Seatext library / BotRefund evidence
How to Detect Bot Traffic in Real Time: A Step-by-Step Implementation Guide
Real-time bot detection works by analyzing browser, network, and behavioral signals as each visit happens. You implement it by adding a client-side script that evaluates hundreds of data points per session, then flags or...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
To detect bot traffic in real time, deploy a client-side detection script that evaluates browser fingerprint, network consistency, and behavioral patterns on every page load. This approach catches automated visits the moment they arrive, unlike server-side log analysis which only reveals bots after the fact.
What real-time bot detection actually means
Real-time detection inspects each visitor's device and behavior while the session is active. Traditional server-side methods review IP addresses, user-agent strings, and request headers after the request completes. Client-side detection runs in the browser, capturing signals like WebRTC leaks, canvas fingerprints, mouse dynamics, and JavaScript execution timing that never reach your server logs.
The distinction matters because modern bots rotate residential proxies and spoof headers to mimic legitimate traffic. They only reveal themselves when forced to execute JavaScript in a real browser environment. A client-side script can challenge the browser with tests that automated tools fail or answer inconsistently.
Core signals used for real-time classification
BotRefund's detection engine evaluates 106 browser, network, hardware, and behavior signals together before classifying a visit as human or automated. No single signal decides the outcome; the prediction AI weighs the full pattern. The signals fall into two main categories.
Network, VPN, and geolocation evasion vectors
- WebRTC Network Leak — checks whether browser network paths reveal conflicting locations
- DNS Tunnel Leak — checks whether DNS and web traffic follow the same route
- DNS Challenge Blocked — checks whether DNS and web traffic follow the same route
- Timezone Evasion — checks whether location and language settings agree
- Latency Mismatch — checks whether connection and browser request details stay consistent
- Suspicious Ports — checks whether the visitor's network identity is coherent
- UTC Timezone Bias — checks whether location and language settings agree
- Languages Mismatch — checks whether location and language settings agree
- Netprobe Telemetry Missing — checks whether the visitor's network identity is coherent
- IP Address Inconsistency — checks whether the visitor's network identity is coherent
- OS / TCP TTL Mismatch — checks whether the visitor's network identity is coherent
- HTTP User-Agent Mismatch — checks whether connection and browser request details stay consistent
- Accept-Language Mismatch — checks whether location and language settings agree
- HTTP Protocol Mismatch — checks whether connection and browser request details stay consistent
- DNS Routing Mismatch — checks whether DNS and web traffic follow the same route
Evasion, debugger, and anti-stealth traps
- CDP Debugger Leak — checks for traces left by browser automation or masking tools
- Native Patching — checks whether the browser profile behaves like a real device
- Engine Mismatch — checks whether the browser profile behaves like a real device
- Rebrowser Leaks — checks for traces left by browser automation or masking tools
- JS Engine Mismatch — checks whether the browser profile behaves like a real device
- Automation Properties — checks for traces left by browser automation or masking tools
Additional behavioral signals captured on the client side include pointer behavior (robotic linear mouse movements, absence of humanlike mouse tremor, grid-aligned movement patterns), speed behavior (superhuman input speed under 1ms, VPN detection), engagement behavior (absence of clicks or scrolling), and session behavior (unnatural session durations).
Step-by-step implementation process
- Add the detection script to your site. Place a single script tag in the
<head>of every page you want to monitor. The script loads asynchronously and begins collecting signals on first paint. - Configure signal collection. Enable the full 106-signal suite or select subsets based on your traffic profile. E-commerce sites typically need all evasion and behavioral vectors; content sites may prioritize network and geolocation checks.
- Define classification thresholds. Set the confidence level at which a visit gets flagged. BotRefund's engine outputs a probability score; most teams start at 90% and adjust based on false-positive review.
- Integrate with your analytics and ad platforms. Push the classification result into Google Analytics, Meta Pixel, or your data warehouse as a custom dimension. This lets you segment bot vs. human traffic in reports and exclude flagged sessions from conversion attribution.
- Set up real-time alerts. Configure webhooks or dashboard notifications for sudden spikes in bot probability scores, new automation signatures, or traffic from known proxy ranges.
- Run a verification audit. After 24-48 hours, compare the detection dashboard against server logs and known test traffic (e.g., your own automated monitoring, partner crawlers). Confirm that legitimate bots like Googlebot are not flagged and that suspicious patterns align with the signal breakdown.
- Enable blocking or challenge responses (optional). If you need active mitigation, connect the classification API to your WAF or CDN edge rules to serve CAPTCHAs, 403 responses, or honeypot pages to high-confidence bot traffic.
Client-side vs. server-side detection: trade-offs
Server-side audits examine IP addresses, request headers, and user-agent data from log files. They catch basic scraper bots but struggle with advanced botnets that rotate residential IPs and spoof headers. Client-side audits analyze the visitor's browser environment directly, capturing fingerprint inconsistencies, automation artifacts, and behavioral anomalies that never appear in server logs.
| Criterion | Server-side only | Client-side (real-time) |
|---|---|---|
| Setup effort | Low — log parsing scripts | Low — one script tag |
| Detection latency | Minutes to hours (batch) | Milliseconds (per request) |
| Residential proxy detection | Weak — IPs look legitimate | Strong — browser leaks reveal mismatch |
| Automation framework detection | None — headers can be spoofed | High — CDP leaks, engine mismatches |
| Behavioral analysis | Limited to request patterns | Mouse, scroll, timing, engagement |
| Good bot allow-listing | Manual IP/UA lists | Verified fingerprint profiles |
Choose server-side if you only need historical reporting and have no control over page code. Choose client-side when you need to stop invalid clicks before they bill, protect conversion pixels from poisoning, or gather forensic evidence for ad-platform refunds.
