Experts detect hidden Playwright traffic by looking for subtle automation footprints that ordinary browsers don’t leave.

Answer: Experts detect hidden Playwright bots by using advanced fingerprinting, AI‑driven multi‑signal correlation, and real‑time network behavior analysis.

Why Detecting Playwright Bots Matters

Playwright is a powerful automation framework that can mimic real user actions. When malicious actors use it, they generate traffic that looks human but drains ad budgets, poisons conversion data, and skews machine‑learning models. A 2026 industry report notes that invalid traffic can represent 9‑20% of paid clicks, costing advertisers up to 20% of spend [S2]. Early detection protects revenue, preserves data quality, and prevents fraud escalation.

Definition and Scope

Playwright scripts control a browser instance via the Chrome DevTools Protocol (CDP). Even when developers apply stealth plugins, the automation leaves behind traces—known as detection signals. BotRefund captures these signals on the client side, feeds them to a prediction AI, and decides whether a session is human or bot.

Key Detection Signals

BotRefund monitors over 100 signals, including the 16 listed above, before making a decision [S1]. No single flag triggers a bot label; the AI weighs the full pattern.

How Each Signal Is Generated and Captured

CDP Debugger Leak

Playwright communicates with the browser via CDP. The protocol exposes internal debugging endpoints that, when queried, leave a chrome.debugger object in the page context. BotRefund’s script checks for the presence of this object and for abnormal chrome.runtime values. Because the leak originates from the automation layer, it is a strong indicator of Playwright use [S1].

Automation Properties

Automation frameworks set several JavaScript properties: navigator.webdriver, window.__playwright, and custom flags in navigator.plugins. BotRefund reads these properties during page load. When any are true, the AI adds a positive weight toward bot classification.

Latency Mismatch

Human devices exhibit predictable network latency based on connection type and geographic distance. Playwright bots often run on cloud VMs with low‑latency links, creating a mismatch between reported performance.timing values and the observed IP‑based latency. BotRefund measures the round‑trip time of a tiny beacon request and compares it to the browser‑reported timing. A significant gap raises the bot score [S1].

Timezone / Language Mismatch

Playwright can spoof Intl.DateTimeFormat().resolvedOptions().timeZone and navigator.language. However, the underlying OS may still expose a different UTC offset in the Date object. BotRefund cross‑checks these values; inconsistency suggests manipulation.

WebRTC / DNS Leak

Even when a script masks the IP address, WebRTC ICE candidates often reveal the real network path. BotRefund initiates a WebRTC peer connection and inspects the candidate list for IPs that differ from the HTTP request IP. DNS tunnel leaks are detected by sending a DNS‑over‑HTTPS request and comparing the resolved IP to the HTTP IP. Both checks flag evasion attempts [S1].

Engine & Rebrowser Leaks

Playwright may patch the JavaScript engine to hide its fingerprint. BotRefund reads low‑level properties such as Object.prototype.toString of built‑in objects and compares them to known Chrome/Edge signatures. Rebrowser leaks appear when a new browser context inherits leftover identifiers from a previous session, which BotRefund detects by hashing the navigator.userAgent and comparing it to the current process ID.

Why These Signals Matter

Relying on a single signal creates false positives (e.g., a VPN user may trigger a timezone mismatch) or false negatives (a well‑masked bot may hide the webdriver flag). Multi‑signal correlation reduces both error types. BotRefund’s AI assigns weights based on historical performance, achieving 99% accuracy across 106 signals [S1]. The model also learns from new evasion patterns, continuously improving detection.

Implementation Checklist for Teams

• Place the BotRefund script tag in the <head> of every page you want to protect.
• Verify that the script loads within 200 ms to avoid missing fast‑click sessions.
• Configure data‑privacy settings to anonymize IP addresses while retaining signal integrity.
• Integrate the AI decision endpoint with your server logs to enrich each request with a bot‑score.
• Set up alerting: trigger a webhook when the bot‑score exceeds a configurable threshold.
• Export raw signal data weekly for internal audit and model‑tuning.
• Document the workflow in your incident‑response playbook.

Common Evasion Techniques and Counter‑measures

Sophisticated Playwright bots try to hide CDP leaks by injecting custom scripts that delete chrome.debugger objects before page load. They also spoof automation properties using Object.defineProperty. BotRefund mitigates these attempts by:

• Running its detection code in an isolated sandbox that executes before any third‑party script.
• Hashing the original property descriptors and comparing them after the page’s own scripts run.
• Cross‑checking network‑level telemetry (WebRTC, DNS) that cannot be altered from JavaScript alone.

When a bot masks one vector, another vector—such as latency mismatch—often remains exposed, allowing the AI to still flag the session.

Limitations

BotRefund’s detection relies on client‑side JavaScript execution. Scenarios where it does not apply include:

• Headless API calls: Pure server‑to‑server requests never load the script, so they bypass detection.
• Privacy‑focused browsers: Extensions that block fingerprinting APIs (e.g., CanvasBlocker) can suppress some signals, increasing false‑negative risk.
• Zero‑day evasion: New automation techniques that perfectly mimic all 106 signals could temporarily evade detection until the AI model is retrained.

Even in these cases, BotRefund can still provide value by correlating server‑side anomalies (IP bursts, unusual User‑Agent strings) with any partial client data that is available.

Step‑by‑Step Detection Process

1. Collect signals. Insert BotRefund’s script tag; it gathers over 100 browser, network, hardware, and behavior signals.
2. Run the AI model. The prediction engine evaluates the full pattern, not any single flag.
3. Flag suspicious sessions. Sessions with CDP debugger leaks or automation properties are marked for review.
4. Correlate with server data. Cross‑check flagged sessions against IP, user‑agent, and request timing.
5. Generate evidence. Export logs that show the exact signals triggering the bot classification.

Practical Scenarios

• Ad click fraud. Playwright bots inflate click counts; detection stops wasteful spend.
• Pixel poisoning. Bots trigger conversion pixels; early flagging protects data quality.
• Scraping protection. Identify high‑frequency Playwright crawlers and block them at the edge.

Limitations and When It Doesn’t Apply (Expanded)

Beyond the client‑side constraints, other edge cases exist:

• Content Security Policy (CSP) blocks. If a site’s CSP disallows inline scripts, the detection script may be prevented from executing, leading to blind spots.
• Network‑level throttling. Some corporate proxies strip WebRTC candidates, reducing the effectiveness of that vector.
• Legal restrictions. GDPR‑compliant deployments must anonymize certain identifiers, which can slightly lower signal richness.

Next Steps & Frequently Asked Follow‑up Questions

1. How can I tune the AI model for my traffic volume? Use the dashboard’s “Model Settings” panel to adjust the bot‑score threshold. Lower the threshold for high‑risk environments (e.g., ad networks) and raise it for low‑risk sites. Export a sample of 10 k sessions, label false positives, and upload the file to retrain the model.
2. Can I export raw signal data for my own analysis? Yes. The “Export Signals” button generates a CSV containing every captured property for the selected time range. This file can be fed into SIEM tools or custom ML pipelines.
3. What is the latency impact of the detection script? The script loads asynchronously and completes signal collection within 30‑50 ms on a typical 3G connection. AI scoring occurs on BotRefund’s edge servers, adding less than 10 ms of round‑trip time.

FAQ

• What if a bot hides the CDP leak? BotRefund also checks automation properties and network inconsistencies, providing backup evidence.
• How fast is detection? Signals are evaluated in real time, usually within milliseconds of page load.
• Do I need a paid plan? The free audit includes the full detection stack for up to 10,000 sessions per month.
• Can I see the raw signals? Yes, the dashboard lets you inspect each signal for any flagged session.

Learn more about this service

See how this page can help with your next step.

Learn more

Fake Leads: Meta Ads vs Google Ads — Platform Comparison

Canvas fingerprinting detects headless browsers by drawing a hidden image on an HTML5 canvas and reading the pixel data. Real browsers render that image using the device's fonts, GPU, and operating system, producing a unique signature. Headless browsers like Puppeteer or Selenium often lack those same fonts or GPU features, so their canvas output looks different. That difference is a strong signal that the visitor is not a human using a normal browser.

This article walks through how the detection works, the exact steps to run a canvas-based check, and why a single canvas anomaly is not enough to call something a bot.

What Canvas Fingerprinting Measures

Canvas fingerprinting works by asking the browser to draw a specific image or text, then converting the result to a hash. The hash changes based on:

• Which fonts are installed and how they render
• The graphics card and driver (GPU)
• Operating system and screen settings
• Subpixel rendering and anti-aliasing

Because these factors vary between devices, the hash acts like a fingerprint. A real browser on a laptop with Windows and Chrome will produce a different hash than a headless browser running on a server with no GPU.

Why Headless Browsers Fail the Canvas Test

Headless browsers are designed to run without a visible window. They often use minimal font sets, no GPU acceleration, and default rendering settings. When they draw the same canvas image, the result is missing the subtle variations that come from real hardware.

For example, a headless browser might not have the font 'Arial' installed, so it falls back to a default font. That changes the pixel output. Similarly, without a GPU, the browser uses software rendering, which produces different anti-aliasing. These differences are easy to spot when you compare the canvas hash to what a real browser produces.

BotRefund's empty font canvas check is one of 106 independent signals it uses. It looks for a mismatch between what the browser claims and what the canvas rendering shows. As BotRefund explains, 'The Empty Font Canvas check looks for a mismatch that a real browsing session does not normally create.'

The Diagnostic Sequence: How to Detect a Headless Browser with Canvas

If you want to implement canvas-based detection yourself, follow these ordered steps. This is a diagnostic sequence, not a one-time test.

1. Create a canvas element with a known image or text. Use a fixed size and a specific font family, like 'Arial', to make the test consistent.
2. Draw the content using the canvas API. Include text, shapes, and gradients to capture rendering differences.
3. Read the pixel data with toDataURL() or getImageData(). This gives you a string that represents the rendered output.
4. Hash the result using a simple hash function. Store this hash as the visitor's canvas fingerprint.
5. Compare against a baseline of known real-browser hashes. If the hash is missing or falls outside the expected range, flag it as suspicious.
6. Cross-check with other signals. A single canvas anomaly is not a bot verdict. Check for headless browser markers like navigator.webdriver, missing plugins, or unusual mouse movement.

This sequence is exactly how BotRefund approaches it. The empty font canvas check is one signal, but BotRefund sends it into a prediction AI that evaluates the complete picture across browser, network, device, and behavior evidence.

