Technical documentation

How tracking URLs on track.zapworld.co work, what the tracker reads, and what it guarantees.

URL format

https://track.zapworld.co/<any path>?<tracking parameters>&redirect_url=<destination URL>

Recommended path: /c. The tracker responds to any path in the same way.

Transparency parameter: redirect_url

• Any request to the tracker domain that contains redirect_url is handled as a click and redirected to that value. This holds for every path (/, /c, /click, /any/other/path) and every HTTP method.
• The tracker redirects directly to that value with an HTTP 302. There are no intermediate hops and no other tracking domains in between.
• The destination can never be replaced by a value configured on the server. The service has no destination overrides, rotators or offer switching.
• No secondary parameter is needed to activate the transparency parameter. If one is ever introduced, it will appear before redirect_url in the URL.
• redirect_url should be the last parameter in the URL.

Encoding rules

• Encoded value (what Google Ads' {lpurl} sends): the value runs to the next & and is percent-decoded exactly once. A + is kept as a literal +.
• Unencoded value (starts with a literal http:// or https://): it must be the last parameter, and everything after redirect_url= is the destination, used as-is.
• Query strings, fragments and encoded values nested inside the destination are preserved byte-for-byte. A double-encoded destination is decoded once only; if the result is not a valid http(s) URL, the request is refused.
• Non-ASCII characters in the destination are percent-encoded (UTF-8) in the Location header, which cannot carry them raw. Browsers apply the same encoding. Hostnames must be sent in ASCII (punycode).

Examples

Validation

The tracker only redirects to destinations it expects. A refused request gets a plain error page and no redirect; it is never sent to another destination instead.

The allowlist currently contains only websites operated by Zapworld LLC.

Responses

• 302 Found with Location set to the destination, plus Cache-Control: no-store, no-cache, must-revalidate, private and Referrer-Policy: no-referrer-when-downgrade.
• GET and HEAD behave identically (HEAD has no body).
• The response is the same for every client. Real browsers, Googlebot, AdsBot-Google and any other user agent get the same status and destination. Suspected automated traffic is only flagged in our logs.
• No cookies are set. Each click is written to a click log; a logging failure never blocks or changes a redirect.
• HTTPS only. Plain-HTTP requests are permanently redirected to HTTPS on the same host by the hosting platform.

Nested click trackers

If a destination is itself another click tracker's URL, that tracker must be certified by Google, and its URL must be URL-encoded inside redirect_url. The tracker never alters a nested tracker's URL or its redirect target.

Parameters

The tracker reads the parameters below and records them in its click log for reporting only. It never adds parameters to the destination and never removes, reorders or changes any part of it. Parameters not listed here are recorded for reporting and never forwarded. We will notify Google before renaming any parameter or adding a new one.

Google Ads setup

Account-level tracking template:

https://track.zapworld.co/c?cid={campaignid}&agid={adgroupid}&crid={creative}&kw={keyword}&mt={matchtype}&net={network}&dev={device}&loc={loc_physical_ms}&gclid={gclid}&wbraid={wbraid}&gbraid={gbraid}&redirect_url={lpurl}

{lpurl} is placed last, so Google Ads sends it encoded.

Live example

https://track.zapworld.co/c?cid=123&gclid=TEST&redirect_url=https%3A%2F%2Fzapworld.co%2F

Check it without following the redirect:

curl -sI 'https://track.zapworld.co/c?cid=123&gclid=TEST&redirect_url=https%3A%2F%2Fzapworld.co%2F'

Contact

Zapworld LLC · business@zapworld.co