Seatext library / BotRefund evidence
How BotRefund's 106 Detection Signals Affect Website Performance
BotRefund runs 106 independent browser, network, device, and behavioral checks on each visit. The signals are designed to operate asynchronously and in parallel, so the added latency stays low and does not block page...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
BotRefund uses 106 independent detection signals to decide whether a visit is human or automated. Each signal collects one objective fact — such as a hardware fingerprint mismatch, an impossible click speed, or a tampered window.open call — and feeds it into a prediction model that weighs the full pattern. Because the checks run in the browser without blocking the main thread, the typical overhead is well under the threshold that would shift Core Web Vitals.
| Factor | Impact | Notes |
|---|---|---|
| Signal count | 106 independent checks | Each check is a lightweight browser API call or behavioral observation. |
| Execution model | Asynchronous, non-blocking | Signals run in parallel; no single check halts page load. |
| Data payload | Minimal | Only the evidence vector is sent to the prediction API, not raw telemetry. |
| Core Web Vitals | No measurable regression in tested deployments | LCP, INP, and CLS remain stable after integration. |
| Setup time | About one minute | Single script tag; no server-side changes required. |
Why signal count alone does not determine overhead
The number of checks matters less than how they are scheduled. BotRefund batches its 106 signals into groups that share browser APIs — for example, hardware fingerprinting, canvas rendering, and audio context checks reuse the same permission prompts and execution contexts. This reduces redundant work and keeps the total CPU time small.
Think of it like a security guard who checks your ID, your bag, and your ticket at one station instead of three separate lines. The guard sees more facts, but you wait only once. Similarly, many signals run in the same micro-task or within the same animation frame. The browser does not notice the extra work.
Modern bot creators use sophisticated techniques. They route traffic through residential proxies, emulate human mouse movement, and randomize click intervals. A single signal cannot catch all of them. That is why BotRefund uses 106 independent checks that corroborate each other. The trade-off is not between speed and safety — it is between a lazy rule that misses bots and a thorough model that adds almost no delay.
How the detection pipeline works
- Page load: The BotRefund script loads asynchronously alongside other third-party scripts. It uses
asyncso it never blocks HTML parsing. - Signal collection: Each of the 106 checks runs in its own micro-task. Examples include the CPU Concurrency Lie check, Impossible Tab Speed, and
window.opentamper detection. - Evidence aggregation: Results are packaged into a compact evidence vector — a few hundred bytes — and sent to the prediction endpoint.
- AI verdict: The model returns a bot/human probability. The page can then suppress conversion pixels, trigger a challenge, or log the session.
The pipeline is designed to fail open. If the prediction API is unreachable, the script logs the session locally and does not block the user. This ensures downtime on BotRefund's side never hurts your site's availability.
How signals are batched to reduce CPU use
Batching is the key to low overhead. Rather than firing 106 separate timers, BotRefund groups signals into logical clusters. For example, all hardware fingerprinting checks — CPU, GPU, audio, canvas — run together because they need similar browser permissions. All pointer and motion checks share the same event listeners. This minimizes context switches and reduces the time spent on the main thread.
Here is a concrete example. The CPU Concurrency Lie check reads the number of logical processors reported by the browser. That is one API call. The Impossible Tab Speed check measures the time between two user interactions. That is a timestamp comparison. Neither requires heavy computation.
Most signals are pure reads from browser APIs or passive event listeners. They do not manipulate the DOM, trigger reflows, or cause layout shifts. This is why adding BotRefund rarely changes Lighthouse scores or field data.
Real-world impact on Core Web Vitals and user experience
Core Web Vitals measure loading performance, interactivity, and visual stability. The three metrics are LCP (Largest Contentful Paint), INP (Interaction to Next Paint), and CLS (Cumulative Layout Shift). BotRefund does not affect them in any meaningful way.
LCP depends on how fast the main content appears. The script loads asynchronously and does not delay resource loading. INP measures response to user input. Since signals run passively or in micro-tasks, they do not block event handlers. CLS measures unexpected layout shifts. BotRefund never injects visible elements or changes dimensions.
In controlled tests, Lighthouse Performance scores changed by ±1 point, which is within normal run-to-run variance. Field data from production sites shows no regression in LCP, INP, or CLS after installation. The only visible effect is that genuine human users are never challenged, while bot traffic is silently dropped or flagged.
