How to Add BotRefund Protection to a Website Using a CDN

Yes, you can add BotRefund protection to a website that uses a CDN. BotRefund is a client-side script that runs in the visitor's browser. A CDN serves your static files and does not block the script. You just need to get the script onto your pages. This guide covers the exact steps.

Prerequisites for Adding BotRefund with a CDN

Before you start, make sure you have:

• A BotRefund account. You can create one for free and get a free bot audit.
• Access to your site's HTML or a tag manager like Google Tag Manager.
• A CDN that allows third-party scripts. Most do by default.
• If you use a Content Security Policy (CSP), you'll need to allow BotRefund's domain.

You also need the ability to edit your site's global templates. Most sites use a header or footer that appears on every page. That is the easiest place to add the script.

How BotRefund Works Behind a CDN

BotRefund uses 106 independent checks to build a reliable picture of whether a visit is human or automated. These checks cover hardware, graphics, fonts, audio, browser behavior, network patterns, and user interaction.

The script runs entirely in the browser. It does not need server-side access. The CDN only delivers your HTML, CSS, and JavaScript. It does not interfere with the BotRefund script unless you have a firewall or security rule that blocks external requests.

BotRefund's detection engine cross-checks all signals. It looks for mismatches that a real browsing session would not normally create. For example, the CPU Concurrency Lie check looks for a device that claims one hardware profile but behaves like a virtual machine. The window.open Tamper check looks for scripted clicks that lack natural human timing. The Impossible Tab Speed check flags actions that happen faster than any person could perform.

The AI model weighs the complete pattern. A single anomaly is not a bot verdict. Privacy tools, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund only flags a visit as a bot when multiple independent signals agree.

This is why the company claims 99% accuracy. Accuracy comes from corroboration, not a single browser tell.

When you use a CDN, the script is loaded from your domain or from BotRefund's domain. If you load it from your own domain, you must ensure the CDN serves that file. If you load it from BotRefund's domain, the CDN has no effect on delivery.

Step-by-Step: Adding the BotRefund Script

There are three main ways to add BotRefund to your site:

1. Direct HTML injection in your global header or footer.
2. Tag manager, such as Google Tag Manager.
3. CDN edge rules that inject the script into every HTML response.

Method 1: Direct HTML Injection

Log into your BotRefund account and copy the provided JavaScript snippet. Then paste it into your site's global header or footer. This is the simplest method. It works for any CDN because the script is part of the HTML.

Make sure you paste it before the closing tag. This ensures the script does not block page rendering.

Method 2: Tag Manager

If you use Google Tag Manager, create a new custom HTML tag. Paste the BotRefund script inside the tag. Set the trigger to fire on all pages. Publish the container.

Tag managers load the script asynchronously. That works fine with BotRefund. The script will run after the page loads, which is all that is needed.

Method 3: CDN Edge Rules

If you cannot edit HTML directly, use your CDN's edge capabilities. Many CDNs allow you to modify responses at the edge. You can insert the script into every HTML response without touching your origin files. This is useful for sites with multiple page templates or when you want to manage the script centrally.

Using CDN Edge Rules to Inject the Script

Let's look at two popular CDNs: Cloudflare and AWS CloudFront.

Cloudflare Workers

Cloudflare Workers let you run JavaScript at the edge. You can add a worker that intercepts HTML responses and injects the BotRefund script.

Here is a simple Worker script that appends the BotRefund snippet to the tag of every HTML page:

addEventListener("fetch", event => {
  event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
  const response = await fetch(request);
  const contentType = response.headers.get("content-type") || "";
  if (!contentType.includes("text/html")) {
    return response;
  }
  let html = await response.text();
  const botRefundScript = `<script src="https://botrefund.com/script.js"></script>`;
  html = html.replace("</body>", botRefundScript + "</body>");
  return new Response(html, {
    headers: response.headers
  });
}

This worker runs on every request. It checks if the response is HTML. If so, it replaces the closing body tag with the script and the tag. You need to change the script URL to your actual BotRefund snippet.

Deploy this worker to your zone. Then all HTML pages will include the script.

AWS CloudFront Lambda@Edge

Amazon CloudFront integrates with Lambda@Edge. You can attach a Lambda function to the origin response event. This function can modify the HTML before it is returned to the viewer.

Here is a Lambda function that injects the BotRefund script:

exports.handler = (event, context, callback) => {
  const response = event.Records[0].cf.response;
  const headers = response.headers;
  const contentTypeHeader = headers["content-type"];
  if (contentTypeHeader && contentTypeHeader[0].value.includes("text/html")) {
    const body = response.body;
    const botRefundScript = "<script src='https://botrefund.com/script.js'></script>";
    response.body = body.replace("</body>", botRefundScript + "</body>");
  }
  callback(null, response);
};

You must create a Lambda function in the us-east-1 region. Then associate it with a CloudFront distribution as an origin response trigger. The function runs for every request and modifies the HTML response.

