Seatext library / BotRefund evidence
How to Add BotRefund Protection to Your Website: Step-by-Step Setup Guide
Add BotRefund to your site in about one minute by creating an account, pasting a single JavaScript snippet into your page header, and starting the free bot audit. No credit card is required, and...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
You add BotRefund protection by creating a free account at botrefund.com, copying the provided JavaScript snippet, and pasting it into the <head> of every page you want monitored. The script loads asynchronously, starts collecting browser, network, device, and behavioral signals, and feeds them into BotRefund's AI model that identifies bot versus human visits with 99% accuracy. Once live, you can run a free bot audit, review flagged sessions, and submit refund claims to Google and Meta for invalid clicks dating back to 2017.
Bot clicks can steal up to 20% of your Google and Meta ad budget, according to BotRefund's homepage (S2). That is not a small leak. For a business spending $10,000 per month, that is $24,000 per year lost to invalid traffic. Adding BotRefund gives you an independent record of which sessions are bots, so you can stop paying for them and recover the money you already lost.
Prerequisites before you start
- Admin access to your website's HTML or tag manager so you can insert a script in the
<head>. - Active Google Ads or Meta Ads campaigns you want protected.
- A work email address to receive the audit report and refund claim updates.
- A Google Ads or Meta Ads account with billing history because refunds are processed through those platforms.
- If you use a Content Security Policy (CSP), you need to know how to add script-src directives.
- For single-page applications (SPAs) that route without reloads, you need a way to re-inject the snippet on every route change.
If you do not have direct code access, ask your developer or use a tag manager like Google Tag Manager or Adobe Launch. The script itself is lightweight and does not require a server change or a database. It is a single JavaScript snippet that runs in the visitor's browser.
Step-by-step implementation
- Create your BotRefund account. Go to botrefund.com and click "Get my free bot audit" or "Create account." Enter your name, website URL, work email, and monthly Google/Meta ad spend range. The form asks for your annual or monthly spend so BotRefund can recommend the right tier.
- Confirm your demo booking. After submitting the form, you'll receive a calendar invite for a live bot audit call. BotRefund runs a real-time audit of your site during that call. You do not need to add the script before the call; the audit can be done without the tag, but adding it first gives you a head start.
- Copy the installation snippet. In your BotRefund dashboard (or the follow-up email), copy the single-line JavaScript tag provided for your account. It includes an account identifier so the data is attributed to your website.
- Paste the snippet into your site's
<head>. If you use Google Tag Manager, add a new Custom HTML tag set to fire on All Pages in the<head>. If you edit code directly, place the snippet before the closing</head>tag on every template. For WordPress, you can add it to your theme's header.php or use a plugin like Insert Headers and Footers. For Shopify, edit the theme.liquid file and place it in the<head>section. - Verify the script is loading. Open your site in an incognito window, open DevTools → Network, filter for "botrefund," and confirm the script returns 200 OK. The dashboard will show "Active" once data starts flowing. If you see an error, check your CSP or ad blockers.
- Run your first free bot audit. Either wait for the scheduled live audit call or trigger an on-demand audit from the dashboard. The report breaks down suspicious paid visits, shows why each session was flagged, and prepares a refund-ready evidence dossier.
The whole process takes about one minute for the technical part, according to BotRefund's homepage (S2). The demo call itself may take 30 minutes because it includes a live walkthrough of your traffic.
What the script actually does on your pages
The lightweight tag runs 106 independent checks on every visit. Signals include hardware and GPU fingerprinting, CPU concurrency consistency, impossible tab speed detection, window.open tampering, ghost click detection, honeypot trap interactions, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed under 1ms, grid-aligned movement patterns, missing clicks or scrolling, and unnatural session durations. Each signal is kept as evidence—not a verdict—and cross-checked against browser, network, device, and behavior data before the AI model scores the visit.
