How to Check If Your Ad Traffic Is Real or Bot-Generated: A Step-by-Step Verification Process

Quick answer: how to verify traffic authenticity in five steps

You can run a manual check today without buying new software. The goal is to collect independent signals — network, browser, and behavioral — that together separate real visitors from automated scripts. Below is a repeatable process you can follow each month or after a suspicious spike.

Step 1: Pull the raw data you already own

1. Export the last 30 days of click-level data from Google Ads and Meta Ads Manager. Include click ID (gclid/fbclid), timestamp, campaign, ad set, placement, device, and country.
2. Export the matching sessions from Google Analytics 4 or your CDP. Join on the click ID so each ad click has a corresponding session record.
3. Export CRM lead records for the same window. Tag each lead with the originating click ID when possible.

If your analytics and CRM don't share a click ID, ask your developer to add the parameter to your landing-page URL and store it in a hidden form field. This one-time setup makes every future audit faster.

Step 2: Flag network-level anomalies

• IP reputation: Run the click IPs through a free reputation API (AbuseIPDB, IPQualityScore, or the Google Ads invalid-click report). Mark any IP that appears on a proxy, VPN, hosting, or Tor list.
• Geographic mismatch: Compare the IP country to the campaign's geo-targeting. A sudden surge from a non-targeted country is a red flag.
• IP clustering: Count clicks per IP per hour. More than 5–10 clicks from the same IP in a short window often indicates a botnet or click farm.

Step 3: Inspect browser and device fingerprints

• User-agent consistency: Real traffic shows a healthy mix of Chrome, Safari, Firefox, Edge across desktop and mobile. A spike of identical user-agent strings — especially headless Chrome or generic "Mozilla/5.0" — suggests automation.
• Missing client hints: Modern browsers send Sec-CH-UA headers. Their absence can indicate a stripped-down script.
• Screen resolution and color depth: Bots often report default values (1920x1080, 24-bit) without variation.

BotRefund runs 106 independent checks on every visit, including a Scrollbar Width Leak test that spots mismatches between reported and actual browser chrome, and a Clean Context Iframe test that catches patched browser APIs used by stealth automation tools (S4, S5).

Step 4: Measure on-site behavior patterns

This is where human vs. bot differences become obvious. Look for these signals in your session recordings or analytics events:

• Time to first interaction: Humans pause to read. Bots often click or submit a form in <100 ms after load.
• Mouse movement: Real users show micro-tremor, curved paths, and hesitation. Bots produce linear, grid-aligned movements or no movement at all (S2, S7).
• Scroll behavior: Humans scroll unevenly, pause, reverse. Bots either don't scroll or scroll at constant speed to the bottom.
• Form completion: Keystroke timing, field corrections, copy-paste events. Superhuman input speed (<1 ms per field) is a strong bot indicator (S8).
• Session duration: Visits that are too short (<3 s), too long (>30 min with no events), or identical across many sessions (S2, S7).

BotRefund categorizes these into eight behavior families — click, trap, pointer, motion, speed, path, engagement, and session — and cross-checks each signal against network, browser, and device evidence before scoring a visit (S2, S7).

Step 5: Connect behavior to business outcomes

Technical signals alone can produce false positives. The final filter is your CRM:

• Leads from flagged sessions: what percentage become qualified opportunities, booked demos, or paying customers?
• Contactability: disconnected phones, invalid email domains, repeated addresses, or unusual country-code concentration (S3).
• Placement-level quality: a sharp lead-quality drop on a specific placement, creative, or audience-expansion segment often points to invalid traffic (S3).

If a segment shows high click volume, strong technical bot signals, and zero CRM progression, you have a refund-ready evidence package.

Verification step: run a live audit before filing claims

Before you submit a billing dispute to Google or Meta, run a live audit on your site. BotRefund's free audit installs in about one minute, requires no credit card, and captures video proof for each bot click (S2, S7). The audit report maps directly to the evidence formats ad-platform reps accept, and BotRefund's team can negotiate the refund on your behalf. Their case studies show recoveries ranging from $18,200 to $1.2M across industries, with an average 20–35% lift in verified conversion rates after bot suppression (S1, S6).