Comparing detection approaches: coverage vs. performance
| Approach | Coverage | Typical latency added | Maintenance burden |
|---|---|---|---|
| Few rule-based checks (5–10) | Low — misses AI-driven bots | <5 ms | Low — rules rot quickly |
| BotRefund 106 signals + AI | High — catches emulation, proxies, click farms | <50 ms (non-blocking) | Zero — model updates server-side |
| Full behavioral recording (replay scripts) | Very high | 100–300 ms + large payloads | High — privacy compliance, storage costs |
Rule-based systems rely on fixed thresholds. A rule like "block visits that click faster than 1 ms" is easy to bypass. Modern bots introduce random delays and humanlike jitter. BotRefund's 106 signals capture many dimensions: browser fingerprint, network characteristics, device properties, and nuanced behavior patterns like ghost clicks, robotic mouse movements, and absence of tremor.
Full behavioral recording captures every mouse move and scroll, but that generates huge payloads and raises privacy concerns. BotRefund only sends a compact evidence vector, not raw telemetry. This keeps bandwidth near zero and eliminates the need to store recordings.
How to monitor performance after integrating BotRefund
If you want to measure the impact on your own site, follow these steps:
- Before installing BotRefund, record your baseline Core Web Vitals using Chrome DevTools or PageSpeed Insights. Note the 75th percentile values for LCP, INP, and CLS.
- Install the script and wait at least 24 hours to collect enough field data.
- Compare the new values with your baseline. Look for changes larger than 0.1 seconds for LCP or 50 ms for INP.
- Check your server logs for any increase in bandwidth. The evidence vector is a few hundred bytes per visit, so the difference should be negligible.
- Review BotRefund's dashboard for latency metrics. It shows the average time spent in signal collection per session.
Most users see no measurable difference. If you have a very strict Content Security Policy, you may need to adjust script-src and connect-src to allow the BotRefund endpoint. That is a one-time configuration change, not a performance issue.
Limitations and when this advice does not apply
- Sites with extremely strict Content Security Policies may need to adjust
script-srcandconnect-srcdirectives to allow the BotRefund endpoint. - Pages that already run heavy client-side A/B testing or personalization scripts should audit total main-thread time before adding any third-party script.
- The 99% accuracy figure reflects the overall model across browser, network, device, and behavior evidence; no single signal (including the 106th) delivers that accuracy alone.
- If your site is a simple static page with almost no JavaScript, adding any third-party script can feel heavy relative to your current load. In such cases, test on a staging environment first.
- BotRefund is not a substitute for a Web Application Firewall (WAF). It focuses on ad fraud and invalid traffic, not on attacks like SQL injection or XSS.
Terminology
- Signal: One independent check that produces a single piece of evidence (e.g., "CPU concurrency mismatch").
- Evidence vector: The compact payload sent to the prediction API containing all signal results for a session.
- Cross-checked context: The process of verifying whether multiple signals support the same conclusion before the AI weighs the pattern.
- Pixel poisoning: When bot conversions train ad-platform algorithms to optimize for invalid traffic.
- Residential proxy: A network of hijacked consumer devices that hides a bot's true IP address, making it look like a real local user.
FAQ
Does the script block rendering?
No. The script loads with async and all signal collection runs in micro-tasks after the initial paint.
Can I disable specific signals?
Enterprise customers can adjust the evidence vector via the dashboard; self-serve accounts run the full 106-signal suite.
What happens if a signal fails to execute?
The evidence vector simply omits that signal. The AI model handles missing features gracefully because it was trained on incomplete vectors from privacy tools and restricted environments.
How often does the model update?
Server-side. No client-side redeploy is needed when new bot patterns are learned.
Will this affect my Lighthouse score?
In controlled tests, Lighthouse Performance scores changed by ±1 point, which is within normal run-to-run variance.
Is there a fallback if the prediction API is unreachable?
The script fails open — it logs the session locally and does not block legitimate users.
Can I see the raw signal data for debugging?
Yes. The dashboard shows a per-session evidence breakdown with timestamps and raw values for each of the 106 checks.
Does BotRefund slow down interactions on mobile devices?
No. The signal collection is designed to use minimal CPU, and most checks are simple API reads. Mobile browsers handle these efficiently, and the script does not block touch events or scrolling.
What if my site uses a service worker or a CDN that strips third-party scripts?
BotRefund works like any other third-party script. If your CDN filters it, you can self-host the script and point to your own copy. The evidence vector still goes to the prediction API.
How does BotRefund compare to CAPTCHA?
CAPTCHA interrupts the user and adds seconds of delay. BotRefund runs invisibly and only challenges the most suspicious sessions. For legitimate visitors, there is no friction.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.