Botters seem to be accessing the faucet script without viewing the WP pages which is where we ensure that they have gone through the shortlink. This means we payout without any page views (i.e. ad views) and without any revenue from the shortlink.
WP nonce feature enables us to attach a generated nonce to the end of a url which is then checked - if there is no nonce or a wrong nonce, wp will not allow access.
Unfortunately this is only a WP feature. Could we adapt it to also apply to whatever it is that the faucet script generates? Or can we somehow deny access to the faucet script from outside WP?
Either of these would enable us to force even the bots to go through the path we want them to go through.