Seatext library / BotRefund evidence
How to Set Up Bot Detection for Google Ads Campaigns
Start by enabling Google's built-in invalid click filters, then add a client-side detection script that records behavioral evidence for each click. BotRefund installs in about one minute, runs 106 independent checks, and exports video-backed...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Enable Google's native invalid-click protection first
Google Ads automatically filters some invalid traffic, but its real-time systems miss modern residential proxy networks and sophisticated competitor click fraud. Turn on the standard invalid-click filters in your account settings, then supplement them with a tool that captures client-side proof for every paid visit.
To enable the filters, sign in to Google Ads, click the tools icon in the top navigation, select "Settings" under the "Setup" column, then choose "Account settings." Scroll to the "Invalid clicks" section and ensure "Automatically filter invalid clicks" is checked. This setting is on by default for most accounts, but verify it has not been disabled. Google's documentation notes that these filters catch basic patterns like repeated clicks from the same IP within a short window, but they do not analyze browser behavior, mouse dynamics, or device fingerprints.
After confirming the setting, open the "Billing" page, click "View transactions," and look for the "Invalid activity" line item. This shows credits Google has already applied. If you see zero credits despite suspicious traffic patterns, you need the additional evidence layer described in the next steps.
Add a client-side detection script to your landing pages
Paste the BotRefund snippet into the <head> of every page that receives Google Ads traffic. The script loads asynchronously, adds no visible latency, and begins recording behavioral signals immediately. Setup takes roughly one minute and requires no credit card.
For a typical WordPress site, go to Appearance > Theme File Editor, select header.php, and insert the snippet just before the closing </head> tag. If you use Google Tag Manager, create a new Custom HTML tag, paste the snippet, set the trigger to "All Pages" or a trigger that fires only on landing pages with GCLID parameters, and publish the container. For AMP pages, add the script via the amp-script component in your AMP template. For single-page applications, ensure the script initializes on each route change so that every paid visit is captured.
The snippet is roughly 2 KB gzipped. It does not set cookies, does not collect personally identifiable information, and respects Do Not Track headers. If your CSP policy blocks inline scripts, add the script's domain to your script-src directive or host the file on your own CDN and update the snippet URL.
Let the engine gather 106 independent signals per session
BotRefund evaluates each visit across browser, network, device, and behavior dimensions. Signals include ghost-click detection (clicks without human intent sequence), honeypot trap interactions, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed under one millisecond, grid-aligned movement patterns, static sessions with no scrolling, and unnatural session durations. Each signal is kept as evidence, not a verdict, and cross-checked against the full pattern before the AI model assigns a 99% accuracy bot-or-human classification.
Two signals documented in the source pack illustrate the depth of the checks. The Scrollbar Width Leak test measures whether the browser reports a scrollbar width that matches the operating system's native rendering. Automated browsers running in headless mode or with stealth plugins often report a width of zero or a fixed value that does not change with OS theme settings. A real browser on Windows, macOS, or Linux produces a width that varies with user preferences and display scaling. The Clean Context Iframe test loads an invisible iframe and compares the JavaScript environment inside it to the top-level window. Automation frameworks that patch navigator.webdriver, chrome.runtime, or other APIs often fail to propagate those patches into the iframe context, creating a detectable mismatch.
Other signal categories include: network-level checks (residential proxy detection, data-center IP reputation, TCP fingerprint consistency), device-level checks (battery API consistency, hardware concurrency vs. reported cores, WebGL renderer fingerprint), and behavioral checks (form completion velocity, copy-paste patterns, focus/blur event sequences, scroll depth variance). The 106 signals are not weighted equally; the AI model learns which combinations are predictive for your specific traffic mix during the initial audit period.
Review the free AI audit and export proof logs
After traffic flows, open the BotRefund dashboard and run the free AI audit. The report lists every flagged session with a video replay, GCLID, timestamp, and the specific signals that triggered the classification. Export the CSV or PDF bundle; this is the evidence package Google's Click Quality team expects when you file a manual refund request.
