Seatext library / BotRefund evidence
How to Log Bot-Related Signs from JavaScript: A Step-by-Step Guide
Use structured logging with timestamps, event types, and contextual data like clicked element and input speed. Combine client-side behavioral signals with server-side checks, then correlate them to avoid false positives. BotRefund uses 106 independent...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Why JavaScript Bot Logging Matters for Your Business
Bots don't just waste server resources. They steal ad budget and pollute your marketing data. BotRefund reports that invalid bot clicks can drain up to 20% of Google and Meta ad spend. A neobank client recovered $140,000 in wasted ad spend after implementing behavioral logging. Without clear logs, you can't prove fraud to ad platforms. You also can't tell if a low conversion rate is from bad targeting or bot traffic. Logging gives you the evidence to make that call.
Prerequisites for Reliable Bot Logging
Before writing any log code, define what you need to prove. Bots leave behavioral traces that differ from human users. You need three core components first. First, a logging endpoint that accepts JSON payloads. Second, a lightweight script you can add to every page without slowing it down. Third, a batching or timeout system to avoid blocking the main page thread during traffic spikes. Skipping these steps leads to messy logs or slow user experiences.
Step 1: Capture Core Interaction Event Data
For every user action you want to track, log these four base fields. First, a millisecond-precision timestamp using Date.now() or the Performance API. Second, the event type: click, input, scroll, mousemove, or touch. Third, the target element's ID, class, name, or CSS selector. Fourth, a unique session ID to group events from the same visit. This basic set lets you spot patterns like superhuman input speed or zero pointer movement. Without these fields, you can't reconstruct what a user did during a session.
Step 2: Log Timing and Speed Signals to Catch Superhuman Behavior
Bots fill forms or click links in milliseconds. Real humans take seconds to type and pause to read. Log the time between consecutive keydown events for form inputs. Record the duration between mousedown and mouseup for clicks. Track how long a user spends on each form field before moving on. Sub-millisecond intervals across multiple fields are a strong bot signal. BotRefund's Impossible Tab Speed check flags this exact pattern as one of its 106 independent bot detection signals. A single fast input isn't proof, but repeated sub-1ms intervals across a full form are very unlikely for a human.
Step 3: Record Pointer and Motion Patterns to Spot Robotic Movement
Human mouse movement is never a perfect straight line. It has tiny jitters and natural curves from hand tremors and adjustment. Bots often move pointers in perfectly straight lines or snap to grid-aligned positions. Log x and y coordinates for mousemove events, but sample them every 50ms to keep data volume low. Also log whether scroll events occur, and if a user focuses an input before typing. BotRefund tracks three related motion signals: robotic linear mouse movements, absence of humanlike mouse tremor, and grid-aligned movement patterns. These are all strong indicators of automated traffic when paired with other signals.
Step 4: Collect Browser and Device Context Flags
Automated browsers often leave small inconsistencies that real browsers don't. Log these lightweight flags as boolean or text fields. First, check if window.chrome exists on a Firefox visit, a common mismatch from headless tools. Second, check if navigator.webdriver returns true, a flag set by most automation frameworks. Third, look for mismatches between the user agent string and reported platform, like a Windows UA on a Mac-sized screen. BotRefund's Console Debug Evaluator is one of its 106 checks that looks for these exact API mismatches. Never block a user based on these flags alone. Privacy tools, corporate networks, and travel devices can cause false positives for real people.
Step 5: Correlate Client-Side Logs with Server-Side Data
Client-side logs are only one piece of the puzzle. Combine them with server-side data like IP address, request headers, and time between requests. A burst of POST requests from the same IP with no matching client-side events is a major red flag. Use a shared correlation ID that appears in both client and server logs to link events across systems. For Meta ad campaigns, look for patterns like form submissions immediately after landing, no scrolling, and uniform click paths. These session behavior signals often point to invalid traffic that standard platform filters miss.
Step 6: Structure Log Output for Analysis and Dispute Use
Send all events as JSON to a dedicated endpoint. Use a consistent payload shape to make analysis easy. A sample payload looks like this:
{
"sessionId": "abc123",
"event": "mousemove",
"timestamp": 1691234567890,
"target": "#submit-btn",
"x": 123,
"y": 456,
"duration": 12,
"gclid": "Cj0KCQjw4q...",
"fbclid": "IwAR2...",
"extra": {}
}Keep payloads small and batch events every 3 to 5 seconds. This reduces server load and still gives you a complete event sequence. Including GCLID and FBCLID values lets you tie bot activity directly to specific ad clicks. This is required to file a valid Google Ads refund request for invalid clicks. BotRefund automatically logs these click IDs to build audit-ready dispute reports for advertisers.
Test and Validate Your Logging Pipeline
After deploying your logging script, test it thoroughly. First, test with a standard browser to confirm normal human interactions are logged correctly. Then test with a headless browser like Puppeteer to confirm bot signals are captured: fast inputs, no pointer movement, and a true navigator.webdriver flag. Compare the two datasets to make sure there's a clear difference. If your logs don't show distinct patterns for bot and human sessions, you're missing key signals. Run regular audits to make sure your logging script still works after site updates.
Key Facts About Bot Detection Accuracy
| Fact | Source |
|---|---|
| BotRefund uses 106 independent checks to build a picture of a visit. | BotRefund |
| A single anomaly is not a bot verdict; cross-check with other signals. | BotRefund |
| Bot clicks can steal up to 20% of Google and Meta ad budget. | BotRefund |
| BotRefund claims 99% accuracy by corroborating multiple signals. | BotRefund |
Limitations of Client-Side Bot Logging
Client-side logging alone can't catch all bot types. Sophisticated bots use real residential proxies and human-in-the-loop CAPTCHA solving to bypass detection. These tools use real people to solve verification challenges, so they produce human-like behavioral signals. Logging also can't verify the identity of a user behind a VPN or corporate network. Always pair your logs with a scoring system and manual review for edge cases. Privacy tools, travel, and unusual devices can produce false positives if you rely on a single signal. BotRefund's 99% accuracy comes from cross-checking 106 independent signals, not just client-side behavior.
Frequently Asked Questions
Should I log all mouse movements?
No. Sampling every 50ms is enough to spot straight lines or robotic paths. Logging every pixel creates huge data volumes and slows down the page for users.
What if a legit user has no mouse movement because they use a touchscreen?
Then log touch events separately. The absence of pointer movement alone is not a verdict unless other signals like fast input speed or no scrolling agree. Touch interactions have their own natural patterns, like variable tap duration and slight position shifts.
Can I use the logs as proof for a Google Ads refund?
Yes, if your logs include GCLID or FBCLID values tied to each session. You need structured, exportable logs that show invalid click behavior to file a dispute with Google's Click Quality team. Many advertisers use these logs to win refunds for clicks dating back to 2017. BotRefund automates this process by capturing click IDs and generating dispute-ready reports.
How often should I send logs?
Batch events every 3 to 5 seconds. This balances real-time monitoring capabilities with server load. Sending logs one by one creates unnecessary network overhead and can trigger rate limits on your logging endpoint.
Will logging slow down my site?
Only if you log too much data or send logs synchronously. Use a non-blocking sender that runs in the background. Drop events if the buffer is full to avoid slowing down user interactions. A well-built logging script adds less than 1 millisecond to page load time.
What's the biggest mistake people make when logging bot signals?
Relying on a single signal like fast input speed. Always combine multiple signals to reduce false positives. A user on a slow phone may have slower input speed, while a bot on a fast server may have variable timing. Cross-checking signals gives a more accurate picture, just like BotRefund's 106-check system that achieves 99% accuracy by corroborating evidence.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.