Common detection methods compared
| Method | Best fit | Setup effort | Core workflow | Control & customization | Limitations |
|---|---|---|---|---|---|
| GA4 built-in bot filter | Basic analytics hygiene | One toggle in Admin | Google maintains a list of known bots and spiders | None — opaque list | Misses sophisticated bots; no evidence for refunds |
| Cloudflare Bot Management | Sites already on Cloudflare | Toggle in dashboard | Edge ML models score each request | Rule builder, allow/block lists | Limited behavioral signals; no ad-platform integration |
| DataDome / PerimeterX | Enterprise security teams | SDK or DNS integration | Challenge-response at edge | Extensive policy engine | Focus on blocking, not ad-refund evidence |
| BotRefund | Advertisers needing refunds | One script tag, ~1 minute | 106-signal client-side AI classification + evidence export | Threshold tuning, custom signals, refund report generator | Requires ad spend to justify ROI; not a WAF |
Practical scenarios where real-time detection changes outcomes
Paid social campaigns on Meta
Meta's Audience Network opts advertisers into thousands of third-party apps where publishers run click bots to inflate revenue. These bots trigger outbound clicks that bill your account but never convert. Real-time detection flags the session before the Meta Pixel fires a conversion event, preventing pixel poisoning and giving you client-side behavioral logs for refund claims.
Google Ads Performance Max and Display
Automated scripts and click farms target high-budget campaigns. Industry audits consistently place automated traffic between 9% and 20% of paid clicks. Real-time classification lets you exclude bot sessions from conversion tracking, so Smart Bidding optimizes for humans instead of automated traffic.
Lead-gen forms and gated content
Bots fill forms with disposable emails or scraped data, wasting sales follow-up time. Signals worth investigating include contactability (disconnected numbers, invalid email domains), timing (forms submitted immediately after landing), session behavior (no scrolling, no field corrections, uniform click paths), and CRM outcome (high reported lead count with no calls connected or demos booked).
Limitations and when this advice does not apply
- Static sites with no JavaScript execution cannot run client-side detection. You are limited to server-side log analysis.
- If your traffic volume is under a few thousand visits per month, the signal sample may be too small to tune thresholds confidently.
- Real-time detection does not replace a WAF for DDoS protection, SQL injection, or application-layer attacks.
- Good bots (Googlebot, Bingbot, monitoring services) must be allow-listed by verified fingerprint, not just user-agent, to avoid false positives.
- Privacy regulations (GDPR, CCPA) require disclosure of fingerprinting in your privacy policy and a lawful basis for processing.
Key facts
| Metric | Value | Source |
|---|---|---|
| Signals evaluated per visit | 106 browser, network, hardware, and behavior signals | S1 |
| Classification accuracy claim | 99% | S1 |
| Refund claim approval rate | 83% across filed claims | S2 |
| Automated traffic share of paid clicks (industry audits) | 9%–20% | S7 |
| Setup time | ~1 minute, one script tag | S2, S7 |
| Ad platforms supported for refunds | Google and Meta | S2, S7 |
| Historical refund lookback | Google Ads spend dating back to 2017 | S2 |
Terminology quick reference
- Client-side detection: JavaScript running in the visitor's browser that collects fingerprint and behavioral signals.
- Pixel poisoning: Bots triggering conversion pixels, causing ad-platform ML to optimize for non-human traffic.
- Residential proxy botnet: Malware on consumer devices that routes bot traffic through legitimate home IP addresses.
- Click farm: Low-cost labor or script emulators on real smartphones clicking ads to generate revenue or exhaust competitor budgets.
- FBCLID / GCLID: Click identifiers appended by Meta and Google; captured per-session for dispute evidence.
- Honeypot trap: Hidden page elements that only bots interact with, revealing automation.
FAQ
How fast does real-time detection return a verdict?
The classification completes within the page load, typically under 100ms, because the signal collection and scoring run in the browser concurrently with page rendering.
Can I use this without running paid ads?
Yes. The detection works for any site wanting to filter analytics, protect forms, or block scraping. The refund workflow only activates when you connect ad accounts.
Will this block legitimate users on VPNs or corporate networks?
VPN detection is one of 106 signals. A VPN alone does not flag a visit; the engine requires a pattern of mismatches across network, device, and behavior vectors before classifying as bot.
What evidence do ad platforms accept for refunds?
Google and Meta require client-side behavioral logs showing automation signatures (e.g., superhuman input speed, missing mouse tremor, CDP debugger leaks) tied to specific click IDs (GCLID, FBCLID) and timestamps.
How often are detection models updated?
The prediction AI retrains continuously on new automation signatures observed across the client network. Updates deploy automatically to the script tag without site changes.
Can I export raw signal data for my own analysis?
Yes. The dashboard provides per-session signal breakdowns and CSV export for offline investigation or data-warehouse ingestion.
What happens if I exceed my plan's visit limit?
Detection continues; overage billing applies per the pricing tier you selected. Enterprise plans include custom volume commitments.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.