Seatext library / BotRefund evidence
How to Set Up Bot Blocking for Google Ads Campaigns: A Step-by-Step Implementation Guide
Enable Google's automatic invalid-click filters, add a client-side detection script that scores each click in real time, and feed confirmed bad IPs back into Google Ads IP exclusions. This three-layer approach stops bot traffic...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Start by turning on Google's automatic invalid-click filters in your account settings — they catch the most obvious fraud but let sophisticated bots through. Next, deploy a client-side detection script on your landing pages that analyzes browser behavior, mouse movement, and interaction timing to score every visit. Finally, export the IPs and device fingerprints that the script confirms as automated and add them to your Google Ads IP exclusion lists. This loop keeps your exclusion lists current without manual maintenance.
Why Google's Built-In Filters Aren't Enough
Google Ads runs real-time filters that block known data-center IPs and obvious click patterns. According to BotRefund's analysis, these automated layers "frequently fail to identify modern residential proxy networks and competitor click fraud," letting thousands of dollars in wasted spend slip through (S7). The platform's own documentation acknowledges that accidental clicks and low-quality traffic are not always credited back. If you rely only on Google's filters, you pay for visits that never had a chance to convert.
BotRefund's detection data shows that "bot clicks steal up to 20% of your Google and Meta ad budget" (S2). That percentage aligns with the 14% average bot click rate observed in a neobanking case study where $140,000 was recovered (S6). The gap exists because Google evaluates traffic at the network level, while sophisticated bots mimic real users on residential connections.
How Client-Side Bot Detection Works
A client-side script runs in the visitor's browser and collects behavioral evidence that network-level filters cannot see. BotRefund uses 106 independent checks across browser, network, device, and behavior dimensions (S4). Each check produces a signal — not a verdict — that feeds into an AI model weighing the complete pattern.
Key Behavioral Signals
- Ghost click detection: Catches click activity that happens without the natural sequence of human intent (S2).
- Honeypot trap interactions: Watches for bots that respond to hidden or intentionally deceptive page elements (S2).
- Robotic linear mouse movements: Flags unnaturally straight pointer paths that rarely appear in real user sessions (S2).
- Absence of humanlike mouse tremor: Looks for the tiny imperfections and jitter typical of human movement (S2).
- Superhuman input speed (<1ms): Identifies interactions that happen faster than a person could realistically perform (S2).
- Grid-aligned movement patterns: Detects movement that snaps to precise lines or blocks instead of natural curves (S2).
- Absence of clicks or scrolling: Highlights sessions that stay too static to match a real browsing journey (S2).
- Unnatural session durations: Catches visit lengths that are too short, too long, or too uniform to be human (S2).
Technical fingerprinting adds another layer. The Scrollbar Width Leak check spots a mismatch that real browsing sessions do not normally create (S4). The Clean Context Iframe check detects automation tools that patch or hide browser APIs (S5). These signals are cross-checked: "Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data" (S4).
Step-by-Step: Adding a Client-Side Detection Layer
- Create a detection account. Sign up for a bot detection service that provides a JavaScript tag and a dashboard for reviewing scored sessions. BotRefund offers a free bot audit that installs in "about one minute" with no credit card required (S2).
- Add the script to every landing page. Place the tag in the
<head>of each page that receives Google Ads traffic. Include it on thank-you and conversion pages so the system can link a scored session to a conversion event. - Verify data collection. Open the dashboard and confirm that sessions appear with behavior scores, device fingerprints, and IP addresses. Look for the evidence log that shows which of the 106 checks fired for each visit.
- Set a scoring threshold. Most platforms let you define what score counts as "confirmed bot." Start conservative — flag only sessions with multiple high-confidence signals (e.g., ghost click + superhuman speed + no scroll). You can tighten the threshold once you see false-positive rates.
- Enable automatic IP export. Configure the detection platform to push confirmed-bot IPs and device fingerprints to a webhook, CSV, or API endpoint that your team can consume.
- Build the exclusion sync. Write a lightweight script (or use a provided integration) that reads the export and adds each IP to your Google Ads campaign or account-level IP exclusion list. Run this sync daily or hourly depending on volume.
- Monitor match rates. Check Google Ads' "Invalid clicks" report weekly. You should see the platform's own filters catching some of the same IPs you excluded — confirmation that your layer is working upstream.
Feeding Confirmed Bad IPs Back Into Google Ads
Google Ads allows up to 500 IP exclusions per campaign and 1,000 at the account level. If you exceed those limits, prioritize the IPs with the highest bot scores and the most click volume. Use account-level exclusions for IPs that hit multiple campaigns.
When you file a refund request with Google's Click Quality team, the evidence you need includes GCLID logs, timestamps, and the behavioral proof your detection script captured (S7). BotRefund's case studies show that "audit trails are the gold standard that Meta ad reps accept" and the same principle applies to Google (S6). Export the session recordings, signal breakdowns, and IP lists from your detection dashboard and attach them to the formal investigation form.
Verifying the Setup Is Working
- Run a free bot audit. Before you spend budget, let the detection script run for 48–72 hours in "monitor only" mode. Review the percentage of sessions flagged as automated. BotRefund's homepage highlights that 83% of click behavior can be analyzed for ghost clicks and other signals (S2).
