Seatext library / BotRefund evidence
How Reliable Are Browser API Inconsistency Checks for Detecting Automation?
Browser API inconsistency checks are moderately reliable as a single signal but not foolproof on their own. They work well against basic bots that fail to replicate native browser behavior, yet advanced automation tools...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Browser API inconsistency checks catch automation by looking for mismatches between what a real browser exposes and what an automated browser reveals after patching or hiding its identity. A normal browser runs standard APIs as designed; automation tools often modify those APIs, and those modifications can break when the browser is probed from another angle. BotRefund uses checks like Playwright Init Scripts, Clean Context Iframe, and Scrollbar Width Leak as three of its 106 independent signals. Each check adds one objective fact about the visit, but the system treats every signal as evidence—not a verdict—and cross‑checks it against other browser, network, device, and behavior data before an AI model weighs the complete pattern. That corroboration is why BotRefund reaches 99% accuracy.
What Browser API Inconsistency Checks Actually Do
These checks execute small scripts in the visitor's browser and compare the results against a baseline of genuine browser behavior. For example, the Playwright Init Scripts check looks for initialization artifacts that automation frameworks leave behind. The Clean Context Iframe check loads an isolated iframe and verifies that browser APIs behave consistently inside and outside that frame. The Scrollbar Width Leak check measures whether scrollbar dimensions match the OS and browser defaults, which scripts often fail to replicate perfectly. Each check is independent, so a bot that passes one may still fail another.
Why Single Checks Are Not Enough
Privacy tools, corporate proxies, unusual devices, and even legitimate browser extensions can produce anomalies that look like automation. If you block every visitor who trips a single API check, you will false‑positive real users. BotRefund's documentation states: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." That is why the platform keeps each signal as evidence and only reaches a conclusion after cross‑checking across multiple categories.
How BotRefund Combines Signals for Reliability
- Independent evidence: Each of the 106+ checks contributes one objective fact.
- Cross‑checked context: The system tests whether other signals—network reputation, device fingerprint consistency, pointer behavior, scroll timing, click patterns—support the same story.
- AI prediction: A model weighs the complete pattern instead of trusting a raw rule, producing a bot-or-human classification with 99% confidence.
This layered approach mirrors how fraud analysts work: no single tell proves fraud, but a consistent cluster of tells across independent dimensions makes a high‑confidence case.
Trade‑off Table: API Inconsistency Checks vs. Other Detection Layers
| Detection Layer | What It Catches | Typical False‑Positive Risk | Evasion Difficulty | Best Role in a Stack |
|---|---|---|---|---|
| Browser API inconsistency checks | Automation frameworks that patch or hide native APIs (Playwright, Puppeteer, Selenium) | Moderate — privacy tools, extensions, enterprise policies can trigger anomalies | Medium — advanced stealth browsers rebuild APIs to match native behavior | Early evidence layer; flags sessions for deeper scrutiny |
| Behavioral biometrics (mouse tremor, scroll timing, click speed) | Scripted interactions that lack human micro‑variations | Low — genuine users rarely move at superhuman speed or with zero tremor | High — requires sophisticated human‑like input synthesis | Core conviction layer; hard to fake at scale |
| Network & device fingerprinting (IP reputation, TLS, canvas, WebGL) | Data‑center traffic, VPNs, mismatched hardware claims | Low to moderate — shared corporate IPs or rare devices can look suspicious | Medium — residential proxies and device farms reduce signal strength | Context layer; explains where the visitor comes from |
| Server‑side log analysis (headers, IP velocity, request patterns) | Basic scrapers, high‑volume crawlers, known bad IP ranges | Low — stateless, no client execution needed | Low — rotating proxies and header spoofing bypass easily | First‑line filter; cheap but blind to client‑side evasion |
Takeaway: API checks are a necessary early signal but insufficient alone. Behavioral biometrics provide the hardest‑to‑fake conviction. Network and server layers add context and volume filtering. A production stack needs all four.
Common Bypass Techniques and Limitations
- Stealth browser patches: Tools like Playwright Stealth, Puppeteer Extra, and undetected‑chromedriver rewrite or hide automation‑specific properties (e.g.,
navigator.webdriver,window.chrome.runtime). - API reconstruction: Advanced bots re‑implement native APIs in JavaScript so consistency checks return expected values.
