Seatext library / BotRefund evidence
Detecting Bots with Empty Font Canvas Fingerprinting
Empty font canvas detection works by rendering text on an HTML canvas using a non-existent font, then comparing the resulting pixel hash against a baseline. This identifies headless browsers or automated tools that fail...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
How Empty Font Canvas Detection Works
The empty font canvas technique relies on the fact that browsers render text differently based on the fonts installed on the underlying operating system. By forcing the browser to render text using a font that is intentionally missing or obscure, you create a specific visual output.
A standard browser will attempt to fall back to a default system font, creating a predictable pixel pattern. Automated browsers, headless environments, or spoofed profiles often fail to replicate this fallback behavior accurately. By capturing the toDataURL() output of the canvas and hashing it, you can compare the result against a known baseline for that specific browser configuration.
This check is one of 106 independent signals used by BotRefund to build a reliable picture of whether a visit is human or automated. It looks for a mismatch that a real browsing session does not normally create. Virtual machines and spoofed profiles can claim one device while their graphics, fonts, audio, or processor behavior tells another story.
Why This Technique Matters
Automated tools often spoof their User-Agent strings to appear as common browsers like Chrome or Safari. However, they frequently struggle to emulate the complex, hardware-dependent rendering pipeline of a real browser. If a visitor claims to be a high-end desktop browser but produces a canvas hash that suggests a generic or headless environment, it serves as a strong indicator of non-human traffic.
The empty font canvas technique is particularly valuable because it targets a specific weakness in headless browsers. Many headless environments do not have a full set of system fonts, or they use a simplified rendering engine that does not match the font fallback logic of a real browser. This creates a detectable difference.
In the broader context of bot detection, this technique is not a standalone verdict. A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data.
Implementation Steps
- Create a hidden canvas: Inject a small
<canvas>element into the DOM that is invisible to the user (e.g.,display: noneor positioned off-screen). - Define the test string: Choose a string of text that includes characters sensitive to font rendering, such as emojis or complex glyphs.
- Apply a non-existent font: Set the canvas context font property to a font family that is highly unlikely to exist on any standard user machine.
- Render and hash: Draw the text onto the canvas and extract the image data using
toDataURL(). Generate a hash (like SHA-256) of this data string. - Compare against baseline: Check the generated hash against a database of known "human" browser fingerprints. A mismatch or an empty/default output often indicates an automated environment.
For example, you might use a font name like "__NoSuchFont__" and a string like "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()". The exact choice matters because some characters trigger different fallback paths.
Choosing the Right Test String and Font
The effectiveness of this technique depends heavily on the test string and the fake font name. The string should include characters that are not universally available in all fonts, such as emojis, ligatures, or rare Unicode symbols. This forces the browser to perform a more complex fallback, which is more likely to differ between real and automated environments.
The fake font name should be something that does not exist on any system. Avoid using common names like "Arial" or "Times New Roman" because they might be present. Instead, use a random string like "__BotRefund_NoSuchFont_2024__". This ensures that the browser must fall back to a default font, and the rendering result will be based on the system's default font stack.
It is also important to consider the canvas size and text position. Use a fixed width and height, and set the text baseline and alignment to avoid variations. The goal is to produce a consistent output for the same browser and OS combination.
Building a Baseline and Setting Thresholds
To use this technique effectively, you need a baseline of what a normal human browser produces. This baseline should be collected from a large sample of known human traffic. You can store the hash values and group them by browser, OS, and device type. For example, Chrome on Windows 10 might produce one set of hashes, while Safari on macOS produces another.
When a new visitor arrives, you compute the hash and compare it to the expected baseline for the claimed browser and OS. If the hash does not match any known baseline, or if it matches a known bot pattern, you flag the session. However, you should not block based on this alone. Instead, you can assign a risk score and combine it with other signals.
BotRefund uses this signal as one of 106 independent checks. The final decision is made by an AI model that weighs the complete pattern. This approach reduces false positives and improves accuracy. According to BotRefund, this corroboration leads to 99% accuracy in distinguishing bots from humans.
