How to Whitelist Your Corporate Network in BotRefund

How BotRefund's Allowlist Works

BotRefund's allowlist (also called a whitelist) lets you define trusted IP ranges so that traffic originating from your corporate network bypasses bot challenges and blocking. When a request arrives from an allowlisted CIDR block, BotRefund's edge logic marks the session as trusted before the 106 independent detection signals run. This prevents legitimate internal traffic—such as QA testing, marketing previews, or employee browsing—from being flagged by checks like CPU Concurrency Lie, window.open Tamper, or Impossible Tab Speed [S1][S6][S7].

The allowlist lives in the BotRefund dashboard under Settings → Traffic Management → Allowlist. Each entry accepts CIDR notation (for example, 203.0.113.0/24 for IPv4 or 2001:db8::/32 for IPv6). You can add multiple ranges, one per line, and optionally label each entry (e.g., "HQ Office", "AWS VPC", "Remote VPN"). Changes propagate to the detection edge within 60 seconds.

If you prefer programmatic management, BotRefund exposes a REST endpoint at POST /v1/allowlist with a JSON body containing cidr, label, and expires_at (optional). Audit logs record every add, edit, or delete action with the actor's user ID and timestamp, which helps compliance teams prove who changed the allowlist and when.

Why Whitelisting Matters for Ad Fraud Prevention

BotRefund's core value is detecting invalid clicks on Google and Meta ads and recovering wasted spend. The platform's AI weighs 106 independent signals—hardware fingerprinting, behavioral biometrics, network reputation, and more—to reach a 99% accuracy verdict [S1][S2]. When your own team visits landing pages, their traffic looks suspicious to some signals: corporate proxies strip headers, VPNs shift geolocation, and automated QA scripts mimic bot-like speed. Without an allowlist, those visits generate false positives that pollute your bot audit reports and can trigger unnecessary refund claims.

False positives also degrade the AI's training data. BotRefund's model learns from confirmed human and bot patterns across your account. If internal traffic is mislabeled as bot, the model's precision drops for your specific traffic mix. Whitelisting keeps the training set clean, which directly protects the 99% accuracy claim and the refund recovery workflow that depends on it [S1][S2].

When to Whitelist Corporate Networks

Typical scenarios include:

• Multi-office enterprises: Each branch has a static egress IP. Add every office CIDR so employees' ad-click QA never triggers blocks.
• Agencies managing client accounts: Agency staff preview client landing pages from a shared VPN. Whitelist the VPN's static IP to avoid contaminating client bot audits.
• CI/CD pipelines: Automated deployment verification scripts hit the live site. Whitelist the build server's IP range so synthetic traffic is excluded from detection logs.
• Remote workforce: If your company uses a corporate VPN with a fixed exit IP, add that CIDR. For split-tunnel setups where only some traffic routes through the VPN, whitelist only the VPN's egress range.

Do not whitelist entire cloud provider ranges (e.g., all of AWS us-east-1). That would open a hole for bots hosted on the same infrastructure. Scope each entry to the smallest CIDR that covers your actual egress points.

Static vs. Dynamic IP Considerations

BotRefund's allowlist expects stable CIDR blocks. If your ISP assigns a dynamic IP to your office router, the allowlist entry becomes stale after a DHCP lease renewal. Workarounds:

• Request a static IP from your ISP. Most business-class plans offer this for a small fee.
• Use a cloud-hosted VPN (e.g., AWS Client VPN, Tailscale, or Cloudflare WARP) with a fixed egress IP. Whitelist that single IP.
• API-driven updates: Write a cron job that detects your current public IP and calls BotRefund's PUT /v1/allowlist/{id} to update the CIDR. This requires a service account with API credentials.

IPv6 introduces additional complexity. Many corporate networks use privacy extensions that rotate the host portion of the address while keeping the prefix stable. Whitelist the /64 or /56 prefix assigned to your organization, not individual /128 addresses. If your network uses multiple IPv6 prefixes, add each one.

Proxy masking (e.g., employees using personal VPNs or residential proxies) defeats IP-based allowlisting. BotRefund's detection signals—especially network reputation and behavioral biometrics—will still evaluate those sessions normally. The allowlist only exempts traffic that arrives from the exact CIDRs you define.

Testing and Verification

After adding CIDR entries, verify they work:

1. Open the BotRefund dashboard → Live Traffic view.
2. Visit your site from a machine inside the whitelisted network.
3. Confirm the session appears with a green Trusted badge and no bot signals fired.
4. Check the Audit Log (Settings → Audit Log) for an entry like "Allowlist match: 203.0.113.45 matched 203.0.113.0/24 (HQ Office)".

For automated verification, use the GET /v1/allowlist/test?ip=203.0.113.45 endpoint. It returns { "matched": true, "entry_label": "HQ Office" } or { "matched": false }. Integrate this into your CI pipeline to catch misconfigurations before they affect production traffic.

