Header bidding infrastructure

We run the wrapper.
You run the business.

A complete header bidding platform, operated under your name. Your tenant goes live in one to two days — build pipeline, your own CDN, your own analytics store, your own management UI — and from there you add as many sites as you want. Over a billion pageviews last month, and a new release reaches production every week.

your-publisher.com AD AD

Your implementation on the page

<script src="//your-cdn-domain.com/site.js"></script>

Nothing on that page says HB Wrapper. Your domain, your global, your cookie names.

0pageviews yesterday
0invalid requests blocked
0delivery problems caught

All publishers combined, updated daily

The problem

A wrapper is not a project. It's a payroll line that never ends.

Building one takes a quarter. Keeping one takes an engineer who tracks every Prebid release, an ad ops person who knows why a slot went blank, somewhere to store enough data to answer “which sites lost fill last Tuesday”, and someone reachable when a bidder ships a bad adapter. That team does not get smaller as you add sites.

HB Wrapper is that platform and that person, running under your name. You keep the publishers, the demand relationships and the brand. Staying current is our job, every week.

151 production releases since January 2024, and three Prebid majors adopted in three years.
Current upstreamPrebid 11
Pageviews / month1.15B
New tenant live in1–2 days
The division of labour

You decide what happens. We make it happen.

You decide what each site should do and write it down as configuration. Everything after that — compiling it, shipping it, loading it, running the auction, rendering the ad and counting what happened — is ours, and none of it lands on your team.

ON COMMIT ONE BUNDLE ONE SCRIPT TAG WINNING BID ON EVENTS Your repository Per-site build CDN Auction Render Track you own only the modules used your brand multi path ad server or fallback stored, and yours YOU HB WRAPPER RUNS THIS
The alternatives

Three ways to get a wrapper. Here is where each one wins.

You are choosing between building this yourself, licensing it, and paying someone a share of what clears. We do not win every row, so here is the whole table — including the one where building beats us.

Build itHB WrapperRevenue-share vendor
What you spendEngineering time, continuouslyA fee per pageviewA share of what clears
Time to your first siteQuartersDaysWeeks
Who tracks Prebid releasesYou, foreverUs, every weekThem, on their schedule
Who owns the configurationYouYouUsually them
Who your publishers seeYouYouOften them
Where it winsAbsolute control of the roadmap — and past a certain volume, paying per pageview stops making senseYou get the platform and keep the publisher relationshipNothing to run, and no engineering at all
Staying current

We merge upstream Prebid every week, not every other year.

The Prebid in your build comes from the official repository and is merged weekly. Our own work sits in separate modules around it, plus a small marked set of changes inside Prebid core. That is why a major version lands in weeks instead of quarters — and why you are on 11 rather than reading about it.

52 = ONE PER WEEK 2024 2025 2026 52 · Prebid 9 50 · Prebid 10 49 to date · Prebid 11 2040 PRODUCTION RELEASES PER YEAR
  • Merged, not divergedThe Prebid in a build is the official repository’s, merged weekly, with our modules around it and a marked set of core changes. An upstream release is an upgrade, not a rescue project.
  • Never all at onceA new version reaches a 10% cohort first, per tenant, with pre-release and production running side by side.
  • Or not at allA tenant that wants to hold still declines the next release and stays where it is. Current is the default, not the requirement.
  • Public referencedocs.hbwrapper.com — changelog, configuration reference and glossary
Operating it

One person can run hundreds of sites.

A new tenant is live in one to two days — pipeline, CDN, analytics store, management UI. After that, adding a site takes minutes: a few new configuration files, written by your team or by a language model, and that site’s wrapper is built and live. A tenant is a separate wrapper and not a config flag, so a mistake stops at one site instead of a platform. “Isolated” is easy to claim and hard to check, so here is the boundary, drawn where it actually falls.

Separate per tenant

  • A dedicated CDN with its own path and its own purge
  • Separate wrapper scope — global variable, testing parameters, cookie names
  • An individual configuration repository that you own
  • Separate analytics data storage
  • Its own release train — take each release when it suits you, or hold

Shared

  • The Prebid upstream sync — the Prebid code itself is the same for everyone
  • The build pipeline that compiles each tenant
Undoing a changeYour configuration is a git repository. Revert the commit, the site rebuilds, the CDN purges, and the previous behaviour is back. The change that caused the problem stays in the history with the name of whoever made it.
Configuration at scaleEvery site has its own complete configuration file — there is no shared document that a bad edit can propagate through. A portfolio-wide change is a scripted edit across the files it applies to, landing as one reviewable commit. It is more deliberate than a single inherited value, and it is the reason one site's mistake stays on one site.