Consider the CPU Concurrency Lie check. A real browser reports hardware, graphics, fonts, and operating-system details that naturally fit together for that device. Automated browsers often claim one device while their graphics, fonts, audio, or processor behavior tells a different story (S1). The script looks for that mismatch. It is not enough to flag a session by itself because privacy tools, corporate networks, and unusual devices can produce odd results for real people. That is why BotRefund keeps each signal as independent evidence and only makes a prediction after checking whether multiple signals agree.
Another example is Impossible Tab Speed. Real visitors pause, hesitate, and move naturally. Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people (S6). If a session shows superhuman input speed under 1 millisecond on several interactions, that is a strong bot indicator. But again, a single fast click could happen for a real user on a very fast machine. So the model weighs the whole pattern.
The script also monitors engagement: whether the visitor scrolls, clicks, or just sits on the page. A session with no clicks or scrolling that still triggers a conversion is suspicious. Bots often load a page, wait a few seconds, and submit a form without touching the mouse. The script notes the absence of humanlike behavior.
Key facts from BotRefund's detection engine
Here is a summary of the main capabilities and facts from BotRefund's official pages.
| Capability | Detail | Source |
|---|---|---|
| Independent checks per visit | 106 | S1 |
| Reported AI accuracy | 99% | S1 |
| Setup time | About one minute | S2 |
| Credit card required | No | S2 |
| Refund lookback window | Google Ads spend dating back to 2017 | S2 |
| Supported ad platforms | Google Ads and Meta Ads (Facebook, Instagram, partner inventory) | S3 |
| Ad spend tiers served | Under $10k/mo, $10k–$50k, $50k–$250k, $250k–$1M, Over $1M/mo | S2 |
| Average bot click rate detected | 14% (case study) | S4 |
| Refund approval rate | Reported across client claims submitted to ad platforms | S2 |
The table shows that BotRefund is built for paid traffic from Google and Meta. If you run advertising on other networks, you cannot use BotRefund to recover those costs. The 99% figure refers to the AI model's internal benchmark for distinguishing bot from human visits based on the full signal set. Real-world refund approval depends on Google and Meta's own review processes.
Common setup mistakes and how to avoid them
- Placing the script in the
<body>or footer. Some checks rely on early page-load signals; the<head>placement ensures full coverage. - Adding the snippet only to landing pages. Bots can enter through any page. Install site-wide for complete attribution protection. If you only monitor a few pages, you might miss bot clicks on other pages that still count as ad clicks.
- Blocking the script with CSP or ad blockers. Ensure your Content Security Policy allows the BotRefund domain so the script loads on every visit. Some privacy browsers also block third-party scripts; you may need to whitelist the domain.
- Expecting instant refunds. The audit produces evidence; refund approval depends on Google and Meta review timelines. A claim may take days or weeks to process.
- Not testing after a site update. If you redesign your site or change your tag manager, the snippet can disappear. Always verify the script is still active after major changes.
- Ignoring single-page app routing. For SPAs, the script only runs when the page loads. If your app uses client-side routing, you need to re-inject the snippet on every route change. Check the BotRefund documentation for framework-specific guidance.
How verification works after installation
Once the script is live, BotRefund's dashboard shows a live feed of scored visits. Each flagged session includes a video replay, the specific signals that triggered the bot classification, and a one-click export for the refund evidence dossier. You can filter by campaign, placement, device, or date range. The dossier is formatted to match Google and Meta's dispute requirements, so you can submit it directly from the platform or hand it to your agency.
The dashboard also shows your overall bot click rate. In a case study with FinTrust, a neobank, BotRefund found a 14% bot click rate and recovered $140,000 in ad spend (S4). That recovery not only saves money but also improves conversion data because your ads are no longer being shown to bots that inflate metrics.
You can also use the dashboard to see which campaigns have the highest invalid traffic. This helps you decide whether to pause certain placements or adjust bids. BotRefund does not automatically block bots; it gives you the evidence so you can make informed decisions. Some businesses use the evidence to suppress conversion events from automated browser emulation signals, which trains Google and Meta AI on cleaner data (S4).