Prerequisites for Reliable Canvas-Based Detection

Canvas detection only works if you set it up correctly. Here are the prerequisites:

• Consistent test content – Use the same canvas drawing every time so results are comparable.
• A baseline dataset – Collect canvas hashes from known human visitors to build a reference range.
• Multiple signals – Canvas alone is not enough. Combine it with other fingerprinting methods like WebGL, audio, and behavior analysis.
• Handling for privacy tools – Some browsers block canvas reads or return blank data. Treat those as 'unknown' rather than 'bot'.

BotRefund's approach meets these prerequisites. It uses 106 independent checks and cross-references them. As its documentation states, 'A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people.'

Verification: Confirm the Detection Works

After you implement canvas detection, verify it with a controlled test. Open your page in a normal browser and note the canvas hash. Then run the same page in a headless browser like Puppeteer. Compare the hashes. If they differ significantly, your detection is working.

Next, test with a real user who has a common setup. The hash should match your baseline. If it doesn't, your test content may be too sensitive or your baseline is too narrow.

Finally, monitor false positives. If real users are being flagged, adjust your thresholds or add more cross-checks. BotRefund does this by keeping the canvas signal as evidence, not a verdict, and cross-checking it against independent browser, network, device, and behavior data.

Key Facts About Canvas-Based Bot Detection

Limitations of Canvas Fingerprinting

Canvas detection is not perfect. It has several limitations you should know:

• Privacy tools – Browsers like Brave or extensions like CanvasBlocker can return blank or randomized data, causing false positives.
• Headless browsers with stealth – Some tools like Puppeteer Stealth or Camoufox try to mimic real canvas output, making detection harder.
• Virtual machines – A VM may have a different GPU or font set, but that doesn't mean it's a bot.
• Cross-browser differences – Chrome and Firefox render canvas differently even on the same device, so your baseline must account for that.

BotRefund acknowledges this. It keeps the canvas signal as evidence, not a verdict, and cross-checks it with other data. This reduces false positives and improves accuracy.

Terminology You Might Encounter

Understanding these terms helps you read detection reports:

• Canvas fingerprint – A hash of the pixel data from a canvas drawing.
• Headless browser – A browser without a graphical interface, often used for automation.
• Empty font canvas – A specific test that checks if the browser has the expected fonts installed.
• WebGL fingerprint – Similar to canvas but uses 3D graphics to extract GPU details.
• Corroboration – Combining multiple independent signals to reach a conclusion.

FAQ

Can canvas fingerprinting be bypassed?

Yes, with tools like Puppeteer Stealth or by patching the canvas API. However, these bypasses are not perfect and often introduce other detectable inconsistencies.

Does canvas detection work on all browsers?

No. Different browsers render canvas differently, so you need a baseline for each browser and version. Also, some browsers block canvas reads entirely.

Is canvas fingerprinting legal?

It is generally legal, but privacy regulations like GDPR require you to inform users if you fingerprint them. Always check your local laws.

How accurate is canvas fingerprinting alone?

Alone, it is not very accurate. It produces many false positives. It works best when combined with other signals like WebGL, audio, and behavior analysis.

What is the difference between canvas and WebGL fingerprinting?

Canvas uses 2D drawing, while WebGL uses 3D graphics. WebGL exposes more GPU details, making it harder to spoof, but it is also more detectable by privacy tools.

Can I use canvas detection on my own website?

Yes, you can write a simple script. But for reliable bot detection, you need a robust system that cross-checks many signals, like BotRefund does.

Understanding the Hidden Operational Tax

When evaluating bot protection, the sticker price of a license is only the entry fee. The real cost is found in the operational friction created by the tool itself. If a system is too aggressive, it blocks legitimate customers; if it is too passive, it fails to protect your ad spend or lead quality. Balancing this requires constant human intervention.

False positive remediation is the most significant hidden cost. When a real user is blocked, they cannot convert, leading to lost revenue and increased support tickets. Investigating a single false positive—verifying the user, checking logs, and adjusting settings—averages 45 minutes of skilled labor. At scale, this can quickly overwhelm your security or marketing teams. (Note: This 45-minute figure is an industry estimate; actual times vary by tool and team.)

Rule tuning is the second major driver. Many legacy systems rely on static rules that require constant updates to keep pace with evolving bot tactics. Analysts often spend 15–20% of their time writing, testing, and refining these rules. This is not just a one-time setup cost; it is a recurring drain on your most expensive technical resources.

But these are not the only costs. Integration, training, and ongoing maintenance also add up. And if your bot protection tool makes mistakes, the financial impact can be far larger than the labor cost. For example, a single false positive can lose a high-value customer. The Digitopia case study shows how bot traffic can silently eat away at ad budgets and lead quality.

The Real Cost of False Positives: A Case Study

Digitopia, an enterprise transformation SaaS company, faced a serious problem. Their marketing campaigns were active, but malicious bot traffic was poisoning their lead scoring systems inside HubSpot. They discovered that 19% of their leads were fake. That means nearly one in five leads was a bot, wasting sales time and distorting conversion data.

After implementing BotRefund, they recovered $18,200 in ad spend and saw a 22% increase in conversion rate. The recovery came from refunds on invalid clicks, but the conversion lift came from cleaning up the data. When bots are removed, marketing AI optimizes for real buyers, not fake ones.

This case illustrates the hidden cost of false positives and false negatives. False positives block real customers; false negatives let bots through. Both are expensive. The key is to minimize both, which requires a system that can distinguish between human and automated behavior with high accuracy.

Rule Tuning: The Recurring Drain

Manual rule management is inherently reactive. By the time an analyst identifies a new bot pattern and writes a rule to block it, the bot operator has often already rotated their proxies or changed their browser fingerprint. This "cat-and-mouse" game is the primary reason rule-based systems become so expensive to maintain over time. They require constant, high-level human attention to remain even moderately effective.

Industry estimates suggest that security analysts spend 15–20% of their time on rule tuning for legacy bot protection. That is a significant portion of a highly paid resource. If an analyst earns $100,000 per year, that is $15,000–$20,000 annually just for tuning. Multiply that by the number of analysts on your team, and the cost becomes substantial.

Moreover, rule tuning is not a one-time effort. Bots evolve, so rules must evolve too. This means ongoing investment in training, testing, and deployment. In contrast, behavioral AI systems learn from data and adapt automatically, reducing the need for manual rule changes.

How Behavioral AI Reduces Operational Overhead

Behavioral AI systems like BotRefund use a different approach. Instead of relying on static rules, they analyze hundreds of independent signals to build a complete picture of each visit. BotRefund uses 106 independent checks, including signals like the Empty Font Canvas and Suspicious Ports. These checks look for mismatches that a real browsing session would not normally create.

For example, the Empty Font Canvas check looks for a mismatch between a browser's reported hardware, graphics, fonts, and operating system. A virtual machine or spoofed profile might claim one device while its behavior tells another story. Similarly, the Suspicious Ports check looks for network anomalies that indicate proxy rotation or location masking.

But a single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps each signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data. This corroboration is why BotRefund claims 99% accuracy.

This approach reduces operational overhead in several ways. First, it minimizes false positives because the system requires multiple corroborating signals before flagging a session. Second, it reduces rule tuning because the AI model learns from data rather than requiring manual rule updates. Third, it automates evidence gathering. When a bot is detected, BotRefund generates a refund evidence dossier automatically, which speeds up refund claims. This is critical because recovering ad spend from Google and Meta requires proof. BotRefund's 83% refund approval rate shows how effective this can be.

Setup is also fast. BotRefund can be added to a website in about one minute, with no credit card required. This reduces integration costs and gets you protection quickly.

Building a TCO Model with a Worked Example

To make the TCO framework actionable, let's walk through a concrete example. Suppose you have an e-commerce site with 500,000 monthly visits. Your bot protection tool blocks 2% of legitimate users (false positives) and lets 5% of bots through (false negatives). You have two security analysts who spend 20% of their time on rule tuning.

First, calculate the cost of false positives. If 2% of 500,000 visits are blocked, that's 10,000 legitimate users. If your conversion rate is 2% and average order value is $100, each blocked user represents $2 in lost revenue. That's $20,000 per month in lost sales. Over a year, that's $240,000.

Next, calculate the cost of rule tuning. If each analyst earns $100,000 per year and spends 20% of their time on tuning, that's $20,000 per analyst per year, or $40,000 total.

Now, add the cost of investigating false positives. If each false positive takes 45 minutes to investigate (industry estimate), and you have 10,000 false positives per month, that's 450,000 minutes, or 7,500 hours. At $50 per hour for analyst time, that's $375,000 per month, or $4.5 million per year. That's clearly unsustainable.

But wait—not all false positives require investigation. Some are automatically resolved. Still, the point is that false positives can be extremely expensive. A behavioral AI system with 99% accuracy would reduce false positives dramatically. If the false positive rate drops to 0.1%, that's 500 blocked users per month, costing $1,000 in lost revenue. Investigation time drops to 375 hours per year, costing $18,750. Rule tuning becomes minimal, perhaps 5% of analyst time, costing $10,000. Total operational cost drops from millions to tens of thousands.

This example shows why TCO must include operational overhead. The license fee is only a small part of the total cost.

Limitations and When to Reconsider

No bot protection system is perfect. Even behavioral AI has limitations. For instance, it may struggle with highly sophisticated bots that mimic human behavior perfectly. It may also produce false positives for users with unusual setups, such as those using privacy tools or corporate networks. However, the key is to choose a system that minimizes both false positives and false negatives while keeping operational overhead low.

You should reconsider your bot protection tool when the combined cost of the license, analyst time for tuning, and lost revenue from false positives exceeds the value of the ad spend or data you are protecting. If you are spending more on managing the tool than you are losing to bots, it's time to switch.

Also, consider the cost of inaction. Bot clicks can steal up to 20% of your Google and Meta ad budget. If you are not protecting against bots, you are losing money every day. The Digitopia case study shows that recovering $18,200 is possible, but only if you have the right evidence.

Frequently Asked Questions

How much time should I budget for rule maintenance?

For traditional rule-based systems, expect to dedicate 15–20% of a security analyst's time. If you choose a behavioral AI system, this time is typically redirected toward monitoring performance rather than manual rule creation.

What is the average cost of a false positive?

