How are they protected from setting cookies in affiliate programs?

Question

Computer networks

Good day!
We have a store website, we want to create an affiliate program for it. The partner sends via a link with partner=id, the site sets a cookie to the visitor, for orders with a cookie, the affiliate commission is considered. Everything is as usual.
I know that unscrupulous partners can open the main affiliate site on their site in an invisible frame or in img src, and then the affiliate cookie will be placed on the visitors even without actually going to the store site.
How do you protect yourself from such things? How to make it so that the affiliate cookie is set only when the visitor actually goes to the store's website?

Answer 1

Start by issuing the X-Frame-Options header . To prevent the cookie from being set when calling the site via <img src="">, you can add a JavaScript check and set the cookie only after passing it.

Answer 2

It seems that browsers have a setting to accept cookies only from the visited site, and by default it is enabled.

Answer 3

Since this is a technically difficult task + time-consuming for large volumes of traffic, it is better to use independent monitoring to identify cookie replacement.
In order to understand in principle whether there is such a problem and whether the volumes of low-quality traffic are critical, you can order free monitoring from the guys involved in traffic verification, for example