Fighting fake download buttons: how we keep a free games portal trustworthy

Free games portals have a trust problem, and it has nothing to do with the games. It is the chrome around them: the fake download buttons, the banners that look like play controls, the pop-unders that fire the moment you click anything. When we built our portal, now home to more than 56,000 free HTML5 games that run entirely in the browser with no downloads and no sign-ups, we decided that keeping the site trustworthy was an engineering problem, not just a moderation one. Here is how we approach it, in four layers.

1. Treat every game embed as untrusted input

Each game loads inside an iframe supplied by a developer or a distribution partner, and we never assume the embed is benign. Every new embed passes through an automated verification step before it can appear on a live page. A headless browser loads the game, confirms it renders real canvas content within a timeout, and verifies that the frame does not navigate the top-level page, open pop-ups, or request permissions it should not need.

On the page itself, iframes are served with a strict sandbox attribute. We grant allow-scripts and allow-same-origin only where the game genuinely needs them, and we never grant allow-top-navigation or allow-popups. A content security policy on the game pages further restricts which origins may be framed and which scripts may run. The practical effect: even if a bad embed slips through review, the browser itself contains the damage.

<iframe
  src="https://games-cdn.example/embed/12345"
  sandbox="allow-scripts allow-same-origin"
  allow="fullscreen"
  title="Play this game">
</iframe>

2. Reject misleading ad creative at the source

Advertising pays the bills, but misleading creative costs us players. We keep a written creative policy with every ad network we work with: no creatives that mimic operating-system dialogs, no fake download or install buttons, no "your player is out of date" scare copy, and no creative that visually imitates our own play button.

Creatives are reviewed on submission and re-reviewed on a schedule, because bad actors routinely swap creative after approval. We also watch for anomalies in the data. An ad slot whose click-through rate suddenly spikes is usually a sign that the creative is tricking users, and we pull that slot pending review instead of waiting for complaints. It is cheaper to lose a day of revenue from one slot than to lose a player's trust permanently.

3. Label everything, clearly and consistently

Most deception on game portals works because players cannot tell what is the game and what is an ad. We fix that with deliberately boring, consistent labeling. Every ad slot carries a plain-text "Advertisement" label. The real play control uses one consistent style across all 56,000 pages, so regular players learn exactly what the genuine button looks like.

Each game page also states the deal up front: the game runs in your browser, no download is required, and you will never be asked to install anything to play. When the honest path is the obvious one, the deceptive paths lose most of their power. This is a UX decision as much as a policy one, and it is probably the highest-leverage change we have made.

4. Make reporting easy, then act on reports fast

Automation misses things, so every game page has a one-click report button covering three cases: broken game, misleading ad, and suspicious redirect. Reports land in a triage queue with the page URL, the ad creative ID when the complaint concerns advertising, and a screenshot captured at report time.

Misleading-ad reports jump to the front of the queue, and confirmed violations feed a blocklist we share back with our ad partners so the same creative cannot reappear under a different campaign ID. We also hold ourselves to a response expectation: a player who reports a problem should see it fixed, or get an explanation, within a couple of days. A report system that nobody answers is worse than no report system, because it teaches users that nobody is listening.

Why this matters at scale

Trust compounds. A player who has been burned by a fake download button does not just leave one page, they stop trusting the whole category of free game sites. The combination of embed verification, strict creative standards, honest labeling, and fast report response is what lets a portal like GameZiko stay usable at 56,000 games: players can trust that the play button is the play button, every time.

None of this requires exotic technology. Sandboxed iframes, a content security policy, a creative blocklist, and a triage queue are all things a small team can build and maintain. What it requires is treating trust as a feature with an owner, a budget, and measurable outcomes, instead of a hope.