Other CDNs have similar features. For example, Fastly offers VCL transforms, and Akamai has EdgeWorkers. The concept is the same: intercept the response and insert the script.

Free Bot Audit: What to Expect

BotRefund offers a free bot audit. No credit card is required. The audit is designed to show you how much of your ad budget is being wasted on bot clicks.

Here is the process:

1. Sign up for a BotRefund account on their website.
2. Add the BotRefund script to your site, using any of the methods above.
3. After the script is live, request the free audit. You will be asked about your ad spend. You can select a range or enter an exact amount.
4. BotRefund schedules a call with you. On the call, they run a live bot audit of your site. They use their detection engine to analyze recent traffic and identify bot visits.
5. You receive a report showing bot clicks, their sources, and the potential refund amount.

The audit also includes video proof for each detected bot click. You can use this evidence to file a refund claim with Google or Meta. BotRefund claims it can recover refunds for Google Ads spend dating back to 2017.

The audit is not automated. A representative works with you to interpret the results. They also explain how BotRefund's detection works and what you can do next.

If you have high ad spend, they may offer an enterprise plan with more features. But the audit itself is free.

Troubleshooting and Common Mistakes

Even after adding the script, you may run into issues. Here are common problems and how to fix them.

The script does not load

Check your browser's Network tab. Confirm that the BotRefund script URL appears and returns a 200 status. If it returns a 403 or 404, check your CSP and firewall rules.

If you use a WAF, allowlist BotRefund's domain. Some web application firewalls block unknown external scripts.

The script loads but no detection happens

Make sure the script is on every page you want to protect. It only runs where it is present. Add it to your global header or footer to cover all pages.

CSP blocks the script

If you have a Content Security Policy, add BotRefund's domain to the script-src directive. For example:

script-src 'self' https://botrefund.com;

Also allow the connect-src if the script makes requests to BotRefund's API.

CDN caches old HTML without the script

If your CDN caches HTML, the cached version may not include the script. Clear the cache for your HTML pages. Or, configure the CDN to skip caching for HTML or to include the script in the cached version by purging after adding the script.

Plugin or extension conflicts

Some browser extensions or ad blockers might interfere with the script. Test in a normal browser profile with extensions disabled. If the script works there, it is likely an extension issue.

Cloudflare Workers or Lambda@Edge not working

Check the function logs. In Cloudflare, view the worker's real-time logs. In AWS, check CloudWatch logs for the Lambda function. Ensure the content-type check matches exactly. Some responses have text/html; charset=utf-8. The code above works for that.

Also ensure the script URL is correct. You must use the actual snippet from your BotRefund account, not the placeholder in the example.

Limitations and Considerations

BotRefund runs in the browser. It cannot detect server-side bot requests that do not load JavaScript. If a bot does not execute JavaScript, the script never runs. This is a fundamental limitation.

For protection against server-side scraping or non-JS bots, you need additional network-level controls. You can use your CDN's bot management features. For example, Cloudflare Bot Fight Mode or AWS WAF Bot Control. These work at the edge and block requests before they reach your origin.

BotRefund focuses on ad click fraud. It detects bots that click your ads and then visit your site. This is different from general bot traffic.

The script requires JavaScript to be enabled in the visitor's browser. Most real users have JavaScript enabled. But some privacy-conscious users may disable it. You will not detect those visits.

BotRefund's accuracy claims are based on its own testing. You should evaluate the service with your own data. The free audit is a good way to start.

FAQ

Will a CDN block BotRefund?

Usually not. A CDN serves your static files and does not interfere with scripts loaded from another domain. However, if your CDN has a firewall that blocks external scripts, you need to allowlist BotRefund's domain.

Can I use my CDN's built-in bot protection instead?

Yes, but it is a different tool. CDN bot protection typically blocks malicious traffic at the edge. BotRefund focuses on detecting invalid ad clicks and helping you get refunds. You can use both.

How long does it take to set up?

BotRefund says adding it to your website takes about one minute. You will need to copy the script and paste it into your site. If you use CDN edge rules, it may take longer to configure.

Do I need to add the script to every page?

Yes, if you want full coverage. Most sites add it to a global header or footer so it appears on every page automatically.

What if I cannot edit my HTML?

Use a tag manager like Google Tag Manager, or use your CDN's edge injection features. This avoids changing your source files.

Does BotRefund work with any CDN?

It works with any CDN because it is a client-side script. As long as you can load the script on your pages, it will work. The edge injection method varies by CDN, but you can always fall back to direct HTML or tag manager.

Next Steps

Now you know how to add BotRefund to a CDN-based site. Start with a free bot audit to see how much of your ad budget is being wasted on bot clicks. Then choose the integration method that fits your workflow.

If you need help, BotRefund offers support and enterprise sales. You can also check your CDN's documentation for edge injection details.