Seatext library / BotRefund evidence
Open-Source Libraries for Detecting Playwright Bots: What Exists and How to Choose
Yes, open-source libraries such as playwright-detector and botd exist for detecting Playwright-driven automation. They work by checking for browser inconsistencies like the Playwright Init Scripts mismatch, but they typically rely on single signals rather...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Direct answer
Open-source libraries for detecting Playwright bots do exist. The most cited options are playwright-detector (an npm package that checks for Playwright-specific properties) and botd (FingerprintJS's open-source bot detection library). Both look for tell-tale signs such as the Playwright Init Scripts mismatch, missing navigator properties, or headless-browser artifacts. However, these libraries generally evaluate one or a few signals in isolation. BotRefund's research shows that a single anomaly is not a reliable bot verdict — privacy tools, corporate networks, and unusual devices can produce similar signals for genuine users. Production-grade detection combines 106+ independent checks across browser, network, device, and behavior layers, then weighs the complete pattern with an AI model to reach 99% accuracy.
Why Playwright bot detection matters
Playwright drives real browser engines — Chromium, Firefox, and WebKit — instead of simulating HTTP requests. This means it renders JavaScript, executes analytics, and triggers conversion pixels just like a human visitor. Basic server-side filters that only inspect IP addresses or user-agent strings miss this traffic entirely. When automated clicks inflate your Google or Meta ad spend, you pay for visits that never convert. BotRefund's data across 2,500+ brand audits shows that bot clicks can steal up to 20% of an ad budget, and 83% of clients who pursue refunds with proper evidence recover funds from Google and Meta.
How Playwright detection works
Detection libraries look for inconsistencies that automation tools leave behind. The most reliable signals come from the browser itself:
- Playwright Init Scripts mismatch: Automation tools patch or hide browser APIs, but those changes can break when the browser is checked from another angle. A normal browser runs standard APIs as designed; an automated browser often reveals a mismatch.
- Scrollbar width leak: Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people. The scrollbar width check looks for a mismatch that a real browsing session does not normally create.
- Clean context iframe: Automation tools often patch or hide browser APIs, but those changes can break when the browser is checked from another angle — for example, inside a clean iframe context.
- Behavioral biometrics: Unnaturally straight pointer paths, absence of mouse tremor, sub-1ms input speed, grid-aligned movement, and missing clicks or scrolling.
Each of these is an independent piece of evidence. BotRefund treats every signal as evidence — not a verdict — and cross-checks it against other browser, network, device, and behavior data before an AI model weighs the complete pattern.
Open-source libraries you will encounter
The GitHub ecosystem lists several projects under the playwright-detection topic. The two most referenced in developer discussions are:
- playwright-detector — a lightweight npm package that exposes a
detect()function checking for Playwright-specific global properties and init-script artifacts. - botd — FingerprintJS's open-source library that bundles multiple bot checks (including headless detection, automation framework fingerprints, and behavioral heuristics) into a single client-side script.
Other repositories appear in search results, but many focus on evading detection (e.g., invisible_playwright provides stealth patches for Playwright scrapers) rather than detecting automation. Treat any library's claimed detection rate as a vendor claim unless you validate it against your own traffic.
Decision criteria for choosing a detection approach
Use the following criteria to decide whether an open-source library fits your needs or whether you need a managed service.
| Criterion | What to evaluate | Why it matters |
|---|---|---|
| Signal breadth | Number of independent browser, network, device, and behavior checks | Single signals produce false positives; 106+ cross-checked signals reduce them |
| Maintenance burden | Frequency of updates when Playwright releases new versions | Playwright updates monthly; unmaintained libraries miss new evasion techniques |
| False-positive handling | Whether the library labels anomalies as evidence or verdicts | Privacy tools and corporate networks trigger look-alike signals for real users |
| Evidence quality | Session-by-session reasoning, click IDs, timestamps, signal-by-signal logs | Google and Meta refund teams require structured, forensic evidence |
| Integration effort | Client-side snippet vs. server-side API vs. managed dashboard | Open-source libraries require you to build collection, storage, and review workflows |
| Refund success rate | Documented recovery rate with ad platforms | BotRefund clients see 83% refund approval across 2,500+ audits |
Trade-off table: open-source vs. managed detection
| Factor | Open-source (playwright-detector, botd) | Managed service (BotRefund) | Takeaway |
|---|---|---|---|
| Setup time | Minutes to add script; hours to build logging | Minutes to add snippet; dashboard ready immediately | Open-source is faster to start, slower to operationalize |
| Signal count | 5–20 checks depending on library | 106+ independent checks across 4 layers | Managed service covers far more evasion techniques |
| False-positive control | You tune thresholds yourself | AI model weighs complete pattern; 99% accuracy | Managed service reduces manual tuning |
| Refund-ready reports | You build the report format | Click IDs, campaign details, session recordings, signal reasoning | Only managed service delivers platform-accepted format |
| Ongoing maintenance | You track Playwright releases and update | Vendor updates signals automatically | Managed service offloads cat-and-mouse work |
| Cost | Free license; engineering time required | Usage-based; free bot audit available | Open-source looks free until you count engineering hours |
When open-source libraries make sense
Choose an open-source library if:
- You need a quick proof-of-concept to quantify bot traffic volume.