While the direct labor cost is roughly 45 minutes of investigation (industry estimate), the true cost includes the lost conversion value and the potential damage to your brand's reputation with that user. In our worked example, a 2% false positive rate cost $240,000 per year in lost sales alone.

Can I automate the refund process to lower TCO?

Yes. By using systems that generate forensic evidence dossiers automatically, you reduce the time required to file and win ad platform refund claims. BotRefund's 83% refund approval rate shows that automated evidence works.

When does a bot protection tool become too expensive?

When the combined cost of the license, the analyst's time for tuning, and the lost revenue from false positives exceeds the value of the ad spend or data you are protecting. Use the TCO model above to calculate your break-even point.

How does behavioral AI achieve 99% accuracy?

By cross-checking 106 independent signals, such as Empty Font Canvas and Suspicious Ports, and using a prediction AI that weighs the complete pattern. A single anomaly is not a verdict; corroboration is key.

A honeypot field is a hidden form input that real visitors never see or interact with. Automated scripts and basic bots typically fill every input they find in the DOM, so when your server receives a submission with that field populated, you know the sender is not human. This technique adds zero friction for legitimate users, requires no third-party dependencies, and stops a significant portion of drive-by form spam.

What a honeypot field actually is

A honeypot is a decoy input — usually a text field — that you hide from human eyes using CSS. You give it a name that looks attractive to a bot, such as "email", "phone", "website", or "message", while your real fields use less obvious names or are protected by other means. Because the field is invisible, a person tabbing through the form never focuses it, and a screen reader user never hears it if you also add aria-hidden="true" and tabindex="-1". A bot that blindly posts data to every input, textarea, and select will populate it, giving you a reliable signal to discard the request.

Why this matters for form security

Form spam wastes storage, pollutes CRM data, triggers false conversion events, and can skew ad-platform optimization. CAPTCHAs and challenge-response tests stop bots but also deter real users — studies show abandonment rates around 15 percent when a CAPTCHA appears. A honeypot costs nothing, adds no user-facing step, and catches the large class of bots that do not render CSS or execute JavaScript. It is not a complete solution, but it is a high-leverage first line of defense.

Prerequisites before you start

• A form that submits to a backend you control (serverless function, traditional server, or form-handler service).
• Ability to add a field to the HTML and a check in the submission handler.
• Basic CSS to hide the field visually without using display: none or visibility: hidden on the input itself — those are easily detected by smarter bots.
• Awareness that sophisticated bots (headless browsers with full rendering, human-operated click farms) will bypass a simple honeypot.

Step-by-step implementation

1. Add the decoy field in your HTML. Place it near the top of the form so parsers encounter it first. Example: <input type="text" name="website" id="hp-website" autocomplete="off" aria-hidden="true" tabindex="-1">. Use a plausible name like "website", "url", "company", or "phone".
2. Hide it with CSS that preserves layout. Wrap the input in a <div> with a class such as .hp-wrap and apply: .hp-wrap { position: absolute; left: -9999px; opacity: 0; pointer-events: none; height: 0; overflow: hidden; }. Do not use display: none on the input itself; many bots skip inputs with that style.
3. Optionally add a time-based check. Record a timestamp when the page loads (or when the form is first focused). On submit, reject if the elapsed time is implausibly short (e.g., under 3 seconds for a multi-field form). This catches bots that post instantly.
4. Validate on the server. In your handler, check if the honeypot field has any value. If it does, return a success-like response (HTTP 200) but do not process the data, send notifications, or fire conversion pixels. Logging the attempt helps you measure bot volume.
5. Keep the real fields named unpredictably. If your real email field is named "email", a smart bot may skip the honeypot named "website" and only fill "email". Rename real fields to something like "user_email_7x" and map them back on the server.
6. Test with a real browser and a script. Submit the form manually — the honeypot stays empty, the submission succeeds. Then curl the endpoint with the honeypot filled — the request should be silently dropped.

Common mistakes that weaken the trap

• Using type="hidden" on the input — bots ignore hidden inputs by default.
• Hiding with display: none or visibility: hidden on the input itself — trivial for a headless browser to detect.
• Giving the field an obvious name like "honeypot", "bot_trap", or "hidden_field".
• Rejecting the request with a 403 or error message — that tells the bot operator the trap exists. Return 200 and discard silently.
• Relying on the honeypot alone for high-value forms (lead gen, checkout, account creation). Layer it with rate limiting, behavioral signals, and, where appropriate, a lightweight CAPTCHA.

How to verify it works

After deployment, monitor your logs for submissions where the honeypot field contains data. You should see a drop in spam entries within hours. Compare the count of dropped submissions against your previous spam volume. If you use a conversion pixel (Meta, Google Ads), confirm that the pixel does not fire for dropped requests — this prevents pixel poisoning, a problem BotRefund's behavioral auditing also addresses by suppressing conversion events for headless emulator signals.

Limitations and when to add more layers

A basic honeypot stops scripts that parse HTML and POST without rendering. It does not stop:

• Headless browsers (Puppeteer, Playwright) that execute CSS and JavaScript — they see the field is hidden and skip it.
• Human-operated click farms where real people fill forms.
• Bots that use computer vision or accessibility-tree inspection to detect invisible fields.

For those cases, combine the honeypot with client-side behavioral telemetry (mouse movement, scroll depth, keystroke timing), IP reputation, and server-side fingerprinting. BotRefund's platform, for example, watches for honeypot trap interactions alongside pointer behavior, motion behavior, and superhuman input speed to identify automated traffic that bypasses simple traps.

Key facts

Terminology quick reference

• Honeypot field — A decoy form input hidden from humans but visible to bots in the DOM.
• Pixel poisoning — When bot conversions fire tracking pixels, teaching ad platforms to optimize for non-human traffic.
• Headless browser — A browser runtime (e.g., Puppeteer, Playwright) that renders pages without a GUI, used for automation.
• Click farm — Low-cost labor or device farms that manually click ads and fill forms to simulate engagement.
• Residential proxy botnet — Malware on consumer devices that routes bot traffic through legitimate residential IPs.

FAQ

Does a honeypot field affect accessibility?

Not if you add aria-hidden="true" and tabindex="-1" to the input. Screen readers will skip it, and keyboard users will not tab into it. The wrapping div with absolute positioning keeps it out of visual flow without removing it from the DOM.

Can I use multiple honeypot fields?

Yes. Two or three fields with different names (e.g., "website", "fax", "company_size") catch bots that have learned to skip one specific field name. Each adds negligible overhead.

What if a real user has autofill that populates the honeypot?

Autofill typically targets fields with standard autocomplete values like "email", "tel", "address". Set autocomplete="off" on the honeypot and give it a name that browsers don't associate with stored profiles (e.g., "website_url_hp").

How does this differ from a CAPTCHA?

A CAPTCHA challenges the user to prove humanity; a honeypot silently observes behavior. Honeypots have zero user friction but catch fewer sophisticated bots. CAPTCHAs catch more but increase abandonment. Use both for high-value forms.

Will a honeypot stop spam from my CRM or marketing automation?

No. If spam originates from API submissions directly to your CRM (bypassing your form), the honeypot never sees the request. Secure your API endpoints with authentication and rate limits.

Can I use a honeypot with form builders like HubSpot, Marketo, or Typeform?

Some form builders let you add custom HTML fields and run server-side validation via webhooks. Check the platform's documentation for "hidden field" or "custom validation" support. If you cannot run a server-side check, the honeypot cannot reject submissions.

What should I compare when evaluating bot protection?

Compare setup effort (code vs. no-code), false-positive rate, impact on conversion rate, ability to recover ad spend from platforms, and whether the solution provides evidence for refund claims. BotRefund adds behavioral telemetry, refund-report generation, and direct negotiation with Google and Meta — capabilities a simple honeypot cannot provide.

Learn more about this service

See how this page can help with your next step.

Learn more

How to Access the Evidence Portal in Your BotRefund Affiliate Dashboard

Why Bot Traffic Poisons Your Ad Algorithms

Google Ads relies on machine learning to find buyers. The system watches which clicks turn into conversions. It then bids more aggressively for users who look like those converters. When automated scripts or click farms trigger form submissions or checkout events, the algorithm receives false positive feedback. It learns that low-intent profiles are valuable. Your cost per acquisition rises. Your return on ad spend drops. You start paying for traffic that never actually buys.

This process is called optimization poisoning. It happens silently. Dashboards still show green arrows. Click volume stays high. But your CRM fills with unreachable emails, bounced phone numbers, or dummy accounts. The damage compounds quickly because early contamination locks the model into a bad trajectory. Once the algorithm optimizes for bots, it takes weeks of manual tuning to correct course.

You cannot fix poisoned campaigns by simply lowering bids. You must stop the fake signals at the source. That requires a layered filter strategy. Platform settings block obvious traffic. Tracking adjustments remove ambiguous sessions. Behavioral verification catches sophisticated headless browsers. Together, these layers keep your conversion data clean.

Prerequisites Before You Start Filtering

• Admin access to your Google Ads account and campaign settings.
• Access to your landing page content management system or web server.
• A working Google Analytics 4 property linked to Google Ads.
• Server-side Google Tag Manager configured, or a reliable third-party tracking pixel manager.
• Clean conversion action definitions in Google Ads. Remove duplicate or overlapping tracking tags before adding filters.

Do not add new filters while running major creative tests. Algorithmic models need stable data. If you change targeting, bidding, or tracking simultaneously, you will confuse the system. Pause non-essential experiments first. Document your current baseline metrics. Record your average cost per click, conversion rate, and cost per acquisition. You will need these numbers to verify that your filters actually improve quality without killing volume.

Step-by-Step: Implementing Platform-Level Filters

1. Exclude known invalid IP ranges. Go to Settings > Placements. Review your display network placements. Remove any domains that generate high bounce rates or zero engagement. For search campaigns, export your IP logs from Google Ads. Block IP addresses that repeatedly submit forms without scrolling or reading content. Use the IP exclusion list under Account Settings.
2. Restrict device and location targeting. Bots often originate from specific regions or virtual private networks. Narrow your geographic targeting to actual service areas. Exclude devices that rarely convert if your business relies on desktop workflows. Keep mobile only if your funnel is built for it.
3. Add negative keywords and audience exclusions. Search terms reveal intent. Add exact match negatives for spam triggers like “free,” “download,” “crack,” or “test account.” Exclude remarketing lists that overlap with low-quality traffic sources. Remove broad match modifiers until you have enough clean conversion data.
4. Enable bot filtering in Google Analytics. Navigate to Admin > Data Streams. Turn on “Exclude all hits from known bots” in your GA4 stream settings. This removes crawler traffic from your reports. It does not stop paid bot clicks, but it keeps your organic and cross-channel dashboards accurate.

