Seatext library / BotRefund evidence
How Can I Tell If My Website Traffic Is From Bots?
Check for a pattern: a traffic spike from an unknown source, a bounce rate near 100%, sessions that last seconds, and clicks that don't become conversions. No single metric proves bots, but the pattern...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Check your analytics for a pattern. Bot traffic usually shows up as a traffic spike from an unfamiliar source, a bounce rate near 100%, sessions that last only seconds, and clicks that never become leads. No single number proves bots. A pattern does.
The fastest way to tell if traffic is from bots is to compare it to how humans behave. Humans arrive from different places, move a mouse, scroll, pause, and sometimes buy. Bots rarely do any of that. If you see traffic that skips human behavior, treat it as bot traffic until you can prove otherwise. Ignore it, and you pay for clicks that can't convert and make decisions with poisoned data.
How to check your traffic in five steps
Prerequisites: access to your analytics tool, server logs if you have them, and a page that gets normal traffic. The whole check takes about 15 minutes.
- Find the spike. Open your acquisition report and sort by source, medium, or country. Set the date range to the last 30 days. Look for a source, a region, or a page that suddenly jumped. Bots often arrive from one referral domain, one data center, or a country you don't serve.
- Check bounce rate and session duration. Bots usually load one page and leave. A segment with a bounce rate above 90% and an average session under five seconds is suspicious. Compare it to your normal human baseline.
- Review device and browser mix. Real audiences use a variety of browsers, devices, and screen sizes. A segment that is 100% desktop, 100% Chrome, or 100% Windows needs explanation.
- Compare clicks to sessions and conversions. If your ad platform reports 1,000 clicks but your site shows 300 sessions, or if sessions show no scrolling and no form corrections, the gap is a red flag.
- Verify in real time. Open real-time analytics and load the page yourself from your normal browser. Then load the same page with a random URL parameter such as ?test=abc. Many basic bots don't execute JavaScript and will never request that parameter. If a suspicious source still shows up, you are seeing automation.
After any change, wait 24 hours and check the same segment again. If the pattern shrinks or disappears, your fix worked. That is the verification step.
One common mistake is calling it bots based on a high bounce rate alone. Human visitors can bounce for reasons like slow page speed, weak copy, or a mismatch between an ad and the landing page. Let the pattern, not one metric, make the call.
What counts as bot traffic
Bot traffic is any website visit that a computer program creates instead of a human. The category includes good bots and bad bots.
- Good bots: search engine crawlers, uptime monitors, and price-comparison tools. They help index your content and rarely hurt your business.
- Bad bots: scrapers, credential-stuffing scripts, click farms, and ad fraud bots. They waste bandwidth, inflate ad bills, and poison analytics.
When people ask "is my traffic from bots?", they usually mean bad bots. The diagnostic above helps you separate the two.
Why one signal is never enough
A high bounce rate can have human causes. A landing page might be slow, irrelevant, or badly designed. A traffic spike can come from a PR mention or a viral post. That's why one signal can be misleading. Bot detection becomes reliable only when signals fit together.
BotRefund's prediction AI, for example, sees how 106 browser, network, hardware, and behavior signals fit together before deciding whether a visit is human or automated. It doesn't score one suspicious browser property; it evaluates the full pattern. Signals become a decision only when they are seen together.
What to do when you find bot traffic
First, don't block everything. Search engine crawlers and monitoring bots are useful. Block only the segment that matches your evidence: an IP range, a user-agent, or a referral domain.
If the traffic is coming through paid ads, you have a bigger problem. Every bot click on a Google or Meta ad costs you money. BotRefund says bot clicks steal up to 20% of Google and Meta ad budgets. To recover that spend, you need proof for each flagged click, not just a bounce rate report.
- Block manually. Use your tag manager, firewall, or ad platform to exclude the verified pattern.
- Use a detection tool. A client-side script can capture browser and behavior signals that server logs miss.
- File a refund claim. Ad platforms allow refunds for invalid traffic. You need session-level evidence and a clear request.
How bot detection actually works
Basic detection uses server logs. It looks at IP addresses, user-agents, and request headers. That catches many simple scrapers but misses bots that rotate IPs and spoof headers.