- Real browser automation: Some operators drive real Chrome/Firefox instances via CDP or WebDriver BiDi, leaving near‑zero API artifacts.
- Environment spoofing: Virtualized devices with genuine browser binaries but synthetic hardware fingerprints.
Each bypass raises the cost and complexity for the attacker. The goal of a detection stack is not to make evasion impossible but to make it expensive enough that most automated traffic becomes unprofitable.
Practical Scenarios Where This Matters
Paid‑search and paid‑social campaigns
Bot clicks inflate CAC and poison conversion pixels. BotRefund's homepage notes that bot clicks steal up to 20% of Google and Meta ad budgets. API inconsistency checks flag the automation layer; behavioral signals confirm the lack of human intent; the combined evidence produces refund‑ready reports that Google and Meta accept.
Lead‑gen form spam
Automated form submissions often complete fields faster than humans and skip scroll/hover events. API checks catch the automation framework; timing and motion signals catch the inhuman speed.
Content scraping and inventory hoarding
Scrapers that render JavaScript still expose API inconsistencies when they patch navigator or document objects. Combined with navigation‑flow analysis, these sessions can be blocked or challenged without affecting real users.
Key Facts from BotRefund's Detection Architecture
| Fact | Detail | Source |
|---|---|---|
| Total independent checks | 106+ (Playwright Init Scripts, Clean Context Iframe, Scrollbar Width Leak, etc.) | S1, S5, S7 |
| Signal categories | Browser, network, device, behavior | S1, S2 |
| Detection confidence | 99% accuracy via AI model weighing complete pattern | S1, S2 |
| Refund success rate | 83% of 2,500+ audited clients recover funds from Google and Meta | S2 |
| Report format | Refund‑ready with click IDs, campaign details, timestamps, session recordings, signal‑by‑signal reasoning | S2 |
| Single‑check policy | "A single anomaly is not a bot verdict" — every signal is evidence, not a rule | S1, S5, S7 |
FAQ
Can a single API inconsistency check reliably block bots?
No. Privacy tools, corporate networks, and unusual devices regularly trigger the same anomalies. Treat each check as one piece of evidence, not a block rule.
Which API checks are hardest for bots to spoof?
Checks that measure cross‑context consistency (e.g., Clean Context Iframe) and checks that rely on OS‑level rendering details (e.g., Scrollbar Width Leak) are harder to fake than simple property existence tests.
How do stealth browsers bypass API checks?
They patch or re‑implement automation‑specific properties (navigator.webdriver, window.chrome internals) and mimic native API behavior. The most advanced ones run real browser binaries via CDP, leaving almost no API artifacts.
What is the false‑positive rate when relying only on API checks?
BotRefund does not publish a standalone false‑positive rate for API checks alone because they are never used in isolation. The 99% overall accuracy comes from the full 106+ signal ensemble.
Do API checks work against headless Chrome/Firefox?
Yes, default headless modes expose numerous inconsistencies (missing chrome object, different permission defaults, altered user‑agent). Stealth plugins reduce but rarely eliminate all of them.
How often should detection signals be updated?
Continuously. Browser versions change, new automation frameworks appear, and stealth plugins evolve. BotRefund's 106+ checks are maintained as a living library rather than a static ruleset.
What should I compare when evaluating bot detection vendors?
Compare: (1) number and independence of client‑side signals, (2) whether they cross‑check browser, network, device, and behavior layers, (3) if they produce refund‑ready evidence formatted for Google/Meta, (4) documented refund success rate, and (5) whether they explain each finding per session instead of giving a generic score.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund runs 106+ independent client‑side checks—including Playwright Init Scripts, Clean Context Iframe, and Scrollbar Width Leak—alongside network, device, and behavioral signals. Each check adds one objective fact; the AI model weighs the full pattern to reach 99% confidence. The output is a session‑by‑session report with click IDs, timestamps, and signal‑by‑signal reasoning formatted for Google and Meta refund reviews. Across 2,500+ audits, 83% of clients recover wasted ad spend. You can start with a free bot audit to see the evidence layer on your own traffic.