Platform filters catch obvious threats. They also block legitimate users occasionally. Test each exclusion in a separate campaign or ad group. Monitor performance for seven days before applying changes globally. Adjust thresholds based on your industry norms. B2B software companies tolerate stricter filters than e-commerce stores.

Step-by-Step: Setting Up Tracking & Behavioral Suppression

Platform settings alone cannot stop modern automation tools. Headless browsers mimic mouse movements, scroll depth, and tab switches. They pass basic CAPTCHAs and load pages normally. To stop them, you must filter behavior at the tracking layer.

1. Install client-side behavioral telemetry. Deploy a lightweight script on your landing pages. The script records pointer jitter, keypress timing, viewport changes, and hardware rendering profiles. Legitimate humans leave irregular patterns. Scripts run at fixed intervals with perfect precision. The difference is measurable.
2. Configure real-time pixel suppression. Connect the telemetry tool to your conversion pixels. When the system flags a session as automated, it stops sending conversion events to Google Ads and Meta. The click still registers. The budget still spends. But the algorithm never receives the false positive signal.
3. Route suspicious sessions to a quarantine bucket. Do not delete flagged traffic immediately. Send it to a separate analytics view or database. Review the forensic logs weekly. Look for recurring patterns like identical GCLID prefixes, missing GPU signatures, or VPN exit nodes. Use these patterns to refine your exclusion lists.
4. Submit proof logs to ad platform reviewers. Most platforms do not auto-refund bot spend. You must file manual disputes. Export your forensic evidence. Format it as a compliance-ready report. Attach session recordings, click IDs, and behavioral timestamps. Submit the package through the Google Ads help center or your account manager portal.

This approach shifts your defense from reactive to proactive. You stop poisoning before it reaches the model. You also create an audit trail for budget recovery. Over time, your campaigns stabilize. Conversion rates rise. Cost per acquisition falls. The algorithm retrains on human behavior instead of synthetic noise.

How to Verify Your Filters Are Working

Verification prevents guesswork. Run this checklist every fourteen days after implementation.

• Check your conversion attribution window. Ensure delayed conversions still track correctly. Suppression scripts sometimes delay server responses.
• Compare bounce rates across placements. A sudden drop in bounce rate usually means cleaner traffic. A spike means you blocked too much.
• Review your top converting audiences. They should align with your ideal customer profile. If you see unexpected demographics or foreign locations, tighten your geo and device filters.
• Monitor your cost per lead trend. It should decline gradually. Sharp drops often indicate broken tracking, not better quality.
• Run a manual click simulation. Use a real browser on a residential connection. Complete your conversion flow. Confirm the event fires in Google Ads within five minutes.

If any metric moves in the wrong direction, roll back the last change. Isolate variables one at a time. Bot filtering is iterative. You will fine-tune thresholds as your campaign matures.

Key Facts About Bot Detection & Refunds

Each layer solves a different problem. Combine them to cover blind spots. Relying on a single method leaves gaps that bots exploit.

Limitations & When Standard Filters Fall Short

No filter catches everything. Some limitations are unavoidable.

False positives happen. Strict behavioral rules may block slow typists, screen reader users, or visitors on unstable connections. Always keep a whitelist for internal teams and verified partners.

Platform updates break tracking. Google and Meta frequently change pixel architectures. Server-side migrations can temporarily pause suppression. Test after every major platform release.

Refunds are not automatic. Ad networks rarely credit bot spend without documented proof. Manual disputes take thirty to sixty days. Budget recovery depends on your account history and dispute success rate.

Early-stage campaigns struggle. New ads lack conversion data. Machine learning explores broadly. Bot traffic looks similar to exploratory clicks during this phase. Wait until you hit fifty conversions before applying aggressive filters.

Accept these constraints. Focus on reducing exposure rather than achieving perfection. Clean data beats perfect data when it comes to long-term algorithmic health.

Frequently Asked Questions

Can I add a single bot filter switch inside Google Ads?

No. Google Ads does not offer a native toggle for advanced bot filtering. You must combine platform exclusions with external tracking controls. Third-party behavioral tools fill the gap left by default settings.

Will blocking bots hurt my campaign volume?

Volume may drop slightly at first. That is normal. You are removing low-quality clicks. True demand remains intact. Quality scores usually improve within two weeks as the algorithm retrains.

How much does bot filtering cost?

Platform exclusions are free. Server-side tracking setup requires developer time. Forensic detection tools typically charge a percentage of recovered spend or a flat monthly fee. Free audits exist to test compatibility before committing.

Do bot filters work on Performance Max campaigns?

Yes, but with restrictions. Performance Max uses automated placements. You cannot manually exclude every domain. Focus on IP blocks, audience exclusions, and behavioral suppression on your landing pages. These measures still protect your conversion signals.

How long does it take to recover wasted ad spend?

Budget recovery depends on dispute processing times. Expect thirty to ninety days after submitting forensic logs. Prevention works faster. Stopping fake conversions early saves money immediately.

Should I filter bots on organic traffic too?

Organic bot traffic does not waste ad budgets. It skews analytics instead. Apply basic crawler exclusions in GA4. Reserve heavy behavioral filtering for paid landing pages where conversion costs matter.

What happens if I ignore bot traffic entirely?

Your algorithm learns incorrect patterns. Costs rise. Conversion rates fall. You chase synthetic profiles instead of real buyers. Campaigns become unpredictable. Recovery requires rebuilding audiences and retraining models from scratch.

Adding BotRefund protection to a website with a custom domain is a quick, step-by-step process. You sign up, add a small snippet of JavaScript to your site, and verify it's working. The setup takes about one minute and requires no credit card. Custom domains work the same as any other domain because the protection runs in the visitor's browser via the snippet.

Before You Start: Prerequisites

Make sure you have these ready before you begin:

• A custom domain pointing to your website (for example, yoursite.com).
• Access to your website's HTML files or a tag manager like Google Tag Manager.
• A BotRefund account – you can create one for free.
• Optionally, an active Google Ads or Meta Ads account if you want to start recovering refunds later.

No DNS changes are required for the protection script itself. BotRefund works by adding a script that runs on your pages, regardless of how your domain is configured.

Step-by-Step: Add BotRefund to Your Custom Domain

Step 1: Create a BotRefund Account

Go to BotRefund's website and sign up. You'll need to provide basic details about your website and your ad spend. No credit card is required to start.

Step 2: Get Your Script Snippet

After signing up, you'll find a tracking or protection snippet in your dashboard. This is a small piece of JavaScript that BotRefund provides. Copy it exactly as shown.

Step 3: Add the Snippet to Your Website

Paste the snippet into your website's HTML. The best place is before the closing </head> tag or just before the </body> tag. If you use a CMS like WordPress, you can add it via a plugin, theme editor, or a tag manager. If you have multiple pages, add it to the global template or every page you want to protect.

Step 4: Publish and Clear Cache

Save the change and publish your site. If you use a caching plugin or CDN, clear the cache to ensure the snippet is served to visitors.

Step 5: Verify Installation

Run a quick test by opening your site in a private browser window and checking the BotRefund dashboard. You should see a “protection active” status. Alternatively, use the free bot audit to confirm the script is captured.

How BotRefund Protection Works on Your Site

BotRefund uses a combination of behavioral checks, browser fingerprinting, and AI to distinguish human visitors from automated bots. According to the source, it uses 106 independent checks to build a reliable picture of whether a visit is human or automated. These checks include factors like mouse movement patterns, tab speed, CPU concurrency, and more. The system cross-checks signals and uses AI prediction to avoid false positives, claiming 99% accuracy.

For a custom domain, the script runs exactly as it would on any other domain. It collects signals from each visitor's browser and sends them to BotRefund's servers for analysis. If a bot is detected, BotRefund can block it or collect evidence for refund claims.

Custom Domains vs. Subdomains and Hosted Pages

Custom domains are handled exactly like any other domain. There is no special configuration required. If you run multiple subdomains (for example, blog.yourdomain.com), you'll need to add the snippet to each subdomain separately because scripts don't automatically carry over. The same applies if you use a platform that serves pages from a different domain (like a landing page builder).

No DNS changes are needed for the protection script. BotRefund does not require you to point any records to their servers. The script simply talks to their API over HTTPS.

Common Mistakes to Avoid

• Placing the snippet in the wrong file. Make sure it's on the live page that visitors actually load, not just in a template that isn't used.
• Forgetting to clear cache. If your site uses aggressive caching, you might not see the script load until the cache is purged.
• Blocking the script with a Content Security Policy (CSP). If your site has strict CSP rules, you may need to allow BotRefund's domain in the policy.
• Using a tag manager incorrectly. If you use Google Tag Manager, ensure the snippet fires on all relevant pages and isn't delayed by triggers.

How to Verify the Protection Is Active

The easiest way is to visit your site in a private browser window and then check your BotRefund dashboard for real-time activity. You can also use the free bot audit BotRefund offers—it will show you if the script is detected and list suspicious sessions. The source pack mentions that a free bot audit is part of the setup process, so you can run it right after adding the snippet.

If you see no data after a few minutes, double-check the placement of the snippet and clear any caches.

Key Facts About BotRefund

Limitations and When BotRefund Might Not Cover You

BotRefund focuses on detecting invalid traffic on Google and Meta ad campaigns. If you run ads on other platforms, it may not provide the same refund recovery support. Additionally, the script cannot block bots that never execute JavaScript—for example, very primitive scrapers that don't render the page. However, those are unlikely to click ads.

If your website has an extremely strict Content Security Policy, you might need to whitelist BotRefund's script source. Also, if you use a service like Cloudflare that already provides bot management, you might have overlapping features—but BotRefund's value is the evidence and refund negotiation.

FAQ

Can I use BotRefund on a custom domain with a subdomain?

Yes. Add the snippet to each subdomain or page that you want to protect. The protection does not automatically extend to subdomains.

Do I need to change my DNS settings?

No. BotRefund does not require DNS changes. The script runs client-side and talks to their servers over HTTPS.

How long does setup actually take?

About one minute, according to the source pack. Adding the snippet to a static HTML file or via a tag manager is fast.

