Seatext library / BotRefund evidence
How to Use BotRefund to Catch Pixel Poisoning: A Step-by-Step Implementation Guide
Pixel poisoning occurs when automated traffic floods your Meta Pixel with fake conversion events, corrupting the data that Meta's algorithm uses to optimize ad delivery. BotRefund catches this by deploying client-side behavioral detection across...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
What pixel poisoning is and why it matters
Pixel poisoning happens when bots, scrapers, or click farms trigger your Meta Pixel (or Google Ads conversion tag) with fabricated events — form submissions, purchases, lead captures — that never came from a real person. The pixel records these as conversions. Meta's optimization engine then learns to target more users who look like those fake converters, steering budget toward inventory that produces only bot traffic. The result: rising cost per lead, plummeting sales-team contact rates, and a feedback loop that gets worse the longer it runs.
Server-side logs alone rarely catch this. Advanced bots rotate residential IPs, mimic human user-agents, and execute JavaScript well enough to fire the pixel. You need browser-level evidence — how the mouse actually moved, whether the scrollbar behaved like a human scrollbar, whether the iframe context was clean — captured at the moment the pixel fired.
How BotRefund detects the bots that poison pixels
BotRefund runs a lightweight script on your landing pages. It collects 110+ independent signals across five categories: behavioral (mouse tremor, scroll velocity, click timing), browser (canvas fingerprint, scrollbar width, iframe context integrity), hardware (battery API, screen orientation, device memory), network (TCP/IP fingerprint, TLS JA3, connection timing), and attribution (click ID, campaign, placement, timestamp). Each signal is recorded per session, not aggregated.
The system does not rely on any single tell. A scrollbar-width mismatch, a missing mouse tremor, or a superhuman input speed (<1 ms) each becomes one piece of evidence. The prediction model weighs the full pattern across browser, network, device, and behavior layers and returns a bot-or-human verdict with up to 99% confidence when the evidence supports it. This multi-signal approach is what lets it catch bots that pass server-side filters.
Step-by-step: implementing BotRefund to catch pixel poisoning
- Add the BotRefund script to every page that loads your Meta Pixel. Place it in the
<head>so it initializes before the pixel fires. The script is async and does not block page load. - Enable conversion-signal protection. In the BotRefund dashboard, select the pixel events you want guarded (Lead, Purchase, CompleteRegistration, etc.). BotRefund will monitor the exact DOM interactions that precede each event.
- Map click IDs to sessions. Ensure your ad URLs carry the
fbclid(Meta) orgclid(Google) parameters. BotRefund captures these automatically and attaches them to every session record. - Run a baseline audit. Let traffic flow for 7–14 days without blocking. BotRefund will flag suspicious sessions and show you the signal-by-signal breakdown — e.g., "Grid-aligned mouse movement" + "No scroll events" + "Clean Context Iframe mismatch" — so you can verify the detections match your known bad leads.
- Activate real-time blocking (optional). Once you trust the verdicts, enable the JavaScript challenge or redirect for sessions scored as bot. This stops the pixel from firing on those visits, protecting your optimization data going forward.
- Export refund-ready reports. For any date range, generate a report that includes: click ID, campaign/ad set/ad, placement, timestamp, session recording link, and the full signal evidence list. The report format matches what Meta's invalid-traffic review team expects.
- Submit the claim to Meta (or Google). Use the platform's invalid-activity dispute flow. Attach the BotRefund report. BotRefund's team can assist with the negotiation; across 2,500+ audits, 83% of clients recover funds.
Key signals that reveal pixel-poisoning bots
Not every bot triggers every signal, but the following clusters appear repeatedly in sessions that fire fake conversion pixels:
- Pointer behavior: Robotic linear mouse movements, grid-aligned paths, absence of humanlike tremor (micro-jitter).
- Speed behavior: Superhuman input speed (<1 ms between keystrokes or clicks), form completion in under 2 seconds.
- Engagement behavior: Zero scroll events, no field corrections, no text selection, no focus changes.
- Session behavior: Unnatural durations — either too short (<3 s) or too long (>30 min) with zero interaction, or perfectly uniform visit lengths across many sessions.
- Browser evasion traps: Scrollbar Width Leak (automated browsers often report a default width), Clean Context Iframe mismatch (automation patches break when probed from a clean iframe), debugger/anti-stealth trap triggers.
- Attribution anomalies: Sudden placement-level spikes (e.g., Audience Network or Reels placements generating 10x the lead rate of Feed), identical field structures across dozens of leads, bursts of conversions at 3 AM local time.
Each signal is logged with a timestamp and DOM context, so you can replay the session and see exactly what the bot did before the pixel fired.
