I'm finishing an API project that will allow website owners to display related videos on all of their pages with a simple javascript code. The related videos are completely related to the page's content. And the videos display on the same page as they were clicked on so that the visitor doesn't leave the page. This will hopefully increase the website owner's metrics of time on site, session duration and reduce their bounce rate while adding rich content to their page.

[![enter image description here](https://i.stack.imgur.com/jHxvs.jpg)](https://i.stack.imgur.com/jHxvs.jpg)

The purpose of this API project was to generate backlinks to my site to increase my web presence. But now I'm reading that widget links can get hit with manual actions from Google along with penalties. And I really just don't understand any of this.

If a widget is so good that a website is willing to embed it or run the javascript with the followed backlink inside of the widget, wouldn't Google see this as a signal that the followed link must have really good content on their website? Why would they hit content developers with penalties like this?

I can offer the javascript widget with a rel="nofollow" backlink inside of the widget, but because of server costs and constraints the only way it will be worth it is if I can get a followed backlink somewhere on the user's website. Which is fine, I can request that they editorially place a followed link somewhere on their site. But the problem is that because of the https protocol that many sites use, I don't see of a way to track which websites are embedding my javascript code and using my data. As a result, if an https website is using my javascript widget a lot without linking to my site I'm unable to restrict access to their domain. I simply won't know which domains are doing that.

I could check my apache logs to determine which IP addresses are calling my javascript code, but I imagine that this would be very difficult to figure out which IP address relates to which web domain. And since https doesn't pass http\_referer in PHP I'm unable to track which websites are using my data. 

Is there a solution to this issue and a way for me to be able to offer this really useful widget with highly related video content to websites while being able to ensure that I receive some sort of followed link in exchange for the dramatic server usage that my widget will require on my servers?

The code utilizes `.load('http://example.com/page')` where example.com is my domain. It would be really preferable if I don't have to offer API secret keys because I'm targeting wordpress users and the learning curve for signing up and implementing API access keys could deter widget adoption.

Can I determine which https websites are using my script with some sort of code? Or is there any other advice about how I can implement backlinks without risking penalty?

Here is an article about widget backlinks from Rand at Moz. It has great info, but I don't think it answers definitively if branded logo backlinks in widgets are still safe. 
<https://moz.com/blog/backlinks-maximize-benefits-avoid-problems-whiteboard-friday>

Thanks