Do I need a credit card?

No. You can start without a credit card and even run a free bot audit.

Will BotRefund work if my site uses a CDN or proxy?

Yes. As long as the script is served to visitors, it will work. You may need to ensure the script is not blocked by your CDN's firewall rules.

What if I have multiple domains?

You can add the same snippet to each domain. BotRefund's dashboard likely lets you manage multiple sites under one account.

Final Check: Confirm Everything Is Set

Once you've added the snippet and verified it, you're done. Your custom domain now has BotRefund protection. Next, consider running the free bot audit to see how much invalid traffic you're already getting and what you might recover.

Yes, you can add BotRefund protection to a website that uses a CDN. BotRefund is a client-side script that runs in the visitor's browser. A CDN serves your static files and does not block the script. You just need to get the script onto your pages. This guide covers the exact steps.

Prerequisites for Adding BotRefund with a CDN

Before you start, make sure you have:

• A BotRefund account. You can create one for free and get a free bot audit.
• Access to your site's HTML or a tag manager like Google Tag Manager.
• A CDN that allows third-party scripts. Most do by default.
• If you use a Content Security Policy (CSP), you'll need to allow BotRefund's domain.

You also need the ability to edit your site's global templates. Most sites use a header or footer that appears on every page. That is the easiest place to add the script.

How BotRefund Works Behind a CDN

BotRefund uses 106 independent checks to build a reliable picture of whether a visit is human or automated. These checks cover hardware, graphics, fonts, audio, browser behavior, network patterns, and user interaction.

The script runs entirely in the browser. It does not need server-side access. The CDN only delivers your HTML, CSS, and JavaScript. It does not interfere with the BotRefund script unless you have a firewall or security rule that blocks external requests.

BotRefund's detection engine cross-checks all signals. It looks for mismatches that a real browsing session would not normally create. For example, the CPU Concurrency Lie check looks for a device that claims one hardware profile but behaves like a virtual machine. The window.open Tamper check looks for scripted clicks that lack natural human timing. The Impossible Tab Speed check flags actions that happen faster than any person could perform.

The AI model weighs the complete pattern. A single anomaly is not a bot verdict. Privacy tools, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund only flags a visit as a bot when multiple independent signals agree.

This is why the company claims 99% accuracy. Accuracy comes from corroboration, not a single browser tell.

When you use a CDN, the script is loaded from your domain or from BotRefund's domain. If you load it from your own domain, you must ensure the CDN serves that file. If you load it from BotRefund's domain, the CDN has no effect on delivery.

Step-by-Step: Adding the BotRefund Script

There are three main ways to add BotRefund to your site:

1. Direct HTML injection in your global header or footer.
2. Tag manager, such as Google Tag Manager.
3. CDN edge rules that inject the script into every HTML response.

Method 1: Direct HTML Injection

Log into your BotRefund account and copy the provided JavaScript snippet. Then paste it into your site's global header or footer. This is the simplest method. It works for any CDN because the script is part of the HTML.

Make sure you paste it before the closing tag. This ensures the script does not block page rendering.

Method 2: Tag Manager

If you use Google Tag Manager, create a new custom HTML tag. Paste the BotRefund script inside the tag. Set the trigger to fire on all pages. Publish the container.

Tag managers load the script asynchronously. That works fine with BotRefund. The script will run after the page loads, which is all that is needed.

Method 3: CDN Edge Rules

If you cannot edit HTML directly, use your CDN's edge capabilities. Many CDNs allow you to modify responses at the edge. You can insert the script into every HTML response without touching your origin files. This is useful for sites with multiple page templates or when you want to manage the script centrally.

Using CDN Edge Rules to Inject the Script

Let's look at two popular CDNs: Cloudflare and AWS CloudFront.

Cloudflare Workers

Cloudflare Workers let you run JavaScript at the edge. You can add a worker that intercepts HTML responses and injects the BotRefund script.

Here is a simple Worker script that appends the BotRefund snippet to the tag of every HTML page:

addEventListener("fetch", event => {
  event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
  const response = await fetch(request);
  const contentType = response.headers.get("content-type") || "";
  if (!contentType.includes("text/html")) {
    return response;
  }
  let html = await response.text();
  const botRefundScript = `<script src="https://botrefund.com/script.js"></script>`;
  html = html.replace("</body>", botRefundScript + "</body>");
  return new Response(html, {
    headers: response.headers
  });
}

This worker runs on every request. It checks if the response is HTML. If so, it replaces the closing body tag with the script and the tag. You need to change the script URL to your actual BotRefund snippet.

Deploy this worker to your zone. Then all HTML pages will include the script.

AWS CloudFront Lambda@Edge

Amazon CloudFront integrates with Lambda@Edge. You can attach a Lambda function to the origin response event. This function can modify the HTML before it is returned to the viewer.

Here is a Lambda function that injects the BotRefund script:

exports.handler = (event, context, callback) => {
  const response = event.Records[0].cf.response;
  const headers = response.headers;
  const contentTypeHeader = headers["content-type"];
  if (contentTypeHeader && contentTypeHeader[0].value.includes("text/html")) {
    const body = response.body;
    const botRefundScript = "<script src='https://botrefund.com/script.js'></script>";
    response.body = body.replace("</body>", botRefundScript + "</body>");
  }
  callback(null, response);
};

You must create a Lambda function in the us-east-1 region. Then associate it with a CloudFront distribution as an origin response trigger. The function runs for every request and modifies the HTML response.

Other CDNs have similar features. For example, Fastly offers VCL transforms, and Akamai has EdgeWorkers. The concept is the same: intercept the response and insert the script.

Free Bot Audit: What to Expect

BotRefund offers a free bot audit. No credit card is required. The audit is designed to show you how much of your ad budget is being wasted on bot clicks.

Here is the process:

1. Sign up for a BotRefund account on their website.
2. Add the BotRefund script to your site, using any of the methods above.
3. After the script is live, request the free audit. You will be asked about your ad spend. You can select a range or enter an exact amount.
4. BotRefund schedules a call with you. On the call, they run a live bot audit of your site. They use their detection engine to analyze recent traffic and identify bot visits.
5. You receive a report showing bot clicks, their sources, and the potential refund amount.

The audit also includes video proof for each detected bot click. You can use this evidence to file a refund claim with Google or Meta. BotRefund claims it can recover refunds for Google Ads spend dating back to 2017.

The audit is not automated. A representative works with you to interpret the results. They also explain how BotRefund's detection works and what you can do next.

If you have high ad spend, they may offer an enterprise plan with more features. But the audit itself is free.

Troubleshooting and Common Mistakes

Even after adding the script, you may run into issues. Here are common problems and how to fix them.

The script does not load

Check your browser's Network tab. Confirm that the BotRefund script URL appears and returns a 200 status. If it returns a 403 or 404, check your CSP and firewall rules.

If you use a WAF, allowlist BotRefund's domain. Some web application firewalls block unknown external scripts.

The script loads but no detection happens

Make sure the script is on every page you want to protect. It only runs where it is present. Add it to your global header or footer to cover all pages.

CSP blocks the script

If you have a Content Security Policy, add BotRefund's domain to the script-src directive. For example:

script-src 'self' https://botrefund.com;

Also allow the connect-src if the script makes requests to BotRefund's API.

CDN caches old HTML without the script

If your CDN caches HTML, the cached version may not include the script. Clear the cache for your HTML pages. Or, configure the CDN to skip caching for HTML or to include the script in the cached version by purging after adding the script.

Plugin or extension conflicts

Some browser extensions or ad blockers might interfere with the script. Test in a normal browser profile with extensions disabled. If the script works there, it is likely an extension issue.

Cloudflare Workers or Lambda@Edge not working

Check the function logs. In Cloudflare, view the worker's real-time logs. In AWS, check CloudWatch logs for the Lambda function. Ensure the content-type check matches exactly. Some responses have text/html; charset=utf-8. The code above works for that.

Also ensure the script URL is correct. You must use the actual snippet from your BotRefund account, not the placeholder in the example.

Limitations and Considerations

BotRefund runs in the browser. It cannot detect server-side bot requests that do not load JavaScript. If a bot does not execute JavaScript, the script never runs. This is a fundamental limitation.

For protection against server-side scraping or non-JS bots, you need additional network-level controls. You can use your CDN's bot management features. For example, Cloudflare Bot Fight Mode or AWS WAF Bot Control. These work at the edge and block requests before they reach your origin.

BotRefund focuses on ad click fraud. It detects bots that click your ads and then visit your site. This is different from general bot traffic.

The script requires JavaScript to be enabled in the visitor's browser. Most real users have JavaScript enabled. But some privacy-conscious users may disable it. You will not detect those visits.

BotRefund's accuracy claims are based on its own testing. You should evaluate the service with your own data. The free audit is a good way to start.

FAQ

Will a CDN block BotRefund?

Usually not. A CDN serves your static files and does not interfere with scripts loaded from another domain. However, if your CDN has a firewall that blocks external scripts, you need to allowlist BotRefund's domain.

Can I use my CDN's built-in bot protection instead?

Yes, but it is a different tool. CDN bot protection typically blocks malicious traffic at the edge. BotRefund focuses on detecting invalid ad clicks and helping you get refunds. You can use both.

How long does it take to set up?

BotRefund says adding it to your website takes about one minute. You will need to copy the script and paste it into your site. If you use CDN edge rules, it may take longer to configure.

Do I need to add the script to every page?

Yes, if you want full coverage. Most sites add it to a global header or footer so it appears on every page automatically.

What if I cannot edit my HTML?

Use a tag manager like Google Tag Manager, or use your CDN's edge injection features. This avoids changing your source files.

Does BotRefund work with any CDN?

It works with any CDN because it is a client-side script. As long as you can load the script on your pages, it will work. The edge injection method varies by CDN, but you can always fall back to direct HTML or tag manager.

Next Steps

Now you know how to add BotRefund to a CDN-based site. Start with a free bot audit to see how much of your ad budget is being wasted on bot clicks. Then choose the integration method that fits your workflow.

If you need help, BotRefund offers support and enterprise sales. You can also check your CDN's documentation for edge injection details.

To reduce false positives on suspicious ports, you should move away from global blocking rules and implement more granular, port-specific thresholds. This involves lowering the sensitivity score for known legitimate traffic, increasing rate limits for those specific ports, and using behavioral signals—like mouse movement and keypress timing—rather than relying solely on the port number itself.