- Your engineering team can maintain the detection logic as Playwright evolves.
- You only need basic filtering (e.g., blocking obvious headless visits) and do not plan to file ad-platform refund claims.
- You want to self-host all data and avoid third-party scripts.
In these cases, botd offers broader coverage out of the box, while playwright-detector is lighter if you only care about Playwright-specific artifacts.
When a managed service pays for itself
Switch to a managed service when:
- You are filing or planning to file invalid-traffic refund claims with Google or Meta — their reviewers expect structured, session-level evidence that open-source libraries do not produce.
- False positives are costly (e.g., blocking legitimate enterprise users behind corporate proxies).
- Your team cannot commit to tracking Playwright's monthly release cycle and updating detection rules.
- You need 106+ cross-checked signals across browser, network, device, and behavior layers to reach 99% accuracy.
BotRefund's free bot audit lets you see the full signal breakdown for your traffic before committing.
Limitations of open-source detection
Open-source libraries share three structural limits:
- Single-signal reliance: Most check a handful of browser properties. A sophisticated bot that patches
navigator.webdriverbut forgets the init-script mismatch will slip through. - No cross-layer correlation: They rarely combine browser signals with network reputation, device fingerprinting, and behavioral biometrics in a single model.
- No refund workflow: Even if detection works, you still need click IDs (GCLID, FBCLID), campaign context, timestamps, session recordings, and signal-by-signal reasoning formatted for Google and Meta review teams.
BotRefund's approach addresses all three: 106+ independent checks, AI-weighted pattern evaluation, and refund-ready reports that have achieved an 83% approval rate across 2,500+ audits.
Key facts
| Fact | Detail |
|---|---|
| Independent checks per session | 106+ (browser, network, device, behavior) |
| Detection accuracy | 99% via AI-weighted pattern evaluation |
| Refund recovery rate | 83% of clients recover funds from Google and Meta |
| Brands audited | 2,500+ |
| Bot click budget impact | Up to 20% of Google and Meta ad spend |
| Report format | Click IDs, campaign details, timestamps, session recordings, signal-by-signal reasoning |
Frequently asked questions
Can I just use the user-agent string to detect Playwright?
No. User-agent strings are trivial to spoof. Playwright and other automation tools let you set any user-agent you want. Reliable detection requires deeper browser signals like the Playwright Init Scripts mismatch.
Does botd detect Playwright specifically?
Botd includes checks for automation frameworks including Playwright, but its open-source version covers a subset of the signals in FingerprintJS's commercial product. Validate its coverage against your traffic before relying on it.
How often do I need to update open-source detection rules?
Playwright releases monthly. Each release can change the browser artifacts that detection libraries check. Plan for at least monthly maintenance if you self-host.
What evidence do Google and Meta require for refunds?
They expect click identifiers (GCLID, FBCLID), campaign details, timestamps, session recordings, and signal-by-signal reasoning structured in their review format. Open-source libraries do not generate this.
Can I combine open-source detection with a managed service later?
Yes. Many teams start with an open-source library to quantify the problem, then switch to a managed service when they need refund-ready evidence and lower false positives.
Is there a free way to test BotRefund's detection on my site?
Yes. BotRefund offers a free bot audit that shows the full 106+ signal breakdown for your traffic without commitment.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund installs with a single snippet and immediately runs 106+ independent checks — including Playwright Init Scripts, Scrollbar Width Leak, and Clean Context Iframe — across browser, network, device, and behavior layers. Our AI model weighs the complete pattern to reach 99% accuracy, and every finding comes with a session-by-session explanation formatted for Google and Meta refund teams. Across 2,500+ audits, 83% of clients recover ad spend. You can start with a free bot audit to see the full signal breakdown for your traffic before deciding.