Better detection runs in the browser. A small script observes what the browser reveals and what the visitor actually does. It can catch missing mouse movement, impossible click speeds, fake browser properties, and misconfigured network settings. BotRefund's detection list shows the range: WebRTC leaks, timezone and language mismatches, DNS routing mismatches, debugger traces, automation properties, grid-aligned mouse paths, superhuman input speed, and session durations that are too short or too uniform to be human.
This client-side approach is also what produces the evidence needed for refund disputes. The script logs behavior as it happens, so you're not guessing later.
Key facts at a glance
These facts come from BotRefund's public site and are labeled as their published numbers, not independent benchmarks.
| Fact | Detail |
|---|---|
| Detection method | Prediction AI evaluates 106 browser, network, hardware, and behavior signals together |
| Published accuracy | 99% accuracy at classifying traffic as human or bot |
| Refund success | 83% approval rate across client refund claims submitted to ad platforms |
| Budget impact | Bot clicks can steal up to 20% of Google and Meta ad budget |
| Setup | One script tag, about one minute, no ad-account access required |
| Data handling | GDPR-aligned data handling |
| Typical user | High-volume advertisers and agencies running Google and Meta paid campaigns |
Keep in mind: these are vendor-published numbers. Your results depend on your traffic, your ad platform, and the quality of your evidence.
Limitations: when 'bot traffic' isn't the real problem
Not every bad lead is a bot, and that matters. Treating every unresponsive contact as fraud can make you exclude a valuable audience. Start with a structured audit that compares ad-platform data, website sessions, and CRM outcomes before you change targeting or ask for a refund.
Some bot traffic is normal and harmless. Search engine crawlers, social preview bots, and uptime monitors will always appear in your logs. The goal is zero harmful bots, not zero bots.
This advice applies most when you run paid campaigns where every click costs money. For a small content site with no paid ads, most "bot traffic" is probably indexing and can be ignored.
Finally, detection is probabilistic. A suspicious pattern is not proof. Before filing a refund claim or firing an agency, confirm the details with a tool designed for that job.
Frequently asked questions
What is the difference between a bot and a real visitor?
A bot is a software program that requests your site without a human working the browser in real time. Real visitors use a browser, move the pointer, scroll, pause, and make choices. Bots tend to skip those steps. No single behavior is proof, but a pattern of missing human behavior is.
Can Google Analytics tell me if traffic is from bots?
Standard reports can show suspicious patterns, but they can't detect every bot. Google offers a setting to exclude known bots and spiders, but sophisticated bots can still slip through because they execute JavaScript. Client-side behavioral tools add a layer that analytics alone misses.
Why do bots cause high bounce rates?
Bots often load one page and leave immediately. They don't scroll, click, or read. That creates a one-pageview session with zero interaction and a duration of a few seconds, which inflates bounce rate and drags down session duration.
How can I tell if a traffic spike is a bot or a real viral post?
Look at the source, geography, and behavior. A viral post brings traffic from many referring URLs, varied devices, and real engagement like scrolling and clicks. A bot spike usually comes from one or two referrers, one browser type, and very short sessions. Check whether the spike converts. Viral visitors sometimes buy; bots almost never do.
Should I block all bot traffic?
No. Block only the segments supported by your evidence. Search engine crawlers and legitimate monitoring tools should stay. Blocking all unknown user-agents can hurt your SEO and break the tools you rely on.
Can I get a refund for bot clicks on Google or Meta ads?
Yes, the platforms have invalid traffic policies and refund processes. The challenge is proof. You need session-level evidence showing the clicks were automated, usually from browser and behavior signals. BotRefund reports an 83% approval rate across refund claims it files, but every claim depends on the platform's review.
What does bot detection cost?
It varies. Free analytics filters and simple firewall rules cost nothing. A purpose-built detection and refund service is usually priced by ad spend. For example, BotRefund's site asks for your monthly Google and Meta spend to show the right plan. Check current pricing directly because rates change.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund is built for proving bot clicks and recovering wasted ad spend. Its detection script watches 106 browser, network, hardware, and behavior signals together instead of relying on a single suspicious property. That pattern-based approach gives you evidence you can use if you decide to dispute invalid traffic with Google or Meta.
Setup takes one script tag in about one minute, and it doesn't require ad-account access. Data handling is GDPR-aligned. The limitation is scope: the service focuses on paid-click fraud for advertisers and agencies, not on every type of website traffic. If you just want to block scrapers on a content site, a simpler tool may be enough. If you're paying for clicks that never convert, this is the next step to test.