Standard security systems often flag non-standard or 'suspicious' ports because they are historically associated with command-and-control traffic. By tuning your detection engine to correlate multiple signals, you can allow legitimate traffic to pass without exposing your network to actual bots.

Step 1: Identify and Baseline Affected Traffic

Before changing any settings, you must confirm which traffic is being incorrectly flagged. Review your security logs to identify the specific ports triggering the false positives. Look for patterns: is the traffic coming from a known IP range, a specific browser type, or a consistent time of day?

Document the 'normal' behavior for these ports. If a legitimate API or a custom internal tool is using a high-numbered port, note its request frequency and typical payload size.

Step 2: Implement Port-Specific Rule Overrides

Instead of lowering the security threshold for your entire network, create an exception specifically for the suspicious ports you identified. This allows you to maintain high security on standard ports while providing 'breathing room' for the ports causing issues.

In your bot detection software, create a rule that targets the specific port number. For example, if port 8443 is being flagged incorrectly, set a rule that requires a higher 'bot score' before a block is triggered on that port.

Step 3: Adjust Rate Limits and Sensitivity Thresholds

Many false positives occur because the default rate limit is too aggressive. If a legitimate service makes a burst of requests on a suspicious port, it might trigger a bot alert.

Increase the allowed number of requests per minute for these specific ports. Additionally, adjust the sensitivity threshold. If your system flags anything at a score of 70, consider raising it to 90 for those specific ports to ensure only highly probable automated traffic is blocked.

Step 4: Shift to Behavioral Telemetry

The most effective way to reduce false positives is to look at how the user interacts rather than where they are connecting. Humans exhibit jitter in movement, varying typing speeds, and natural scrolling.

Ensure your detection tool is configured to weigh behavioral signals more heavily than port signatures. If a session on a suspicious port shows human-like mouse coordinates and keypress offsets, the system should not flag it as a bot, regardless of the port used.

Step 5: Monitor and Iteratively Tune

Once you apply the new thresholds, monitor your logs in 'log only' or 'learning' mode if possible. Check if the legitimate traffic you identified is now passing through and if actual bots are still slipping by.

If false positives persist, slightly increase the rate limit. If you see new bot activity, tighten the threshold or add a secondary requirement, such as a specific browser fingerprint check.

Verification Step

To verify the fix, trigger a known legitimate request from the suspicious port and confirm it is not blocked. Then, perform a simulated bot attack on that same port to ensure the system still identifies and blocks the automated traffic.

Why Port Detection Sensitivity Matters

Modern web applications often use non-standard ports for APIs, internal management tools, or legacy services. If your bot detection is too rigid, these critical business functions will fail, leading to broken integrations and 'shadow IT' where users find ways to bypass security just to get work done.

Ignoring this issue leads to 'alert fatigue.' When security teams are constantly bombarded with false positives, they may eventually ignore a genuine breach occurring on one of those ports. Tuning your thresholds ensures that when an alert does fire, it is treated with the necessary urgency.

The Mechanics of Bot Detection Signals

Most bot detection platforms work on a scoring system. Each signal—such as the IP reputation, the browser fingerprint, or the port used—adds points to a total score. A 'suspicious port' might add 30 points. If that exceeds your threshold, the user is blocked.

Advanced systems like BotRefund use corroboration to prevent false positives. For example, a bot might spoof its port and its location, but it cannot easily simulate the hardware rendering profiles or the millisecond-level timing of clicks. By weighing 110+ signals together, the system can distinguish between a sophisticated scraper and a human user.

Comparison of Detection Strategies

Choose Static Port Blocking only if you are in a closed environment where no legitimate traffic should ever use those ports.

Choose Threshold Tuning if you have specific applications that are frequently interrupted but you want to maintain high overall security.

Choose Behavioral Telemetry for high-traffic sites where blocking even a few real customers results in significant lost revenue.

Practical Scenarios

Scenario A: A SaaS company uses a custom port for its API. The bot detection flags the high-volume API traffic as a scraper. Solution: Implement a port-specific rule that increases rate limits and requires a valid API key signature, bypassing the behavioral bot score.

Scenario B: A marketing team uses a non-standard port for tracking pixels. The system blocks the team's IP. Solution: Lower the sensitivity threshold for the specific IP range associated with the marketing office while maintaining strict human-like browser telemetry for all other visitors.

Limitations and Exceptions

Tuning thresholds does not help if the bot is perfectly mimicking human behavior. If a bot uses a headless browser to simulate mouse movements and timing perfectly, no amount of threshold tuning will stop it. Additionally, this advice does not apply to low-level network attacks (like DDoS), which should be handled at the firewall or CDN level rather than the bot detection layer.

Frequently Asked Questions

Why Server Logs Reveal What Analytics Misses

Client-side analytics (Google Analytics, Meta Pixel, Mixpanel) only fire when a browser loads your page and executes JavaScript. Bots that run headless Chrome, Puppeteer, or simple curl scripts often skip asset downloads entirely, so they leave no trace in your dashboard. Your access logs, however, record every HTTP request the server receives — including the ones that never trigger a pixel.

The gap is practical: a campaign can show 10,000 clicks in Ads Manager while your CRM sees zero qualified leads. The logs will show whether those 10,000 visits actually requested stylesheets, images, and API endpoints, or whether they stopped at the HTML response.

Prerequisites: Log Access and Format Basics

Before you can hunt patterns, you need raw logs in a consistent format. Most hosting environments give you one of three paths:

• Nginx / Apache on a VM: /var/log/nginx/access.log or /var/log/apache2/access.log. Default combined format includes IP, timestamp, request line, status, bytes, referrer, and user-agent.
• Managed platforms (Vercel, Netlify, Cloudflare, AWS ALB): Enable log streaming to S3, CloudWatch, Datadog, or a SIEM. Cloudflare calls this "Logpush"; AWS calls it "Access Logs" for ALB/CloudFront.
• Containerized apps (Kubernetes, ECS, Cloud Run): Sidecar log shippers (Fluent Bit, Vector, Datadog Agent) forward stdout/stderr to your log store.

Normalize to a common schema: timestamp, client_ip, method, path, status, bytes, referrer, user_agent, request_time, upstream_response_time. If your CDN adds cf-ray or x-forwarded-for, keep those fields — they help correlate later.

Step-by-Step Log Analysis Process

1. Collect a representative window. Pull 24–72 hours of logs covering the campaign period you suspect. Compress, download, and load into a queryable tool (see Tools section).
2. Deduplicate by session. Group by client_ip + user_agent + 30-minute activity windows. This turns raw lines into "visits" you can reason about.
3. Flag the four core anomalies. Run the queries below (SQL, awk, or your log platform's query language). Each row returned is a candidate bot session.
4. Enrich with threat intel. Cross-reference flagged IPs against AbuseIPDB, GreyNoise, or your CDN's bot management feed. Residential proxy exits often appear clean in reputation lists — treat reputation as a signal, not a verdict.
5. Correlate with ad platform click IDs. If you capture gclid, fbclid, or msclkid in your logs (via query params or cookies), join flagged sessions to the exact paid clicks. This is the evidence chain refund teams require.
6. Export a dispute packet. For each ad platform, prepare a CSV: click ID, timestamp, IP, user-agent, anomaly flags, and a one-line reason (e.g., "HEAD-only, 12 ms dwell, no asset requests").

Key Suspicious Patterns to Hunt For

1. Missing or Spoofed Referrers

Legitimate ad clicks carry a referrer from the ad network (e.g., https://www.google.com/, https://www.facebook.com/). Bots often send -" (direct) or a generic homepage. Query: WHERE referrer = '-' OR referrer NOT LIKE '%google.%' AND referrer NOT LIKE '%facebook.%' AND referrer NOT LIKE '%t.co%'.

2. Identical User-Agents Across Diverse IPs

A single Chrome version string appearing on 50+ unrelated IPs in one hour is a hallmark of a botnet rotating residential proxies. Query: SELECT user_agent, COUNT(DISTINCT client_ip) AS ip_count FROM visits GROUP BY user_agent HAVING ip_count > 20.

3. Sub-200 ms Request Intervals

Humans cannot click, wait for HTML, parse, and click again in under 200 ms consistently. Measure request_time deltas per session. Query: WHERE LAG(timestamp) OVER (PARTITION BY session_id ORDER BY timestamp) < 200.

4. HEAD-Only or Asset-Free Sessions

Real browsers fetch CSS, JS, fonts, and images. Bots that only want to trigger a conversion pixel often send HEAD /landing-page or GET /landing-page with Accept: text/html and never request /static/*. Query: WHERE NOT EXISTS (SELECT 1 FROM logs l2 WHERE l2.session_id = l1.session_id AND l2.path LIKE '/static/%').

5. Automated Browser Fingerprints

Headless Chrome, Puppeteer, Playwright, and Selenium leak telltale signals: navigator.webdriver=true, missing chrome.runtime, consistent viewport sizes, zero plugin list. These appear in client-side telemetry, but you can infer them server-side when the same IP+UA combo shows perfect, repeatable request ordering across thousands of sessions. BotRefund's detection uses "106 behavioral & environmental signals" including these fingerprints to identify automated browsers in real time (S8).

Tools and Automation Options

For a 5-minute start: zcat access.log.gz | goaccess --log-format=COMBINED -o report.html. Open report.html and check the "Request Time" and "User Agents" panels.

Common Mistakes and How to Verify Findings

• Mistake: Blocking IPs after one anomaly. Fix: Require ≥ 3 independent flags (e.g., missing referrer + sub-200 ms + no assets) before suppressing a conversion pixel or filing a refund claim.
• Mistake: Trusting CDN "bot score" alone. Fix: CDN scores miss residential proxy bots that use real Chrome on real devices. Always layer your own behavioral checks.
• Mistake: Ignoring x-forwarded-for chains. Fix: Parse the left-most original client IP; the right-most is your load balancer.
• Verification step: Replay a flagged session's request sequence in a real browser (copy headers via curl). If the page loads normally and fires your analytics, the session was likely human — your heuristic was too aggressive.

Limitations of Log-Only Analysis

Logs cannot see what happens inside the browser after the HTML arrives: mouse movement, scroll depth, keystroke timing, canvas fingerprint, or WebGL renderer. They also miss encrypted payloads (POST bodies) unless you log them explicitly — which raises PII concerns. For full behavioral proof, you need client-side telemetry. BotRefund adds "110+ forensic signals" via a lightweight script that captures millisecond keypress offsets, pointer jitter, and hardware rendering profiles (S2, S5). The trade-off: logs are free and retroactive; client-side telemetry requires a code deploy but catches bots that perfectly mimic HTTP patterns.