And it isn't a black box. Standard setups are JSON, and anyone on your team with a technical feel for the stack can change them — the schema is documented, and a language model reads it as easily as a person does. That is the whole reason one person can carry hundreds of sites.

What's included

The line items other wrappers sell you separately are in the box.

Traffic quality, monitoring, page-health analytics and the debugging tools usually arrive as three more contracts with three more vendors, each adding its own tag to the page. Here they are part of the wrapper, writing into the same store and read off the same screens.

Part of the wrapperWhere this usually comes from
Invalid traffic scored 0 to 100 before the auction, with the threshold yours to setAn invalid-traffic vendor, priced per impression, with its own tag on the page
Uptime and delivery monitors, incidents and alerting to your own channelsA monitoring product — or nothing, and you hear about it from a publisher
Analytics that show what rendered, what didn’t, and why, per site and per dayA yield-analytics platform, priced per impression
Core Web Vitals per site, through the same beacon as everything elseA separate speed-monitoring tool, or a Lighthouse run somebody does by hand
An auction console openable on any live URL, by anyone you give the parameter toA browser extension, plus a HAR file and a support ticket
Your own analytics store, one per tenant, roughly three years of historyYour own warehouse, and somebody to build the pipeline into it

Every line on the right is a contract, a tag on the page, and a second place to look when something is wrong. That is the real cost of buying them separately, and it isn’t the invoice.

Custom scripts

If you can write it in JavaScript, you can ship it.

The deeper work — custom formats, unusual refresh rules, an edge case nobody has hit yet — is JavaScript, and it is yours to write. Custom scripts run inside the wrapper's own lifecycle, with no sandbox around what you are allowed to want.

Reach into the auction

Change which bidders are in play, which sizes are requested, what a placement looks like — conditionally, at runtime, per site.

Run code that isn't about ads

Insert elements into the page, fire a third-party tag, fix something in the DOM. The script does not have to be about advertising at all.

Build the module that doesn't exist

Write your own Prebid analytics or RTD modules — including ones not yet in the upstream repository — and run them in your build.

The auction

Client and every server endpoint bid at the same moment.

A parallel hybrid auction: client-side Prebid bidders, multiple Prebid Servers and additional ORTB endpoints all open together rather than queueing behind one another, settled against a bid cache that survives the page and follows the session. More lanes open for the same slot is more demand competing for it — and no lane pays for another lane's latency.

t = 0 · EVERY LANE OPENS TOGETHER TIMEOUT Client · bidders 1–4 Client · bidders 5–8 Client · bidders 9–12 Prebid Servers ORTB endpoints Session bid cache Winner → GAM a cached bid is already on the table before the first response arrives one GAM call, with the winner AUCTION TIMELINE · LANE LENGTHS ILLUSTRATIVE, START TIME IS NOT
Where we stand

We run the auction. We take no share of what clears through it, and there is no HB Wrapper demand in it competing with your partners.

You bring the demand. Because we take nothing out of the auction, there is no optimization that pays us and costs you — every change we ship is an engineering decision, not a commercial one.

The commercial model is usage-based and priced per pageview — not a percentage of your revenue, and not a per-seat licence.

When demand fails

An empty slot is money left on the table. This wrapper clears it.

Every wrapper has a happy path. What separates one that has been in production for years is what it does on the other three.

GAM responds for a slot creative returned empty creative + a cached bid no response in time + a cached bid no creative, no bid Render it. Nothing else happens. Render the cached bid instead. Direct render, GAM bypassed. Size-matched house HTML.
Traffic Integrity Score

Invalid traffic, scored before it costs you a partner.

Traffic Integrity Score (TIS) is our proprietary scoring algorithm, built into the wrapper. Every request is scored from 0 to 100 for how likely it is not to be a real reader. Low is clean and monetizable. High is almost certainly invalid, and gets excluded before it reaches an auction — which is what protects your supply’s reputation with the demand partners you and your publishers depend on.

YOUR BLOCK THRESHOLD · CONFIGURABLE MONETIZE INSPECT EXCLUDE 0 30 70 100 0 — indistinguishable from a real reader. 100 — almost certainly not a human.
Industry-standard methodDetection follows Media Rating Council patterns for general and sophisticated invalid traffic rather than a private definition of “bad”.
Maintained listsKnown datacentre ranges, crawlers, spoofed agents and fraud signatures, kept current rather than shipped once.
Bait trapsElements no human interacts with. Something that engages with them is telling you what it is.
Excluded, and countedTraffic above your threshold is kept out of the auction, and the score distribution is in your analytics — so you can see what was excluded and argue about the threshold with data.
Reference

The rest of the surface, without the adjectives.

