How to Set Up Alerts for Selenium Bot Activity

Set up alerts for Selenium bot activity by connecting a detection layer to an alerting channel. The workflow is simple: collect browser signals, score them as a group, and push the result to Slack, email, or a webhook when a threshold is crossed.

This guide walks through the setup in order, including prerequisites, alert thresholds, one verification step, and the limits of alerting.

One distinction up front: Selenium's own documentation uses alerts for JavaScript pop-up boxes such as alert(), confirm(), and prompt(). This article is about alerts that notify you when a Selenium-driven bot is on your site, not Selenium code that handles browser pop-ups.

What counts as Selenium bot activity

Selenium bot activity is automated browser traffic driven by Selenium WebDriver. It can scrape content, click ads, submit forms, or probe for weaknesses.

Before you build alerts, define the behavior you care about. Scraping alerts might focus on fast page views. Ad-click alerts might focus on clicks without human intent. Account abuse alerts might focus on form submissions.

Your alert rules should match the damage you are trying to stop.

Prerequisites

• A page or tag manager where you can add JavaScript.
• An alert destination: Slack webhook, email endpoint, or monitoring API.
• A way to store session IDs and timestamps.
• If bot traffic hits paid ads: a way to capture GCLIDs, FBCLIDs, or similar click IDs.
• A test Selenium script to confirm the alert works.

You do not need special server access for client-side detection. The detection script runs in the visitor's browser.

How to set up alerts for Selenium bot activity

Use these steps in order. Step 6 is the verification step.

Step 1: Capture the signals that separate bots from people

Start with signals Selenium usually leaves behind. In JavaScript, check for automation flags such as navigator.webdriver. A real user's browser rarely exposes them.

Add checks for debugger traces, network mismatches, and behavior. BotRefund groups these into network and geolocation vectors, evasion and debugger traps, and behavioral signals such as pointer path and session pacing.

Step 2: Score signals together, not one by one

The most common mistake is alerting on one signal. A VPN user can look like a bot by IP. A fast clicker can look automated. One signal can be misleading.

Give each signal a weight, then combine them into a score from 0 to 1. For example, a session with automation properties, a CDP leak, and no mouse movement should score higher than a session with one odd header.

For stronger detection, send the signals to a prediction service that has seen many bot and human sessions. This is the approach BotRefund uses: 106 browser, network, hardware, and behavior signals are evaluated together before a visit is classified.

Step 3: Define thresholds and severity

Set a low threshold for logging and a high threshold for alerting.

• Score 0.0 to 0.3: human, take no action.
• Score 0.3 to 0.6: suspicious, log it.
• Score 0.6 to 0.8: likely automated, send a low-priority alert.
• Score 0.8 to 1.0: strong bot signal, page the on-call team or block the session.

These ranges are an example. Tune them to your traffic.

Step 4: Send the alert to the right channel

Create a webhook in Slack, Teams, or your monitoring tool. When the score crosses your threshold, POST a JSON payload with the session ID, the score, and the signals that fired.

A good payload answers three questions: who was this session, why did it look automated, and when did it happen.

Step 5: Save evidence for ad refunds

If Selenium activity is clicking Google or Meta ads, an alert is not enough. You need click IDs and behavioral proof. BotRefund captures click IDs and generates refund-ready reports so the invalid activity can be disputed with Google and Meta.

Step 6: Verify the alert pipeline

Run a Selenium script against the page and confirm the alert fires. Then browse the same page normally and confirm the score stays low. If both pass, your alert setup works.

Key facts: Selenium bot detection signals

Use this table as a reference when you build alert rules.

Signal group	What it checks	Example signals
Network, VPN, and geolocation	Whether network identity and browser location agree	WebRTC network leak, IP inconsistency, timezone evasion, DNS routing mismatch
Evasion, debugger, and anti-stealth	Whether automation tools left traces on the browser	CDP debugger leak, automation properties, native patching, engine mismatch
Behavior	Whether movement and session pacing look human	Ghost clicks, linear mouse paths, superhuman input speed, missing mouse tremor, unnatural session durations

BotRefund's prediction AI sees how 106 signals fit together before deciding whether a visit is human or automated.

Build it yourself or use a managed detector

You have three realistic options.

Option 1: single-signal checks. Fastest to build, but it will miss modern Selenium setups and create false alerts. Use it only for a first look.

Option 2: custom scoring with webhooks. Gives you full control over thresholds and routes. You maintain the detector, the scoring model, and the alert payloads. Good for teams that already run a monitoring stack.

Option 3: managed detection. A service installs a script, evaluates many signals, and delivers reports. BotRefund, for example, adds protection in about one minute, needs no credit card to start, and is built for proving invalid clicks to ad platforms.

Choose option 1 if you only need a quick data point. Choose option 2 if you need custom alert routing and have engineering time. Choose option 3 if you want coverage fast and also want refund evidence.

Limitations: what alerts cannot fix

Alerts tell you a bot is there. They do not stop the bot by themselves. You also need a response plan: block, rate-limit, or invalidate the session.

No single signal is reliable. Selenium can be configured to patch some properties, so your detector needs multiple layers.

Alert fatigue is real. If every suspicious session pages someone, important alerts get ignored. Use thresholds and severity levels.

If you run paid ads, refunds are not automatic. Google credits invalid activity only when you understand the claim process and provide evidence. Alerts can be part of that evidence, but click IDs and session logs matter more.

Alert terminology

• Automation properties: browser flags that reveal an automated driver.
• CDP debugger leak: a Chrome DevTools Protocol connection left open by automation.
• WebRTC network leak: browser network paths that reveal a location different from the one the browser claims.
• Ghost click: a click event that happens without a natural human action sequence.
• Honeypot trap: a hidden page element that bots interact with but people do not see.
• Session duration: visit length that is too short, too long, or too uniform to be human.

Each of these is a signal. None is proof by itself.

FAQ

Why can't I just block Selenium's IP ranges?

Selenium traffic often comes from residential proxies and cloud IPs that change constantly. IP blocking creates false positives and misses the bot.

Should every alert automatically block the visitor?

No. Start with logging and low-priority alerts. Automatic blocking should only happen at a very high confidence score, after you test against real users.

What should I do when an alert fires?

Look at the session ID, the signals that fired, and the score. If the session clicked an ad, save the click ID and behavioral evidence. Then decide whether to block the session or add the pattern to your rules.

What does an alert setup cost?

A simple webhook alert costs only engineering time. Managed services vary. BotRefund starts with a free install and no credit card; check the vendor's site for current terms.

Can alerts protect conversion tracking?

Only if invalid sessions are filtered before they fire conversion pixels. Alerts alone cannot clean the pixel. You need a detector that prevents bot sessions from triggering conversion events.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• JavaScript alerts, prompts and confirmations | Selenium
• How to handle Alerts & Popups in Selenium [2026] | BrowserStack
• Alerts in selenium

How BotRefund can help

BotRefund uses prediction AI that reads 106 browser, network, hardware, and behavior signals together, so a single misleading signal does not trigger a false verdict. Its detection covers Selenium traces such as CDP debugger leaks and automation properties, plus behavioral signals like ghost clicks and unnatural pointer paths.

If the bot activity is clicking Google or Meta ads, BotRefund helps prove invalid clicks, prepare evidence, and negotiate refunds. The script adds to a website in about one minute, and no credit card is required to start. BotRefund is a managed detection and refund service, not a custom webhook builder, so teams that need their own alert routing should pair it with their existing monitoring stack.