Key Facts

FAQ

How far back can I claim ad refunds?

Google and Meta generally limit billing disputes to the past 60 days (S6). Pull logs at least weekly to stay within the window.

Do I need to log request bodies to catch bots?

Not for the patterns above. Method, path, headers, timing, and IP are sufficient. Logging bodies adds PII risk and storage cost.

Can Cloudflare Bot Management replace this analysis?

It blocks known bad actors, but sophisticated residential proxy bots with real Chrome fingerprints often pass. Use Cloudflare as a first layer; your log analysis catches what slips through.

What if my hosting provider doesn't give raw logs?

Enable log streaming to an S3 bucket or CloudWatch (AWS), Logpush (Cloudflare), or the equivalent on your platform. If they refuse, consider a reverse proxy (Cloudflare free tier, NGINX on a small VM) in front of your app.

How do I prove a session was a bot to Google/Meta?

Submit the click ID (GCLID/FBCLID), timestamp, IP, user-agent, and your anomaly flags (missing referrer, no assets, sub-200 ms intervals). BotRefund automates this packet creation and achieves an 83% approval rate (S2).

Will analyzing logs slow down my site?

No. Logs are written asynchronously. Analysis runs offline on exported files.

What's the difference between a scraper and a click-fraud bot?

Scrapers crawl content (pricing, inventory) and rarely trigger conversion pixels. Click-fraud bots deliberately click ads and often fire conversion events to poison pixel data. Both show HEAD-only, asset-free patterns; click-fraud bots additionally carry ad click IDs.

What a Denial Means and What to Do First

A denied Meta Audience Network refund claim means Meta reviewed your initial request and found insufficient evidence, a missed deadline, or a policy mismatch. The response is usually a notification in Ads Manager or an email with a reason code.

Before you resubmit, open that notification and copy the exact reason. Meta rarely explains the full gap in one line, so you will often need to request the detailed denial rationale in writing.

Most denied claims fail for three reasons: missing server-side logs, filing outside the allowed window, or evidence that only shows client-side data like Google Analytics. Your appeal should address each gap with new, platform-specific proof.

Why Meta Audience Network Appeals Are Harder

Meta Audience Network placements run on third-party apps and websites. This makes traffic harder to verify than in-feed Facebook impressions. The third-party nature means you do not control the publisher environment where the click happened.

Sources show that non-human traffic consistently consumes 15% to 25% of paid advertising budgets. Automated scrapers, rival click rings, and low-quality publisher networks click social ads and drain daily campaign caps.

Audience Network placements have historically shown high click-through rates and near-instant bounce rates. This pattern signals bot activity. Meta applies a higher evidence bar for these placements because the traffic source is outside Meta's direct control.

Step 1: Get the Denial Reason in Writing

1. Open the denial notification in Meta Ads Manager.
2. Look for a case ID, transaction ID, or reference number.
3. If the message is vague, use Meta Support to request a written explanation.
4. Save the response as a PDF or screenshot with the timestamp.

Without the written reason, you are guessing. Meta's review is case-by-case, and the stated reason directs which evidence to gather next.

Step 2: Close the Evidence Gaps

Use this checklist based on common denial reasons:

• No server logs: Export raw access logs with IP, timestamp, user agent, and request URL for the disputed period.
• Short date range: Extend the analysis window before and after the flagged clicks to show the pattern is not a one-day anomaly.
• Client-side only: Add server-side confirmation that the click reached your infrastructure, not just the browser.
• No third-party verification: Include a fraud-detection report or bot-score summary from a forensic tool.
• Audience Network specific: Specify the placement IDs in your appeal. Third-party inventory needs extra documentation.

Keep campaign, ad set, creative, placement, click identifier, landing-page URL, and timestamp with each lead. If data is overwritten during a CRM import, the team loses the ability to prove the pattern.

Step 3: Build the Appeal Package

Organize the evidence into a single document or zip file with this structure:

1. Cover page: account ID, case ID, date range, and total disputed amount.
2. Summary: one paragraph stating what you are appealing and the specific denial reason you are addressing.
3. Evidence A: server logs with the relevant IPs and timestamps.
4. Evidence B: analytics comparison showing the suspicious pattern.
5. Evidence C: third-party verification or forensic report.
6. Appendix: screenshots of the original claim and the denial notice.

A forensic audit helps when you lack internal logging. Check the vendor's methodology and whether they can testify to their findings.

Step 4: Resubmit Through the Correct Channel

Use the same support path where you filed the original claim. Reference the original case ID in the subject line or first sentence. Attach the appeal package and keep a copy of the submission confirmation.

Meta's billing support form, the Help Center, and your account manager (if you have one) are three different paths with different turnaround times. Choose the path that gives you the fastest response for your account tier.

Step 5: Escalate If the Second Denial Stands

If Meta denies the appeal, ask for a supervisor review or request an account manager escalation. For larger spenders, a dedicated Meta representative can reopen the case with additional context.

If you do not have an account manager, use the Business Help form and cite the case ID and the specific policy clause you believe Meta misapplied. Escalation works best when you can show that the new evidence directly contradicts the original denial reason.

Prevent the Next Denial

Set up continuous traffic monitoring before you need a refund. Keep 90 days of server logs, tag clicks with FBCLID or click identifiers, and run monthly bot-score checks on your Audience Network placements.

When you catch suspicious activity early, you file while logs are fresh and the pattern is clear. Automated browser bots simulate user sessions, click sponsored creative, and navigate landing pages. They consume paid budget without generating real customer engagement.

Look for these signals of invalid traffic:

• Unusually fast form completion or sub-second bounce rates.
• Identical field structures across multiple leads.
• Sudden placement-level spikes in clicks with no conversion lift.
• Conversion events with no meaningful page engagement.
• Disconnected numbers, invalid email domains, or unusual country concentration.

Key Facts

Limitations

This advice covers the general appeal path based on Meta's published refund policy and common evidence requirements. Meta updates its review criteria without public notice, and some denial reasons (such as policy violations or account-level issues) may not be appealable through the standard process.

Google limits claims to the past 60 days. Meta's window may differ. Verify the current procedure with Meta Support before investing time in evidence collection. The source pack does not provide Meta's exact current appeal SLA or guaranteed refund percentages.

FAQ

How long does a Meta appeal take? There is no published SLA. Expect one to four weeks depending on case volume and whether you escalate.

Can I appeal more than once? Yes, but each submission needs new evidence. Resubmitting the same package usually produces the same result.

What if I no longer have server logs? Rebuild what you can from analytics, CDN logs, or hosting backups. Partial evidence is better than none, but a missing date range weakens the case.

Does Meta Audience Network have different rules than Facebook ads? Audience Network placements are third-party, so Meta may apply a higher evidence bar. Specify the placement IDs in your appeal.

Should I use a third-party audit service? A forensic audit helps when you lack internal logging. Check the vendor's methodology and whether they can testify to their findings.

What if the denial reason is policy violation? Policy violations may not be appealable through the standard refund process. Contact Meta Support to confirm your options.

Can I recover spend from Audience Network specifically? Yes, but expect a higher evidence bar. Third-party placements require placement-level documentation and server-side confirmation that clicks reached your infrastructure.

To block known bots in Meta Ads Manager, navigate to Settings → Library → Exclusion Lists. Click Create Exclusion List. Add the IP addresses, domains, or device identifiers you have identified as bot sources. Save the list. Then open the relevant ad set, scroll to the Exclusions section, and select your list. The exclusion takes effect immediately for new impressions.

Before you scale spend, audit your attribution setup by running controlled test conversions through each channel, verifying postback and pixel firing, checking deduplication logic, and reconciling every value against a single source of truth. Then check whether the attribution model still fits your business goal. This readiness checklist gives the order to run those checks and what each result should look like.

An attribution audit is a pass over the chain between a click and a revenue record. If any link misattributes credit, scaling spend multiplies the mistake. The goal is confidence that every credit matches what actually happened.

What an attribution audit actually covers

An attribution audit checks four layers of the tracking stack:

1. Data capture. Do pixels, postbacks, and click IDs fire correctly on every page that matters?
2. Data transfer. Does the tool that records the click pass that information to the tool that records the conversion?
3. Deduplication. Does one conversion get counted once per tool?
4. Model fit. Does the way credit is assigned match how customers actually buy?

Work through those layers in that order. A misfiring pixel is cheaper to fix than a wrong multi-touch model, so catch the mechanical failures first.

The pre-scale attribution readiness checklist

Run these six checks in order. Each produces a clear pass or fail. If any check fails, fix it before moving on.

1. Run a test conversion through each channel and affiliate.
2. Verify postback and pixel firing for each channel.
3. Check deduplication and cross-device logic.
4. Reconcile analytics, platform, and source-of-truth numbers.
5. Review attribution model alignment with business goals.
6. Freeze campaign changes during the test period.

The full audit takes one to three days, depending on how many channels and payout files you maintain.

Check 1: Run test conversions through every channel

Create a real test conversion for each channel that drives spend: paid search, social, email, and each affiliate. Use a unique UTM tag or click ID for every test so you can trace which channel received credit.

Use a different device and browser for the click and the conversion. That forces the system to handle cross-device attribution, not just the easy same-device case.

What to record for each test:

• The channel that received credit
• Whether the ID attached to the conversion matches the original click
• Whether the conversion count matches what the ad or affiliate platform reports

If a test conversion is credited to the wrong channel, stop the audit and fix the tracking before going further. Continuing with a broken link makes the rest of the audit unreliable.

The three most common manipulation patterns are last-click hijacking (an affiliate fires a redirect in the final seconds before conversion), cookie stuffing (tracking cookies placed silently with no user interaction or real referral), and coupon extension overwrites (browser extensions inject affiliate cookies at the moment of purchase). All three look like clean conversions, so run at least one test conversion that creates a competing cookie on the same session.

Check 2: Verify postback and pixel firing per channel

Each channel has its own tracking mechanism. Google Ads uses GCLID values. Meta uses FBCLID and purchase pixels. Affiliate networks use their own click IDs and postbacks.