The dashboard shows a summary card with total paid clicks, bot percentage, estimated wasted spend, and a trend line over the last 30 days. Click any session row to open the session detail view. The video replay reconstructs the visit using the recorded DOM mutations, mouse coordinates, scroll positions, and keyboard events. You can scrub the timeline, jump to the moment a signal fired, and see a side panel listing the active signals at that timestamp. The CSV export includes columns for GCLID, campaign ID, ad group ID, keyword, click timestamp, bot probability score, top five contributing signals, and a link to the hosted video replay. The PDF bundle packages the same data with embedded screenshots for each flagged session, formatted for easy attachment to the Google investigation form.
File a Google Ads refund request with the evidence bundle
Navigate to the Google Ads Click Quality investigation form, attach the exported logs, and reference the GCLIDs for the disputed clicks. Google categorizes refund-eligible invalid activity into competitor click activity, publisher click fraud, and bot traffic or web scrapers. The client-side behavioral proof—especially video replays—turns a subjective dispute into a documented case that reps can approve quickly.
Step-by-step workflow from the source pack: (1) In Google Ads, click the help icon (question mark) in the top right, select "Contact us," then choose "Click quality" as the issue type. (2) Fill in the required fields: customer ID, date range of the disputed clicks, and a brief description such as "Automated browser traffic detected via client-side behavioral analysis." (3) Attach the PDF evidence bundle and the CSV file. (4) In the description box, list the GCLIDs you want reviewed, grouped by campaign. (5) Submit the form. Google typically responds within 5-10 business days. If the request is approved, credits appear on your next billing statement under "Invalid activity." If additional information is requested, reply with the specific session IDs and video links from the dashboard. The source pack notes that refunds can be claimed for spend dating back to 2017, so you can audit historical campaigns if you have GCLID logs stored.
Suppress bot conversions so bidding algorithms retrain on real users
Beyond refunds, feed the bot classifications back into your conversion tracking. Suppress conversion events for sessions flagged as automated so Google's and Meta's optimization algorithms stop training on fake leads. One neobank client recovered $140,000 in ad spend and saw an 18% conversion-rate lift after suppressing bot registrations that had distorted their CAC metrics.
The FinTrust case study (source S6) shows a modern neobank offering fee-free digital accounts. They faced massive bot registration attempts on search ad landing pages that mimicked real users, inflating CAC and corrupting the conversion pixel. After installing BotRefund, they suppressed conversion events for sessions with automated browser emulation signals. This ensured Facebook and Google AI trained only on verified bank accounts. The result: $140,000 in ad spend refunded, a 14% average bot click rate identified, and an 18% conversion-rate increase. Other verticals in the case study catalog (source S1) show similar patterns: a logistics SaaS recovered $45,000 with a 28% lift, a healthcare CRM recovered $58,000 with a 25% lift, a DevOps platform recovered $92,000 with a 30% lift, and a luxury real estate agency recovered $84,000 with a 33% lift. In each case, the sequence was: install script, run audit, export evidence, file refund requests, then implement conversion suppression via the platform's offline conversion API or GTM data layer push.
Complementary strategies and trade-offs
Bot detection scripts are one layer. Consider these complementary approaches and their trade-offs:
- IP exclusions in Google Ads: Add known data-center IP ranges or VPN exit nodes to your campaign IP exclusion lists. Pros: free, native, immediate. Cons: residential proxies rotate IPs constantly; lists become stale quickly; maximum 500 IP entries per campaign.
- Click fraud protection software (e.g., ClickCease, PPC Protect, Fraud Blocker): These tools often combine IP reputation databases with basic behavioral rules. Pros: managed dashboards, automated exclusion list sync. Cons: most rely on server-side logs only, missing client-side signals like mouse dynamics; pricing typically starts at $50-100/month per account; refund evidence is usually limited to IP and timestamp.
- Server-side log analysis: Export Google Ads click logs (GCLID, timestamp, IP, user agent) and join with your web server access logs. Look for patterns: high bounce rates from specific ISPs, identical user agents across many clicks, clicks with zero second session duration. Pros: no additional script on page. Cons: cannot see mouse movements, scroll behavior, or browser fingerprint anomalies; requires engineering time to build and maintain pipelines.
