Seatext library / BotRefund evidence
How to Set Up a Bot Detection System for Meta Ads: A Step-by-Step Implementation Guide
Set up bot detection for Meta ads by installing a client-side tracking script, configuring Meta Pixel and Conversion API to capture click IDs and session data, defining behavioral signals like rapid form fills and...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
To set up a bot detection system for Meta ads, start by placing a lightweight JavaScript tag on every landing page that loads after the Meta Pixel. The script captures browser-level signals — mouse movement, scroll depth, touch events, device fingerprint, and timing — that server logs cannot see. Pair this with Meta's Conversion API so each click ID (fbclid) ties a session to the exact campaign, ad set, and creative. Define the behavioral thresholds that separate humans from automation: forms submitted in under three seconds, zero scroll before conversion, identical field-entry patterns across sessions, and bursts of leads from a single placement. Feed those flagged sessions into a reporting layer that outputs click IDs, timestamps, session recordings, and signal-by-signal reasoning in the format Meta's invalid-traffic team expects. Tools like BotRefund automate the 110-signal analysis and produce refund-ready reports that have achieved an 83% approval rate across 2,500+ audits.
Why Bot Detection Matters for Meta Campaigns
Meta campaigns reach people across Facebook, Instagram, and eligible partner inventory at high volume. That reach is valuable, but it also means a lead campaign can receive accidental interactions, low-intent traffic, automated browsing, and deliberately fraudulent submissions. Industry audits consistently place automated traffic between 9% and 20% of paid clicks. Bots click ads, browse landing pages, abandon carts, sometimes even fill forms. To your billing statement, they are indistinguishable from customers.
When bots trigger conversion pixels, the algorithm learns from them. If bots make up 30% of the first traffic, Meta and Google can learn from that contaminated sample and send more of the campaign toward traffic that looks like it. The campaign can be effectively poisoned before enough genuine buyers arrive. This is how you get the CMO nightmare: the campaign starts great, something changes, and performance becomes inexplicably worse even though the creative, offer, landing page, and audience stay the same.
Core Components of a Meta Bot Detection System
A working system has three layers: collection, analysis, and evidence packaging.
- Collection layer: A client-side script that runs in the visitor's browser. It records behavioral data (scroll, mouse, touch, keyboard), browser fingerprints (canvas, WebGL, fonts, audio context), hardware signals (battery, memory, CPU cores), network attributes (IP type, latency, proxy indicators), and attribution tokens (fbclid, gclid, UTM parameters). Server-side logs alone miss advanced botnets that rotate residential proxies and mimic human headers.
- Analysis layer: A rules engine or ML model that scores each session against 110+ signals. BotRefund combines 110+ behavioral, browser, hardware, network, and attribution signals to identify automated traffic with 99% confidence. Each finding includes a clear, session-by-session explanation instead of a generic invalid-traffic estimate.
- Evidence layer: A report generator that outputs click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning. We turn each finding into a refund-ready report with click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning. The evidence is structured in the format platform teams use to review invalid traffic claims.
Step-by-Step Setup Process
- Audit current traffic before changing anything. Preserve attribution before changing the campaign. Keep campaign, ad set, creative, placement, and landing-page identifiers intact so every flagged session maps back to the exact charge.
- Install the client-side detection script. Add one script tag to the
<head>of every landing page used by Meta campaigns. No ad-account access required. One script tag · ~1 minute. The script loads asynchronously and does not block page render. - Connect Meta Pixel and Conversion API. Ensure the Pixel fires standard events (PageView, Lead, Purchase) and that the Conversion API sends the same events server-side with matching fbclid values. This dual feed lets you reconcile browser sessions with billed clicks.
- Define behavioral thresholds. Start with the signals worth investigating: Contactability — disconnected numbers, invalid email domains, repeated addresses, or an unusual concentration of one country code. Timing — several leads arriving in short bursts, forms submitted immediately after landing, or conversions concentrated at unusual hours. Session behavior — no scrolling, no field corrections, uniform click paths, and no meaningful time on the offer page. Campaign patterns — a sharp lead-quality difference by placement, creative, audience expansion, device, or landing page. CRM outcome — a high reported lead count paired with no calls connected, demos booked, qualified opportunities, or repeat engagement.
- Run a baseline collection period. Let the script gather 7–14 days of traffic without blocking. Review the dashboard for placement-level spikes, creative-level anomalies, and device-type outliers.
- Enable real-time suppression (optional). Once thresholds are validated, configure the script to stop firing conversion pixels for sessions that exceed the bot score. This prevents pixel poisoning — where bot conversions train the algorithm to find more bots.
- Generate refund-ready reports. Export flagged sessions with click IDs, timestamps, signal breakdowns, and session recordings. Format the data exactly as Meta's invalid-traffic reviewers expect. Behavioral logs showing that traffic was automated — rather than just suspicious — make the difference between an approved and denied claim.
- File claims on a rolling schedule. Submit evidence monthly or quarterly. Across 2,500+ brands audited, 83% of clients recover funds from Google and Meta. That high approval rate comes from three things: 99% bot-detection confidence, reports built in a format their teams can review, and deep experience negotiating successful claims.