For each mechanism, trigger a test event and confirm the payload arrives in your analytics and conversion tools. If a channel collects a click ID but never passes it to the conversion tool, the conversion will be recorded but credited to nothing.

A single misfiring postback is a data-quality bug. A channel that never fires postbacks is unusable — every conversion attributed to it is a guess. If you log click IDs automatically (GCLID and FBCLID), verifying this part becomes a simple comparison of logs against conversion reports.

Check 3: Check deduplication and cross-device logic

Multiple tools can each record the same conversion. Your ad platform, your analytics tool, and your CRM may each report a different number for the same event.

The test conversion from Check 1 should appear exactly once in each tool. If it appears twice in one tool, the deduplication rule is broken.

Cross-device rules matter too. A user who clicks on a phone and converts on a laptop tests both cross-device linking and the attribution model. Run at least one test conversion that crosses devices before you conclude the audit.

Check 4: Reconcile against a source of truth

Pick one system as the source of truth — usually the CRM or billing system. It is not the analytics tool, and it is not the ad platform. The source of truth records confirmed, non-reversible conversions.

Compare three numbers for the test period:

• Revenue reported by the analytics tool
• Revenue reported by the ad or affiliate platform
• Revenue confirmed in the CRM or billing system

A small gap is normal because conversion windows differ across tools. A large one means data is being lost or created somewhere. Investigate each gap before scaling.

Filter out bot clicks before you compare. Behavioral signals — not just click-level detection — reveal whether a session that converted was a real person. Click-level fraud tools catch bots in the traffic. The commissions that cost the most come from real sessions where an affiliate manipulates the attribution path in the final seconds before conversion, so a behavioral check is essential to the reconciliation step.

Check 5: Review attribution model alignment

The attribution model decides how credit is distributed across touchpoints. Common models include last-click, first-click, linear, time-decay, and data-driven.

Last-click works for a short, low-consideration purchase where the final click is the whole story. It understates the contribution of early touchpoints when the sales cycle is long. A first-click model does the reverse.

If you change the model, document current numbers first. Then rerun the audit after the switch to confirm the new model behaves as expected.

Key facts about attribution audits

Common gaps that only show up at scale

Some problems are invisible at small spend and painful at scale.

Coupon extension overwrites rarely show up in small samples. Browser extensions inject affiliate cookies at the moment of purchase, so a conversion that looks attributed to a real affiliate was actually produced by an extension the user installed. The payout CSV reconciliation will surface this pattern.

Single-channel test passes, multi-channel test fails. Run test conversions one at a time and you miss simultaneous click paths. Run two test conversions that overlap in time and check which channel wins. Legitimate sessions often involve multiple touchpoints, so the audit must handle overlap.

Payout CSV vs. platform mismatch. The affiliate platform may report one commission amount, and your payout CSV another. Reconcile the two before the first large payout, not after. That requires a full payout file, not just a sample report.

Limitations and when the checklist does not fully apply

This checklist works well for a standard lead-gen or e-commerce setup. It assumes one website, one conversion window, and one source of truth.

It applies less cleanly when multiple websites share a conversion path, when the sales cycle spans months for a single customer, or when a conversion has no confirmed record in the billing system. In those cases, start with a smaller test period and verify the source of truth first.

Behavioral signals can also mislead. Privacy tools, corporate networks, and unusual devices produce unexpected behavior for real people. A single anomaly is not a verdict — check it against other signals. The same principle applies to your audit: a single discrepancy deserves investigation, not an instant verdict.

Rerun the audit after platform updates, model changes, conversion-window changes, and significant traffic-mix shifts.

Attribution audit FAQ

How often should I run an attribution audit?

Run one before scaling spend, then at least quarterly, and again after any change to the tracking stack or attribution model.

What is the cheapest way to run a test conversion?

Use your own purchase or signup with a new device and a distinct UTM. It costs nothing and produces real data.

What does a postback actually do?

A postback sends the click ID from the ad platform to the conversion tool, so the platform can pair the click with the conversion that followed it.

How long should I wait between the test click and the test conversion?

Long enough to span your full conversion window — usually 30 to 90 days, depending on the attribution window you use.

Can I audit attribution without platform integrations?

Yes. You can start by reading UTM parameters and click IDs from your traffic. For exact payout reconciliation, you will need to upload a payout CSV or connect the platform later.

Should I freeze campaign changes during the audit?

Yes. Changing campaigns during the test period pollutes the baseline and makes it impossible to compare before and after numbers. Preserve attribution before changing anything.

An audit of your coupon system for extension abuse starts with one question: did a browser extension set its affiliate cookie after the buyer had already engaged with your store? If yes, the transaction is a likely override.

Quick Answer: Use a Bearer Token

BotRefund authenticates API requests with an API key. You send that key in the Authorization header as a Bearer token. Every request must include it. No session cookies, no OAuth flow, no client secrets.

Here is the exact header format:

Authorization: Bearer YOUR_API_KEY

Replace YOUR_API_KEY with the key you generate in your BotRefund dashboard. That is the whole authentication model.

Prerequisites Before You Start

You need three things before you can authenticate:

• An active BotRefund account. You can create one from the homepage. No credit card is required for the free audit.
• Access to the dashboard. Log in with the email and password you used to sign up.
• A plan that includes API access. API credentials are available on eligible agency plans. If you do not see the API section, contact sales to confirm your plan includes it.

If you are on a free trial or a basic plan, you may not see API keys yet. Check with BotRefund support before building your integration.

Step-by-Step: Generate Your API Key

1. Log in to your BotRefund dashboard. Go to botrefund.com and click Login in the top navigation.
2. Open Account Settings. Look for a gear icon or your profile name in the top-right corner.
3. Find the API section. It is usually labeled API Keys or Developer.
4. Click Generate New Key. The system creates a unique key for you.
5. Copy the key immediately. BotRefund shows the full key only once. Store it in a password manager or a secure environment variable.
6. Name the key. Give it a descriptive name like production-backend or staging-test. This helps you track which key is used where.

You now have a working API key. The next step is to use it in your code.

How to Send the Key in Your Requests

Here is a minimal example using curl:

curl -X GET \
  https://api.botrefund.com/v1/audits \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

In JavaScript with fetch:

const response = await fetch('https://api.botrefund.com/v1/audits', {
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  }
});

In Python with requests:

import requests

headers = {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
}
response = requests.get('https://api.botrefund.com/v1/audits', headers=headers)

The pattern is always the same. Put the key in the header. Do not put it in the URL or the request body.

Common Authentication Mistakes

These are the errors developers make most often:

• Missing the word "Bearer". The header must read Bearer YOUR_API_KEY, not just YOUR_API_KEY.
• Using the wrong key. You may have multiple keys. Make sure you use the one for the correct environment.
• Leaking the key in client-side code. Never put your API key in a browser script or a public repository. Anyone can steal it.
• Expired or revoked keys. If you rotate keys, old ones stop working. Update your code when you rotate.
• Incorrect header name. It is Authorization, not Auth or API-Key.

If you get a 401 Unauthorized response, check these first. Most authentication failures are simple header mistakes.

Why API Authentication Matters for Bot Detection

Authentication is not just a security gate. It is the gateway to automation. BotRefund helps you recover up to 20% of your Google and Meta ad spend lost to invalid bot clicks. To automate this recovery, you need programmatic access to the platform.

Without a valid API key, you cannot pull forensic signals. BotRefund uses 110+ forensic signals to prove which visits were non-human. These signals include trap behavior, pointer behavior, and speed behavior. By authenticating with the API, you can build scripts that automatically audit your traffic, generate evidence dossiers, and negotiate refunds directly with Google and Meta.

Think of your API key as the key to your vault. It unlocks the data needed to clean your customer reach and stop junk click-farm impressions across Google Display & Video partner networks.

Storing Your API Key Securely

Treat your API key like a password. Do not hardcode it in your source code. Use environment variables or a secrets manager.

Here is how to store it in a .env file:

BOTREFUND_API_KEY=your_key_here

Then load it in your application:

import os
api_key = os.getenv('BOTREFUND_API_KEY')

For production systems, use a dedicated secrets service like AWS Secrets Manager, HashiCorp Vault, or Google Secret Manager. Never commit keys to version control.

Rotating Your API Key

Rotation is the practice of replacing an old key with a new one. Do this regularly or when you suspect a leak.

1. Generate a new key in the dashboard.
2. Update your application to use the new key.
3. Test the new key with a simple request.
4. Revoke the old key once the new one works.

Keep a short overlap period. Run both keys for a few minutes to avoid downtime. Then delete the old key.

Limitations and When This Does Not Apply

BotRefund does not publish a public REST API with documented endpoints for all users. The API is available on eligible agency plans. If you are on a different plan, you may not have access to API keys.

This authentication method applies only to the BotRefund API. It does not apply to the on-site script that BotRefund uses for bot detection. That script runs in your browser and does not require an API key.

If you need API access and do not see the option in your dashboard, contact BotRefund sales. They can confirm whether your plan includes it or upgrade you.

Frequently Asked Questions

What if I get a 401 error?

Check that your header is exactly Authorization: Bearer YOUR_API_KEY. Make sure the key is not expired or revoked. If it still fails, generate a new key.

Can I use multiple API keys?

Yes. You can generate multiple keys for different environments or applications. Name them clearly so you know which is which.

How often should I rotate my key?

Rotate every 90 days as a best practice. Rotate immediately if you suspect a leak or if a team member leaves.

Is the API key the same as my login password?

No. Your login password is for the dashboard. The API key is separate and used only for programmatic requests.

Can I put the key in the URL?

No. Never put the key in a query string or path. It can appear in logs and browser history. Use the Authorization header only.

Does BotRefund support OAuth?

No. BotRefund uses API key authentication only. There is no OAuth flow or token exchange.

What does the free audit include?

The free audit shows flagged bots, why each was flagged, and session evidence. It does not require an API key. You can start collecting evidence free from the homepage.

Introduction

Canvas detection is a core technique in modern bot mitigation, using HTML5 canvas rendering to identify inconsistencies between reported and actual browser environments. While powerful, improper integration can lead to false positives, performance degradation, or missed threats. This guide explains how to avoid common mistakes when implementing canvas detection, grounded in real-world practices from BotRefund’s detection platform. It focuses on the 'Empty Font Canvas' signal as one of 110+ independent checks, emphasizing corroboration over isolated verdicts. The article is structured around diagnosing and preventing specific integration errors, with clear cause-effect-fix logic for each.