How stand-down signals work: afsrc, cookies, and soft-click

Detection is the whole game

Stand-down only works if software publishers can reliably see that another partner already referred the shopper. Networks and platforms publish those signals so extensions can honor them without guessing.

This article covers the signals you will see most often, how they relate to soft-click rules, and what good implementation looks like.

URL parameter signals (example: afsrc=1)

On impact.com (and brands that enable the network stand-down policy), partner-driven traffic can land with a query parameter such as:

https://merchant.example/?afsrc=1

When afsrc is present and equal to 1, a software-based publisher must stand down for that session. The parameter is the public indicator that a prior publisher referral already happened on that network’s stack.

Implementation checklist:

• Read the current page URL query string on every relevant merchant page
• Treat afsrc=1 as authoritative — do not require extra confirmation before suppressing UI
• Keep standing down for the required window even if the user navigates within the merchant site
• Do not strip, ignore, or rewrite the parameter to avoid detection

Other networks and SaaS affiliate platforms may use different parameter names. Always follow the program you are enrolled in.

Cookie and platform ID signals

Some platforms signal prior attribution with a first-party or partner cookie rather than (or in addition to) a URL flag. For example, certain link platforms require stand-down when their ID cookie is already present.

Practical rules:

• Check for the documented cookie before showing any cashback or coupon prompt
• Do not delete or overwrite competitor or network attribution cookies to “clear” stand-down
• Remember that cookie availability depends on browser privacy settings — combine cookie checks with URL checks where both exist

Soft-click policy (sibling rule)

Stand-down and soft-click policies travel together.

• Stand-down says: if another publisher already referred this shopper, stay quiet.
• Soft-click says: do not set or overwrite an affiliate cookie unless the user took a clear, intentional action — and a soft click must not steal an existing cookie.

Violations often look like:

• Auto-fired tracking pixels or redirects with no user click
• Checkout overlays that inject a new affiliate click when the user only wanted a coupon list
• “Helpful” background activation of cashback without an affirmative click

If your product can fire tracking without a deliberate user gesture, soft-click review should be part of every release.

Session length and timing

Policies commonly require stand-down for:

• The remainder of the browser session, or
• A minimum duration after the original referral (often 30 or 60 minutes),

whichever is longer. Design your client logic around timestamps and session lifecycle, not a single page-load check.

What “good” looks like in an extension

1. On merchant page load, run signal detection first.
2. If any stand-down signal matches, enter a silent mode for that merchant/session.
3. Log internally for QA (never surface a “we stood down” nag to the shopper).
4. Only after the window expires — and only with a clear user action — allow normal prompts again.

Bottom line

Stand-down is enforceable only when signals are respected. Learn each network’s parameter and cookie contract, pair it with soft-click discipline, and treat bypasses as compliance failures — because brands and networks already do.