- Check conversion quality. After enabling exclusions, watch your CRM or lead-quality metrics. The FinTrust case study reported an 18% conversion rate increase after suppressing bot conversion events (S6).
- Audit Google's invalid-click report. In Google Ads, go to Tools > Billing > Invalid clicks. The credited amount should rise as your exclusion list catches traffic Google's filters missed.
- Test with a known VPN or proxy. Visit your own landing page from a residential proxy. The detection dashboard should flag the session. If it doesn't, adjust the scoring threshold or check script placement.
Common Mistakes That Break Legitimate Traffic
- Blocking on a single signal. A visitor on a corporate VPN may show one anomaly (e.g., unusual session duration) but behave humanly everywhere else. Require multiple corroborating signals before excluding.
- Excluding entire IP ranges. Residential proxies rotate IPs within a /24 block. Blocking the whole range catches innocent neighbors. Stick to individual IPs or use device fingerprinting alongside IP.
- Forgetting to update exclusions. Bot IPs churn daily. A static exclusion list becomes stale within weeks. Automate the sync or schedule a weekly manual refresh.
- Placing the script only on the landing page. If a bot clicks the ad, bounces, and never loads your script, you lose the signal. Ensure the tag fires on the first pageview after the click (use the GCLID parameter to confirm).
- Ignoring mobile app traffic. If you run App campaigns, the detection script must be inside the app (via SDK) or you must rely on Google's filters alone. Web-only tags miss in-app clicks entirely.
Key Facts
| Metric | Value | Source |
|---|---|---|
| Average bot click rate across case studies | 14% | S6 |
| Ad budget stolen by bot clicks (BotRefund estimate) | Up to 20% | S2 |
| Detection accuracy via corroborated signals | 99% | S4, S5 |
| Independent behavioral checks per visit | 106 | S4, S5 |
| Typical setup time for detection tag | About one minute | S2 |
| Refund lookback window for Google/Meta disputes | Dating back to 2017 | S2 |
| FinTrust recovered ad spend | $140,000 | S6 |
| FinTrust conversion rate increase after suppression | +18% | S6 |
Limitations & When This Advice Doesn't Apply
- Low-volume campaigns. If you spend under $1,000/month, the cost of a detection service may exceed the recoverable waste. Google's built-in filters are often sufficient at that scale.
- Pure brand campaigns with exact-match keywords. Competitor click fraud is rare on branded terms; bot traffic is mostly generic scrapers that Google already filters.
- App-only campaigns. Web-based detection tags cannot see in-app clicks. You need an SDK integration or must rely on platform filters.
- Strict privacy regulations. Some jurisdictions (e.g., GDPR with strict ePrivacy enforcement) may require consent before running behavioral fingerprinting scripts. Check local law before deploying.
- Shared corporate networks. Large offices often exit via a single IP. Excluding that IP blocks all employees. Use device fingerprinting and behavioral scoring instead of IP-only exclusions.
FAQ
How long does it take to see results after adding the detection script?
You'll see scored sessions within minutes of deployment. Meaningful exclusion-list impact appears after 24–48 hours once the sync runs and Google propagates the IP exclusions. Refund credits from Google's Click Quality team typically take 2–6 weeks after you submit evidence.
Will the detection script slow down my landing pages?
Modern detection tags load asynchronously and add less than 50 KB gzipped. BotRefund's tag is designed to initialize after the page is interactive, so Core Web Vitals stay unaffected. Always test with Lighthouse before and after deployment.
Can I use Google Analytics 4 or Tag Manager to block bots instead?
GA4 and GTM can filter reporting views, but they cannot modify Google Ads' real-time bidding or IP exclusion lists. You need a detection layer that writes back to Ads. Reporting filters only hide the waste; they don't stop you from paying for it.
What evidence does Google require for a refund request?
Google's Click Quality team expects GCLID logs, timestamps, IP addresses, and a narrative explaining why the clicks are invalid. Client-side behavioral proof — mouse-movement recordings, signal breakdowns, session replays — significantly increases approval odds (S7). BotRefund's platform exports this evidence in a format built for the dispute form.
Does this work for Performance Max and Demand Gen campaigns?
Yes. The detection script sits on your landing page, so it sees traffic from any campaign type that sends users to your site. The IP exclusions you push back apply at the account or campaign level, covering Search, Display, Video, Performance Max, and Demand Gen.
How often should I review the exclusion list?
Weekly at minimum. Bot IPs rotate fast; a list older than two weeks catches mostly stale addresses. Automate the sync from your detection platform to keep it current. If you manage exclusions manually, set a recurring calendar reminder.
What if my detection service flags a legitimate customer as a bot?
Review the session replay and signal breakdown. If only one low-confidence signal fired, whitelist that IP or device fingerprint in the detection dashboard and remove it from Google Ads exclusions. The 99% accuracy claim comes from corroborating multiple signals, not single rules (S4). False positives usually cluster around privacy tools, corporate proxies, or accessibility devices — adjust thresholds for those segments rather than disabling detection entirely.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.