- Recovery after the fact and screening at the door address the same problem at very different costs. Evidence, dispute and clawback take weeks; the checks at admission usually take minutes.
- Only a few fields on an application are actually verifiable: domain ownership and age, whether the declared traffic source matches an observable footprint, and whether the applicant will name specific placements. The rest is self-reported and carries limited weight.
- Probation should be set by volume, not by calendar. “The first two thousand clicks” is the same yardstick for a large and a small partner; “the first thirty days” is not.
- The most informative thing in the first thirty days is not conversion rate but three distributions: the click-to-conversion interval, device and geography concentration, and repetition of the same identifier across conversions. Anomalies show up in the shape long before they show up in the totals.
- No single signal is a conclusion. Shared addresses, concentrated device models and very short conversion intervals all have common benign explanations. A judgement requires several independent signals pointing the same way.
Why the cost is lowest at admission
The full after-the-fact sequence looks like this: notice an anomaly, pull enough history to characterise it, separate suspect conversions from normal ones, prepare material the counterparty can both understand and not easily refute, open a dispute, wait for the network or the partner to respond, negotiate a proportion, and eventually recover some of it. The process runs in weeks and typically ends in partial rather than full recovery. More to the point, the partner is usually still sending traffic throughout.
The checks at admission take minutes, and the two kinds of error are not symmetric. Wrongly rejecting a legitimate partner costs you the incremental revenue that partner might have produced. Wrongly admitting a problematic one costs commission plus the handling that follows, plus the contamination those conversions introduce into the attribution data your ad platforms learn from. The second error is more expensive, which makes a somewhat strict door reasonable in most programmes. The detection side of the problem is covered in full in how affiliate click fraud is detected.
What an application can and cannot tell you
A standard application asks for a site URL, monthly traffic, a breakdown of traffic sources, previous networks worked with, and promotional methods. Most of those fields are self-reported with no independent way to check them, and a bad-faith applicant fills them in without friction. Basing an assessment on those numbers tests the applicant's willingness to complete a form, not the quality of their traffic.
A different set of fields is verifiable. Domain registration date and history: a domain registered last week cannot also have a stable organic search audience, and those two claims cannot both be true. Whether the site genuinely exists with content proportionate to the claimed scale: a content site claiming hundreds of thousands of monthly visits should have a visible indexed footprint in public search. Whether the declared source matches an observable trace: a partner who says their traffic is mainly social should have social assets you can find. None of this needs special tooling and all of it takes a few minutes.
One further item is a requirement rather than a check: ask the applicant to name where the traffic will actually appear. Whether they will answer, and how specifically, is itself a signal. A partner who will not describe their placements cannot be held to a placement rule afterwards, and traffic arriving from an undeclared source is exactly what makes later disputes hardest to settle. Continuous monitoring of what partner pages contain is covered in affiliate partner page compliance monitoring.
Four signals worth checking before approval
First, whether domain age and content scale support each other. This is not to say a new domain is disqualifying — new content projects launch every day — but the claimed traffic scale has to be compatible with the domain's history. A contradiction is worth asking about directly rather than rejecting on.
Second, whether the declared source matches a findable footprint. The valuable outcome here is not finding confirmation but finding nothing at all. A partner claiming traffic at scale who leaves no visible trace anywhere public is a combination that needs an explanation.
Third, overlap with existing partners. The same applicant re-applying under different entity names, or several “separate” partners resolving to one set of infrastructure — shared registration details, shared hosting, a shared redirect intermediary — is more common in affiliate programmes than people expect, and it usually means someone is spreading exposure so that one account being paused does not stop the flow. How to take those chains apart is set out in affiliate redirect chain analysis.
Fourth, whether the described promotional methods include anything your programme terms already exclude. Bidding on brand terms, coupon aggregation, formats that rely on pop or forced interaction, and unauthorised use of brand assets are not necessarily invalid traffic, but they are a separate class of problem and usually one the terms already address. Stating it once at admission is cheaper than explaining it later.
Making probation an actual screen
Most programmes have a probation period in name, and in practice it is a stretch of time in which nothing is examined. Three things have to hold for it to function.
First, measure by volume rather than by calendar. A partner sending a few hundred clicks a day produces readable distributions within a fortnight; one sending twenty a day will not have produced them in two months. “The first two thousand clicks or the first fifty conversions, whichever comes first” applies the same yardstick to partners of very different sizes. A day count does not.