Key Signals to Monitor
The following signals, drawn from forensic audits of Meta lead campaigns, consistently separate human from automated traffic:
| Signal Category | What to Watch | Why It Indicates Automation |
|---|---|---|
| Contactability | Disconnected numbers, invalid email domains, repeated addresses, unusual country-code concentration | Bots often use generated or scraped contact data that fails verification |
| Timing | Leads in short bursts, instant form submission after landing, conversions at unusual hours | Human reading and decision time is absent; scripts execute on load |
| Session Behavior | Zero scroll, no field corrections, uniform click paths, no meaningful time on page | Automation follows a fixed DOM path; humans hesitate, correct, explore |
| Campaign Patterns | Sharp lead-quality differences by placement, creative, audience expansion, device, landing page | Bot operators target specific placements or creatives; humans distribute more evenly |
| CRM Outcome | High reported leads, zero calls connected, no demos booked, no qualified opportunities | Ultimate proof: if no human ever responds, the leads were never human |
Server-Side vs Client-Side Detection
Server-side audits look at server log files. They monitor IP addresses, request headers, and user-agent data. While this catches basic scraper bots, it struggles to detect advanced botnets that use residential proxies, rotate fingerprints, and execute JavaScript. Client-side audits analyze the visitor's browser environment directly. They capture mouse movement, scroll velocity, touch events, keyboard timing, canvas fingerprints, WebGL parameters, battery status, and hardware concurrency. Without browser-level auditing, you pay for these visits. Bots load pages but do not read, scroll, or convert. This raises your customer acquisition costs (CAC) and lowers your campaign ROAS.
Automated bots — including competitive price scrapers, content crawlers, and residential proxy clickers — routinely simulate high-intent browsing behaviors. These bots spend significant dwell time on landing pages, navigate product categories, and execute DOM interactions that trigger standard tracking pixels. Because pixels cannot inherently verify human consciousness, they transmit positive feedback to the ad network. The algorithm interprets these bot sessions as success signals and optimizes toward more of the same.
Building Evidence for Refund Claims
Meta's automated detection systems catch only a fraction of invalid activity. Sophisticated bot traffic — using realistic fake accounts, residential proxies, and browser automation — routinely bypasses Meta's filters. To recover spend from this traffic, you need to proactively file a claim with evidence. Meta's refund process is less structured than Google's, which means having the right evidence is even more critical.
A claim-ready report includes:
- Click ID (fbclid) for every flagged session
- Campaign, ad set, creative, and placement identifiers
- Timestamp of click and conversion event
- Session recording or reconstructed event timeline
- Signal-by-signal breakdown: which of the 110+ checks failed and why
- Comparison to baseline human behavior on the same page
Experience negotiating with Google and Meta: we have worked through more than 2,500 audits and know how to present bot evidence to Google and Meta. We format the data, write the claim, and support the negotiation with the documentation and arguments their reviewers need to return money to advertisers.
Common Mistakes and Limitations
- Blocking too early. Suppressing pixels before validating thresholds removes legitimate conversions and skews optimization. Run a baseline period first.
- Relying only on IP reputation. Residential proxy networks make IP-based blocking ineffective against sophisticated operators.
- Treating all bad leads as bots. Not every bad lead is a bot, and that matters. Treating every unresponsive contact as fraud can make a team exclude a valuable audience. Start with a structured audit that compares ad-platform data, website sessions, and CRM outcomes before changing targeting or making a refund request.
- Ignoring pixel poisoning. If bot conversions feed the algorithm, the campaign learns to buy more bot traffic. Real-time suppression stops the feedback loop.
- Submitting generic "invalid traffic" estimates. Meta reviewers reject aggregate percentages. They require session-level proof with click IDs and behavioral reasoning.
- No CRM integration. Without downstream outcome data (calls connected, deals closed), you cannot distinguish low-intent humans from automation.
Key Facts
| Metric | Value | Source |
|---|---|---|
| Automated traffic share of paid clicks (industry audits) | 9% – 20% | S5 |
| BotRefund detection confidence | 99% | S2 |
| Signals analyzed per session | 110+ | S2 |
| Brands audited | 2,500+ | S2 |
| Refund claim approval rate | 83% | S2 |
| Script installation time | ~1 minute, one tag | S5 |
| Ad-account access required | No | S5 |
| Meta automated detection coverage | Fraction of invalid activity | S6 |
FAQ
How long does it take to see results after installing the script?
You need 7–14 days of baseline collection before validating thresholds. First refund-ready reports typically emerge in week 3–4.
Does the detection script slow down my landing pages?
The script loads asynchronously and adds less than 50 ms to page load. It does not block rendering or Core Web Vitals.
Can I use this with Meta Advantage+ Shopping and Advantage+ Leads campaigns?
Yes. The script captures fbclid on every click regardless of campaign type. Advantage+ campaigns are especially vulnerable to pixel poisoning because they rely heavily on conversion signals for optimization.
What if Meta denies my refund claim?
Denials usually mean the evidence lacked session-level behavioral proof. Re-file with click IDs, session recordings, and signal-by-signal reasoning. BotRefund's negotiation experience helps restructure denied claims.
Is this GDPR/CCPA compliant?
The detection script processes behavioral signals, not personal data. BotRefund's data handling is GDPR-aligned. No ad-account access means no PII exposure.
How much ad spend justifies a bot detection system?
If you spend over $10,000/month on Meta, the 9–20% automated traffic range means $900–$2,000/month at risk. The recovery estimator on BotRefund's site models recoverable spend based on your monthly budget.
Can I build this in-house instead of using a vendor?
You can collect browser signals with custom JavaScript, but building the 110-signal analysis engine, maintaining fingerprint databases, and formatting reports to Meta's exact specifications requires dedicated engineering. Most teams find the vendor route faster and more defensible.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.