Key facts from verified case studies

Industry	Ad spend recovered	Bot click rate	Conversion lift
Financial Technology (Visa)	$1,200,000	—	+35%
Neobanking (FinTrust)	$140,000	14%	+18%
Logistics SaaS (LogiCore)	$45,000	—	+28%
Healthcare CRM (MedPass)	$58,000	—	+25%
DevOps SaaS (CloudScale)	$92,000	—	+30%
LegalTech (ApexLegal)	$19,500	—	+21%
Agency (RealLux)	$84,000	—	+33%
Cybersecurity (SecureNet)	$112,000	—	+26%
Solar Energy (BriteEnergy)	$47,000	—	+31%

Source: BotRefund case-study catalog (S1, S6). Figures reflect individual client results; your recovery will vary by spend level and bot pressure.

Limitations of manual checks

• Sampling bias: Analytics platforms sample high-volume data. Export raw hit-level data or use BigQuery/GA4 export for full fidelity.
• False positives: Privacy tools, corporate proxies, and unusual devices can mimic bot signals. Always cross-check multiple independent signals before labeling a visit as bot (S4, S5).
• Time window: Google and Meta typically accept refund claims for the last 60–90 days, though BotRefund has recovered spend dating back to 2017 in some disputes (S2, S7).
• Platform policy: Each ad platform defines invalid traffic differently. Meta's "invalid traffic" includes accidental clicks and low-intent traffic, not just bots (S3).

Terminology quick reference

• Click ID (gclid/fbclid): Unique parameter appended to landing-page URLs by Google Ads and Meta Ads. Enables joining ad clicks to website sessions.
• Headless browser: A browser running without a graphical UI (e.g., Puppeteer, Playwright, Selenium). Used for automation and scraping.
• Residential proxy: Routes traffic through consumer ISP IPs to evade datacenter IP blocklists.
• Honeypot trap: Hidden page element (link, form field) that real users never interact with. Interaction signals automation.
• Scrollbar Width Leak: A fingerprinting check that detects mismatch between reported and actual scrollbar dimensions, common in automated browsers (S4).
• Clean Context Iframe: A check that loads the page in an isolated iframe to reveal patched or hidden browser APIs used by stealth tools (S5).

FAQ

How much of my ad budget is typically lost to bots?

BotRefund's data suggests bot clicks can consume up to 20% of Google and Meta ad budgets (S2, S7). Industry studies report similar ranges. Your exact loss depends on vertical, targeting, and bid strategy.

Can I get refunds for past months?

Google and Meta generally limit billing disputes to the most recent 60–90 days. However, BotRefund has successfully recovered spend dating back to 2017 in certain cases where systematic fraud was documented (S2, S7).

What if my analytics shows high bounce rate but good CRM conversion?

High bounce with strong downstream conversion usually means real visitors who found what they needed quickly. Focus refund efforts on segments where both engagement and CRM outcomes are poor.

Do I need developer resources to install bot detection?

BotRefund's script adds in about one minute via a single JavaScript snippet or tag-manager template. No credit card or engineering sprint required for the free audit (S2, S7).

How does BotRefund's 99% accuracy claim work?

Accuracy comes from corroboration across 106 independent signals — browser, network, device, and behavior — fed into a prediction model that weighs the complete pattern rather than relying on any single rule (S4, S5).

What's the difference between invalid traffic and bot traffic?

Invalid traffic is a platform policy term that includes accidental clicks, incentivized clicks, and low-intent traffic alongside bots. Bot traffic is a technical subset: automated software mimicking human interaction. Refund claims require evidence matching the platform's specific definition (S3).

Can I run this audit on Meta lead-form campaigns without a landing page?

Native lead forms don't expose session data. You'll need to drive traffic to a landing page you control, or use Meta's lead-quality signals (contactability, timing, CRM outcome) as proxies (S3).

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• How to Detect Bot Traffic in Your Ad Campaign & Website
• Google Ads Bot Traffic: Detect and Block Fake Clicks
• Is Your Traffic Real? How to Diagnose AI-Bot Traffic in Google ...

Learn more

Visit the website for more information.