Second, cap the exposure. A stated daily ceiling during probation bounds the worst case at a number you have chosen in advance. This is not a statement of distrust; it is the default treatment any counterparty without a track record should receive.
Third, align the payment window with the validation window, and state that plainly before the partner joins. Terms introduced afterwards generate disputes even when the underlying finding is sound; terms stated up front rarely get challenged. This is a matter of process design, distinct from clawing money back, which is dispute handling.
Which distributions to read in the first thirty days
Conversion rate on its own carries little information: it can be high because the traffic is good and high because the conversions are manufactured. The shape of the distributions is what carries information.
The interval between click and conversion. For real users this is dispersed: some buy immediately, some return hours later, some the next day. If one partner's intervals cluster tightly in a narrow band, especially a band of seconds to tens of seconds, the process producing those conversions is programmatic rather than a population of people each deciding separately.
Concentration by device and geography. Any real audience shows natural dispersion across device models, OS versions, screen sizes and regions. Heavy concentration — nine in ten conversions from one handset model on one OS build — is not impossible, but it needs an explanation, and the partner should be the one providing it. Where the boundary sits between data-centre traffic and ordinary users is less intuitive than it sounds, and it is covered in identifying bot traffic.
Repetition of the same identifier across conversions. Read this one carefully. Corporate networks, carrier NAT and campus networks all put many genuine users behind a single address, and in some regions most mobile traffic egresses this way. A repeated address is a reason to look at that partner's other distributions, not a finding in itself. Treating repetition as standalone evidence is the main source of false positives; the terms involved are defined precisely in click fraud terms explained, and the formal industry grading of invalid traffic is set out in GIVT versus SIVT.
Where entry vetting stops working
The ceiling on all of this should be stated plainly. Entry vetting filters applicants whose problems are visible before they send anything, which is a substantial share and never the whole set. An experienced counterparty arrives with a package built to clear every entry check: a site that genuinely exists, a plausible domain age, placements they are willing to name, and well-behaved numbers throughout probation. The traffic quality changes after probation ends.
A second case has nothing to do with intent: an honest partner adds a new sub-source, resells a placement, or has an upstream supplier change hands, and the traffic mix shifts without the partner necessarily knowing. Having passed screening a year ago guarantees nothing about what arrived this week. The same distributions therefore have to be watched continuously rather than examined once at the door. Malicious clicks originating from competitors are a separate problem, covered in detecting competitor click fraud, and the affiliate-side protections as a whole are summarised in preventing click fraud in affiliate marketing.
FAQ
Is it worth rejecting applicants who will not disclose their placements?
In most programmes yes, because non-disclosure removes the only cheap check available at the application stage. A partner who cannot say where the traffic will appear cannot be held to a placement rule later, and disputes over traffic from an undeclared source are the hardest to settle. A steadier position is conditional approval with a low cap rather than outright rejection, since some legitimate partners are genuinely protective of their inventory.
How long should probation run?
Long enough to collect a usable sample, rather than a fixed number of days. A partner sending a few hundred clicks a day is readable within two weeks; one sending twenty a day may need two months. Setting it by volume — the first two thousand clicks or the first fifty conversions, whichever comes first — is what makes the screen consistent across partners of very different sizes.
Does a shared address across conversions prove there is a problem?
No, and treating it that way produces false positives at a high rate. Corporate networks, carrier NAT and campus networks all put many real users behind one address, and in some regions most mobile traffic leaves this way. A repeated address is a reason to examine that partner's other distributions, not a conclusion on its own. A judgement needs several independent signals pointing the same way.
Should commission be held during probation?
Holding payment until the standard validation window closes is normal practice and easier to defend than recovering money afterwards, provided the term is stated before the partner joins. The aim is not to delay payment as a matter of routine but to align the payment point with the point at which a conversion can be validated. Terms added afterwards generate disputes even when the finding behind them is correct.
Can entry vetting replace ongoing monitoring?
No. It filters the applicants whose problems are visible before they send anything, which is a meaningful share but never all of them. Traffic quality also shifts over time within a single partner, through a new sub-source, a resold placement or a change of intent. Passing screening a year ago says nothing about what is arriving this week.