If you see bot signals firing on whitelisted IPs, double-check CIDR syntax (no trailing spaces, correct prefix length) and ensure the traffic truly exits via the whitelisted egress. Split-tunnel VPNs and local breakout policies are common culprits.

Common Pitfalls

• Over-broad CIDRs: Adding 10.0.0.0/8 or 192.168.0.0/16 whitelists RFC1918 private space, which never appears at BotRefund's edge. Use only public egress IPs.
• Stale entries: Office moves, ISP changes, or VPN migrations leave dead CIDRs. Schedule a quarterly review; the audit log shows last-match timestamps for each entry.
• Label collisions: Duplicate labels make audit logs ambiguous. Enforce a naming convention like "--" (e.g., "us-east-hq-isp", "eu-west-vpn-tailscale").
• Ignoring IPv6: If your network is dual-stack, whitelist both IPv4 and IPv6 prefixes. Missing one leaves half your traffic subject to detection.
• Confusing allowlist with suppression lists: BotRefund also offers a Suppression List (Settings → Traffic Management → Suppressions) for known bot IPs you want to block explicitly. The allowlist is for trusted traffic; the suppression list is for known-bad traffic. They serve opposite purposes.

Advanced Configuration Options

Beyond basic CIDR entries, BotRefund supports:

• Time-bounded allowlist entries: Set expires_at via API for temporary access (e.g., a penetration test engagement). The entry auto-expires and disappears from the dashboard.
• Conditional allowlisting: Enterprise plans can attach a header_match rule (e.g., X-Corporate-Device: true) so the allowlist only applies when a managed device presents a specific header. This mitigates risk if a whitelisted IP is shared with a guest Wi-Fi network.
• Team-scoped allowlists: In multi-team accounts (Agency or Enterprise tiers), each team sees only its own allowlist entries. Admins see a global view. Use this to isolate client environments in agency accounts.
• Webhook notifications: Configure a webhook URL to receive allowlist.updated events. Your SIEM can correlate allowlist changes with traffic anomalies.

These features are documented in the BotRefund API reference (developer.botrefund.com). If the dashboard UI doesn't expose a setting you need, the API likely supports it.

Impact on Refund Claims and Detection Accuracy

Whitelisted traffic is excluded from bot audit reports that feed refund disputes. This is intentional: you don't want to claim refunds for your own team's clicks. However, it means your refund eligibility calculations reflect only external traffic. If a large portion of your ad clicks come from internal IPs (common in B2B campaigns where employees click their own ads), whitelisting reduces the total click volume BotRefund analyzes. The 99% accuracy claim applies to the analyzed traffic [S1].

BotRefund's refund recovery workflow—capturing video proof, logging GCLID/FBCLID, generating dispute reports—only processes non-whitelisted sessions [S2]. Ensure your finance team understands that internal clicks are not recoverable and should not be included in ad spend reconciliation.

If you need to audit internal traffic quality (e.g., to verify QA scripts aren't inflating conversion pixels), use the Internal Traffic Report (Reports → Internal Traffic). It shows all whitelisted sessions with full signal breakdowns, but marks them as "excluded from refund claims".

FAQs

• How do I verify the allowlist is working? Visit your site from a whitelisted IP, open the BotRefund Live Traffic view, and confirm the session shows a green "Trusted" badge with zero bot signals. The Audit Log will record an "Allowlist match" entry.
• Can I whitelist multiple IP ranges? Yes. Add each CIDR on a new line in Settings → Traffic Management → Allowlist. Label each entry for clarity.
• What if my corporate network uses dynamic IPs? Use a static-egress VPN (cloud VPN, Tailscale, Cloudflare WARP) and whitelist its fixed IP. Alternatively, script API updates via a cron job that detects IP changes.
• Does whitelisting affect BotRefund's 99% accuracy? It improves accuracy for your account by removing false positives from internal traffic. The 99% figure applies to non-whitelisted traffic evaluated by the full 106-signal engine [S1].
• Can I whitelist IPv6 addresses? Yes. Enter the IPv6 prefix in CIDR notation (e.g., 2001:db8:abcd::/48). Whitelist the stable prefix, not rotating /128 addresses.
• What happens if I accidentally whitelist a cloud provider's entire range? Bots hosted in that range will bypass detection. BotRefund does not prevent this; scope CIDRs to your specific egress IPs only.
• How do allowlist changes affect in-flight refund disputes? They don't. Disputes are based on historical data captured before the change. Future audits will reflect the new allowlist.
• Can team members edit the allowlist without admin rights? On Agency and Enterprise plans, team-scoped permissions control this. Admins can grant "Allowlist Manager" role per team.
• Is there a limit on the number of CIDR entries? The dashboard allows up to 500 entries per team. API-only accounts can request higher limits.
• Does whitelisting apply to the free bot audit? Yes. The free audit respects your allowlist configuration, so internal traffic won't appear as bot in the audit report.