBrand-term ads in every market, extension behaviour, redirect chains and last-click overwrites, captured as they happen.

Exhibit

One header that closes two doors.

HTTP response header · example only

# Only your own site may frame your pages
Content-Security-Policy: frame-ancestors 'self';
  # Only approved sources may run scripts
  script-src 'self' https://www.googletagmanager.com;
# Older browsers
X-Frame-Options: SAMEORIGIN

A quick test you can run today

Ask a developer to put your registration page in an iframe on a test domain. If it loads, a fraudster can load it too, invisibly.

The policy above is a sketch, not something to paste into production. A real CSP has to be tested against every tag, payment provider and game supplier you rely on. We build that with your developers and check it on every domain you run.

Tag analysis service →

THEME 01Q-01 to Q-06