Understanding the refund claim process
BotRefund does not automatically file refunds for you. You must review the flagged sessions and approve what you want to claim. Once you approve, BotRefund packages the evidence into a dossier that meets Google and Meta's requirements. Then either you or BotRefund submits the claim on your behalf. According to the homepage, BotRefund "proves bot clicks, negotiates with Google and Meta, and gets your money back" (S2).
The refund claim process works like this:
- Review flagged sessions. In your dashboard, you see a list of sessions classified as bot. Each has a reason and evidence.
- Select the sessions to claim. You can choose individual sessions or filter by date, campaign, or placement.
- Generate the evidence dossier. The dashboard creates a PDF or export package that includes video replay, signal lists, and timestamps.
- Submit the claim. You can submit it yourself through Google Ads or Meta Ads Manager, or you can let BotRefund handle the submission if you grant access.
- Track the outcome. BotRefund tracks the approval status of each claim and shows you the refund amount credited back to your ad account.
Google allows refunds for invalid clicks dating back to 2017 (S2). Meta does not publish a fixed lookback window, but the dashboard will indicate the applicable period based on your account history.
Limitations and when this advice does not apply
- BotRefund focuses on paid traffic from Google and Meta. It does not block bots at the network edge or protect organic, direct, or referral traffic. If your main concern is spam bots on your contact form without paid ads, this is not the right tool.
- Sites with heavy client-side rendering (SPAs) may need the snippet re-injected on route changes; check the docs for framework-specific guidance.
- Enterprise contracts (over $1M/mo spend) involve a custom onboarding call and dedicated support—self-serve setup covers the standard tiers.
- The 99% accuracy figure reflects the AI model's internal benchmark; real-world refund approval rates vary by platform and claim quality.
- BotRefund does not prevent bots from visiting your site. It only detects them and documents their behavior. If you need active blocking (e.g., CAPTCHA, content masking), you must pair it with a WAF or bot management platform.
- The script relies on JavaScript execution. Bots that do not run JavaScript may not be fully analyzed, although BotRefund can still detect some hardware and network signals.
Terminology quick reference
- Ghost click: Click activity without the natural sequence of human intent (S2).
- Honeypot trap: Hidden page elements that only bots interact with (S2).
- Impossible tab speed: Timing patterns that scripts cannot replicate (S6).
- CPU concurrency lie: Mismatch between reported hardware and actual browser behavior (S1).
- Evidence dossier: Organized, refund-ready documentation of invalid clicks (S9).
- Pixel protection: Preventing fraudulent sessions from distorting conversion data (S9).
- Window.open tamper: Detecting when a bot manipulates the window.open method to open pop-ups or redirects (S7).
FAQ
How long until I see results after adding the script?
Data appears in the dashboard within minutes of the first tracked visit. The first comprehensive audit is typically ready within 24–48 hours, depending on traffic volume.
Does the script slow down my site?
The tag loads asynchronously and is designed to be lightweight. BotRefund states typical setup takes about one minute with no noticeable performance impact (S2).
Can I use BotRefund alongside Cloudflare, Akamai, or other WAFs?
Yes. BotRefund operates at the browser layer, complementing network-level filters. It does not conflict with CDN or WAF rules.
What if my site uses a strict Content Security Policy?
Add BotRefund's script domain to your script-src directive. The dashboard provides the exact domain once you create an account.
How far back can I claim refunds?
BotRefund can recover Google Ads spend dating back to 2017 (S2). Meta's lookback period follows their current policy; check the dashboard for the exact window.
Is there a long-term contract?
The self-serve tiers are month-to-month with no credit card required to start. Enterprise plans involve a custom agreement.
What happens after I submit a refund claim?
BotRefund negotiates with Google and Meta on your behalf using the evidence dossier. Approved refunds are credited back to your ad account. The platform tracks approval rates across all client claims (S2).
Do I need a developer to install the script?
No. If you can use Google Tag Manager or your website's header editor, you can install it yourself. The one-liner snippet is copy-paste.
Can I test the script without adding it to production?
You can add it to a staging site first, but note that traffic on staging sites is not paid, so bot detection patterns may differ. The best test is to run it in production for a few days and then review the audit.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.