Handling False Positives and Edge Cases
No single technique is perfect. The empty font canvas check can produce false positives for legitimate users. For example, users with custom font configurations, browser extensions that alter font rendering, or older browsers with different fallback logic may generate unexpected hashes. Corporate networks that enforce specific font policies can also cause mismatches.
To mitigate this, you should never rely solely on this check. Always combine it with other signals such as mouse movement, network properties, and behavioral patterns. BotRefund emphasizes that a single anomaly is not a bot verdict. Privacy tools, travel, and unusual devices can produce unexpected behavior for genuine people.
Another edge case is when a bot attempts to spoof the canvas output. Sophisticated bots can intercept the canvas API and return a precomputed hash that matches a human baseline. This is why modern detection relies on corroboration across multiple signals. The empty font canvas check is just one piece of the puzzle.
Integration with Broader Bot Detection
The empty font canvas technique fits into a larger bot detection strategy. It is a form of canvas fingerprinting, which is a well-known method for identifying browsers. However, it is more specific because it uses a non-existent font to create a controlled test. This makes it harder for bots to emulate because they would need to know the exact font name and the expected rendering output.
In practice, you would run this check alongside other checks such as WebGL fingerprinting, audio fingerprinting, and behavioral analysis. BotRefund uses 106 independent checks, including hardware and GPU fingerprinting, suspicious ports, and more. Each check adds an objective fact about the visit. The AI model then evaluates how all signals fit together.
For example, if a visitor claims to be on a MacBook Pro but the empty font canvas hash matches a Linux headless browser, that is a strong signal. However, if the visitor is using a virtual machine for legitimate reasons, other signals might support the human story. The key is to look for consistency across all signals.
Limitations and Trade-offs
While the empty font canvas technique is useful, it has limitations. First, it can be bypassed by advanced bots that emulate the canvas rendering. Second, it may cause false positives for users with unusual font setups. Third, it requires a baseline that must be maintained as browsers and operating systems update.
There is also a privacy consideration. Canvas fingerprinting can be used to track users across sessions. However, the empty font canvas technique is less invasive than full canvas fingerprinting because it only tests a specific font fallback. Still, you should be transparent in your privacy policy and comply with regulations like GDPR.
Performance is another factor. The technique is lightweight and runs in milliseconds. It does not impact page load speed significantly. However, if you run many checks, the cumulative effect could be noticeable. BotRefund optimizes this by running checks asynchronously and in parallel.
Practical Scenarios
Consider an e-commerce site that suffers from ad fraud. Bots click on ads, inflating costs and skewing analytics. By implementing the empty font canvas check, the site can flag sessions that show a mismatch between the claimed device and the actual rendering. This evidence can be used to dispute invalid clicks with Google and Meta.
Another scenario is a content site that wants to block scrapers. Scrapers often use headless browsers to extract content. The empty font canvas check can identify these headless environments because they lack the full font stack of a real browser. This helps protect the site's content and reduce server load.
For a login page, this technique can add an extra layer of security. If a bot attempts to brute-force credentials, the canvas check can flag the session and trigger additional verification steps, such as CAPTCHA or two-factor authentication.
Frequently Asked Questions
- Does this technique impact page load speed? When implemented efficiently, the impact is negligible as it runs as a background script.
- Can bots bypass this? Sophisticated bots can attempt to spoof canvas output, which is why modern detection relies on corroboration across multiple signals.
- Is this legal? Yes, it is a standard security practice for identifying automated traffic, provided it complies with your site's privacy policy.
- What if the user has custom fonts? The test uses a non-existent font, so local custom fonts should not interfere with the baseline comparison.
- How do I verify the results? Compare the hash against a large sample of known human traffic to establish your baseline.
- What is the accuracy of this technique alone? It is not meant to be used alone. BotRefund combines it with 105 other checks to achieve 99% accuracy.
- Can this technique be used on mobile devices? Yes, but mobile browsers may have different font fallback behavior, so you need separate baselines for mobile.
- How often should I update my baseline? Whenever a major browser or OS update changes font rendering, you should recalculate your baseline.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.