- reCAPTCHA or hCaptcha on forms: Adds a challenge before form submission. Pros: blocks simple bots at the conversion point. Cons: adds friction for real users; sophisticated bots solve captchas via human farms; does not protect the click itself, only the form submit.
- UTM parameter validation: Require specific UTM parameters on landing page URLs and reject direct visits that lack them. Pros: simple to implement. Cons: breaks legitimate bookmark sharing; bots can copy full URLs with UTMs.
Trade-off summary: client-side behavioral detection (BotRefund) provides the richest evidence for refunds and the cleanest signal for conversion suppression, but requires a script on every landing page. IP exclusions and server-side analysis are free but blind to residential proxy traffic. Click fraud SaaS offers convenience but less granular evidence. A layered approach—Google filters + client-side detection + periodic IP list updates—covers the widest range of invalid traffic types.
Key facts
| Metric | Detail |
|---|---|
| Setup time | About one minute to add the script to your site |
| Detection signals | 106 independent browser, network, device, and behavior checks |
| Classification accuracy | 99% via AI model that weighs the complete signal pattern |
| Evidence format | Video replay, GCLID, timestamp, and signal breakdown per session |
| Refund lookback | Google Ads spend recoverable back to 2017 |
| Typical bot click rate | Up to 20% of Google and Meta ad budget |
Limitations and when this approach does not apply
Google's automated filters still run; the third-party layer adds evidence, not a replacement. The script must load on every landing page that receives paid traffic—if you use multiple domains or AMP pages, add the snippet to each. Refund approval depends on Google's Click Quality team; BotRefund supplies the proof but cannot guarantee a credit. The 99% accuracy figure reflects the AI model's internal validation; real-world false-positive rates vary with traffic mix and privacy-tool usage.
Additional limitations: the script cannot detect bots that execute full JavaScript and perfectly mimic human behavior (rare but theoretically possible). Privacy-focused browsers (Brave, Tor) or extensions that randomize fingerprints may increase signal noise. The free audit tier has a monthly click volume cap; high-spend accounts need a paid plan for continuous monitoring. The refund process is manual and requires a Google Ads representative to review the evidence; approval timelines vary by region and account history.
FAQ
Does BotRefund replace Google's built-in invalid click filters?
No. Google's filters run automatically. BotRefund adds client-side behavioral evidence that you can submit when Google's filters miss something.
How long does it take to see results after installing the script?
Data appears in the dashboard as soon as paid visits occur. Run the free AI audit after a few hundred clicks to get a representative sample.
What if my site uses multiple domains or AMP pages?
Add the same snippet to the <head> of every page that receives Google Ads traffic, including AMP templates and any subdomains used for campaigns.
Can I use the evidence for Meta (Facebook/Instagram) refunds too?
Yes. The same behavioral logs and video replays work for Meta's invalid traffic dispute process.
Does the script slow down page load?
It loads asynchronously and adds no visible latency to the user experience.
What happens if a real user is flagged as a bot?
The AI model weighs the full 106-signal pattern; a single anomaly is never a verdict. Privacy tools, corporate networks, and unusual devices can create outliers, but cross-checking across browser, network, device, and behavior data keeps false positives low.
Is there a cost to try the detection?
The bot audit is free to start; no credit card is required. Pricing scales with monthly ad spend tiers.
How do I suppress bot conversions in Google Ads?
Use the offline conversion import API or Google Tag Manager to send a conversion event with a value of zero for sessions flagged as bots, or exclude the GCLIDs from your conversion tracking via a custom dimension filter.
What is the Scrollbar Width Leak signal?
It checks whether the browser reports a scrollbar width consistent with the operating system's native rendering. Automated browsers often report zero or a fixed value, while real browsers vary with user settings.
What is the Clean Context Iframe signal?
It loads an invisible iframe and compares the JavaScript environment inside it to the top-level window. Automation tools that patch browser APIs often fail to propagate those patches into the iframe, creating a detectable mismatch.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.