Everything below is a capability, not an argument. It is here so an evaluation can check it off, and each one has a configuration reference behind it.

Auction controls

The settings that decide what the auction is actually worth.

Standard Prebid gives you a floor and a timeout. Most of the money is in what happens either side of them.

Advanced floors

Price floors with geo, userId and ORTB2 schema extensions — not only standard Prebid floor rules.

Bid adjustments

Pubshare, server-side adjustments and per-network multipliers, for the cases a flat discount gets wrong.

Conditional timeouts

Auction timing varies by device or geo, so slow paths do not hold up fast ones.

Geo filtering

Bidders and UserID modules switched on and off per region, without a separate build.

First-party data

FPD support with automatic enrichment passed into the auction.

50+ key-values

Automatic GAM targeting: bidder, CPM, size, format, device, connection speed, viewability, refresh state and more.

Flexible sizes

Sizes configured for GAM only, header bidding only, or both on the same placement.

SafeFrame control

Global, per-ad-unit, or forced when CPM is under a floor. Impression-level from CPM, advertiser domain, IAB category or ad unit — revenue stays open where SafeFrames are not needed, sensitive inventory gets surgical protection.

Public on-page API

A documented interface so your own code can change wrapper behaviour at runtime, from the page.

Refresh

Refresh that reads the page, not just a stopwatch.

A timer alone burns impressions on slots nobody is looking at. Refresh here is driven by what the reader is actually doing, every trigger is a per-slot setting, and everything stays configurable at your fingertips.

Viewability-drivenA slot refreshes only once it has been genuinely seen, for as long as you require, measured by the wrapper's own viewability or by GAM's.
Scroll and activityReader movement through the page and general engagement as the trigger, so refresh follows attention.
Page focusNothing refreshes in a background tab. Refresh pauses when focus leaves and resumes when it returns.
Maximum refresh countA hard ceiling per slot, per page or per session, so a long read cannot turn into a slideshow.
Stop triggersNamed conditions that end refreshing for a slot entirely — your own events included.
Rate by valueRefresh interval varies with what the slot is earning: a high-CPM placement can be treated differently from a low one.
Continue on emptyAn unfilled refresh does not end the cycle; the slot stays in play for the next one.
Operations

Configuration you can touch, in a repository you own.

Your settings are plain files in a git repository that belongs to you. Your team edits them. A language model can edit them. You grant access to whoever should have it and take it away when they leave. And because it is git, the history is permanent: three years from now you can still see exactly who changed that floor, when, and what it was before.

No ticket queue between you and a change you understand.

  • One commit, any number of sitesA change to one site or to all of them lands as a single reviewable commit, with the diff showing exactly which sites it touched.
  • Work the way your team worksYour team can change the wrapper from the management UI, call the same actions over the API, edit config with a language model, or embed the UI where you already work.
  • Monitors that watch for youBuild, delivery and anomaly monitors, so a broken bidder surfaces before a report does.
Troubleshooting

The tools are in the page, where the problem is.

When a slot misbehaves, the answer is in the auction that just happened — not in a support queue and not in a HAR file you email to someone.

In-page consoleOpen the auction on the live page: the timeline, the slots, what each bidder answered, what GAM did with it and which path fired.
Bid-level tracingFollow a single bid through the auction to find the one causing the problem — a malformed response, a slow endpoint, a creative that breaks a layout.
Warnings, not silenceConfiguration and runtime problems are surfaced as warnings on the page rather than swallowed, so a misconfiguration is visible the day it ships.
Capability index

Configured where, by whom.

CapabilityWhat it coversConfigured in
Lazy loadSlots defined and requested as they approach the viewport, with per-slot distance thresholdssite config
AnalyticsPageviews, fill and fallback rates by branch, TIS distribution, abnormality flagsdashboard + API
A/B rolloutEvery release runs at 10% before full deploy; the cohort is stable per userrelease train
Rich mediaPluggable creative formats, per-unit CSS, own viewability tracking where you would rather not use GAM'smodule + CSS
Start where the detail is

The documentation is the sales material.

Every claim on this page has a configuration reference behind it. The docs are public and complete — read them before you talk to anyone, including us.

When you want to see it running on your own inventory, write to contact@hbwrapper.com.