AdGhost Lite – Ad Insertion for Google Ad Manager

AdGhost Lite puts your Google Ad Manager (GAM) ad units on your WordPress site and keeps them in good positions.

AdGhost Lite is complete on its own and free. An optional paid add-on, AdGhost Pro, is sold separately.

1. Enter your Google Ad Manager network code.
2. Add your ad units, or import them from a GAM CSV.
3. Click Save and deploy.

Placement

• In-content ads placed by rule: after or before the paragraphs you name (2, 4, 7, 9), every N paragraphs, before the last paragraph, or “Best spots”. They skip unsafe positions (inside tables, lists, quotes, columns, straight under a heading or image) and keep a minimum number of words between ads.
• Header, footer, before and after content, before and after comments, between posts in lists, sidebar (after widget N), and next to any HTML element by CSS selector.
• AdGhost Ad block for the block editor, plus shortcode, widget and PHP function for manual placement.
• Anchor bar, interstitial and rewarded ads using Google’s native formats.
• Sticky and float-to-corner behaviours; corner pop-up, slide-in, docked and beside-content formats on the Pro plan.
• AMP pages: every placement is served as an , and the anchor as AMP’s own sticky bar.
• Works with block themes, classic themes, page builders and content in any language.

Control

• Per unit: devices, page types, alignment, sizes, maximum insertions, auto refresh.
• Key-values for Google Ad Manager: send each page’s post ID, page type, categories, tags and author, your own site-wide pairs, and pairs per unit, to target line items and break down reports.
• Hide ads from logged-in writers or from every logged-in visitor, so your own views and clicks never reach Google.
• Pages without ads: privacy policy and contact pages are excluded by default, and any page can be switched off from the editor or the Pages list.
• Maximum ads per page, lazy loading, layout-shift prevention, ad label.
• ads.txt editor and validator.
• Preview mode that outlines every ad position for administrators.
• Optional invalid traffic detection that can withhold ads from automated sessions.

Fast and private

The ad script is built into your site’s own uploads folder when you deploy, or you can host it on your own server or CDN. The plugin sends no data to its author.

Source code

Everything this plugin runs in the browser is built from human-readable source that ships inside the plugin, in ad-setup/: the ad engine, its format modules and the invalid-traffic detector. The files served to readers, in cdn-free/, are generated from those sources in two steps, each checked to leave the program unchanged: comments and indentation are removed, then local variable names are shortened. Both tools are included in ad-setup/tools/ (strip.mjs and mangle.mjs). No code is obfuscated.

Third-party services

This plugin loads Google Publisher Tag (GPT), Google’s ad library, from https://securepubads.g.doubleclick.net/tag/js/gpt.js on the front end of your site, so that the ad units you configure can request and display ads from your own Google Ad Manager account. It is loaded only after you enter a network code and deploy, and never on pages without ads. When it loads, the visitor’s browser connects to Google, and Google receives what it needs to serve ads, such as the page address, the ad unit codes and browser details.

• Google terms of service: https://policies.google.com/terms
• Google privacy policy: https://policies.google.com/privacy
• How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites

You are responsible for any consent your visitors’ jurisdiction requires before ads load, for example with a consent management platform.

The plugin makes no other requests to external services.

Privacy

Invalid traffic detection is off until you switch it on (AdGhost → Settings → Invalid traffic). When it is on, a first-party cookie named adghost_sid identifies the browser session, and the visitor’s browser reports the names of the bot checks that fired to your own site through the WordPress REST API. Your site works out the result from them; nothing is sent anywhere else. The deeper device checks (graphics, fonts) follow the visitor’s choice: they are skipped under Global Privacy Control, and where a consent platform is on the page they run only with consent. A visit found to be a robot is remembered for the rest of that browser session (session storage, key agh_ivt). When “Block ads for obvious bots” is chosen and a session shows a clear robot sign, a second cookie, adghost_ivt, tells the site’s pages to show that browser no ads; it expires with the session. Verdict reports are limited per visitor address; the address is only kept as a hash that changes daily.