Protecting the pixel in real time
BotRefund's conversion-signal protection works by intercepting the pixel's fbq('track', ...) call. Before the event leaves the browser, the script checks the session's current bot score. If the score exceeds your threshold, the event is suppressed and a console log records the blocked event with the click ID and reason. The real user's subsequent genuine conversion still fires normally.
This approach keeps your pixel data clean without requiring you to rewrite your tag manager setup. You continue to use Meta's standard pixel code; BotRefund simply gates the track calls that originate from sessions it has already classified as automated.
Building evidence that Meta and Google accept
Platform reviewers reject vague claims like "we saw weird traffic." They accept structured evidence that ties a specific click ID to a specific session recording and a specific set of behavioral anomalies. BotRefund's report includes:
- Click ID (
fbclid/gclid) and full campaign hierarchy - Timestamp down to the millisecond
- Session replay (video-like reconstruction of mouse, scroll, keystrokes)
- Signal-by-signal reasoning: which of the 110+ checks fired, what the expected human range was, what the session showed
- Aggregate placement/creative breakdown showing where bot concentration is highest
This format mirrors the internal review checklists used by Meta's and Google's invalid-traffic teams, which is why BotRefund's clients see an 83% refund approval rate across 2,500+ audits.
Limitations and when this approach does not apply
- First-party cookie / consent restrictions: If a visitor rejects all cookies and your consent management platform blocks the BotRefund script, that session is invisible. You lose both detection and pixel protection for that visit.
- Single-page apps with client-side routing: The script must re-initialize on each virtual page view. If your router doesn't trigger a full
DOMContentLoaded, you need to callBotRefund.init()manually on route change. - Non-Meta/Google pixels: The refund workflow is tailored to Meta and Google's dispute processes. Other platforms (TikTok, LinkedIn, Twitter/X) have different evidence requirements; BotRefund still detects the bots, but you'll need to adapt the report format.
- Low-volume campaigns: Statistical confidence improves with volume. Under ~1,000 clicks/month, the per-session verdicts are still accurate, but placement-level pattern detection (e.g., "Audience Network is 80% bot") becomes noisy.
- Sophisticated human fraud farms: Click farms that use real people on real devices — not automation — will pass behavioral checks. BotRefund flags automation, not low human intent.
Key facts
| Capability | Detail | Source |
|---|---|---|
| Detection signals | 110+ independent behavioral, browser, hardware, network, and attribution checks | S2 |
| Bot-detection confidence | Up to 99% when session evidence supports it | S2, S3, S5 |
| Refund success rate | 83% of clients recover funds from Google and Meta across 2,500+ audits | S2 |
| Report format | Click IDs, campaign details, timestamps, session recordings, signal-by-signal reasoning — structured for platform review teams | S2 |
| Conversion-signal protection | Real-time gating of pixel track calls based on session bot score | S4, S6 |
| Key behavioral signals | Mouse tremor, scrollbar width, iframe context, input speed (<1 ms), grid-aligned movement, engagement absence, session duration anomalies | S2, S3, S5 |
| Attribution capture | Automatic fbclid/gclid capture tied to each session | S1, S4 |
| Negotiation support | Team assists with claim formatting and platform communication | S2 |
Terminology quick reference
- Pixel poisoning: Corruption of a conversion pixel's training data by fake bot-triggered events, causing the ad algorithm to optimize toward bot-heavy inventory.
- Client-side detection: Analysis that runs in the visitor's browser (JavaScript), capturing mouse, scroll, browser API, and rendering behavior that server logs cannot see.
- Click ID (
fbclid,gclid): Unique identifier appended to ad destination URLs; links a session to the specific campaign, ad set, creative, and placement that drove the click. - Session replay: A reconstructable record of a visit's DOM interactions — mouse path, scroll positions, keystrokes, focus changes — used for human review.
- Invalid activity credit: Google's term for refunds issued when clicks/impressions violate policy (bots, accidental clicks, competitor fraud). Meta uses a similar dispute process.
- Signal corroboration: The principle that no single anomaly proves a bot; confidence comes from multiple independent signals telling the same story.
FAQ
How long does it take to see results after installing BotRefund?
You'll see flagged sessions within hours of deployment. A reliable baseline for placement-level patterns usually takes 7–14 days of traffic, depending on volume.
Does BotRefund slow down my page?
The script loads asynchronously and adds ~15 KB gzipped. It does not block rendering or pixel firing for legitimate users.
Can I use BotRefund alongside Cloudflare or a WAF?
Yes. Edge layers (Cloudflare, Akamai, etc.) filter known bad IPs and basic bots. BotRefund adds the browser-level evidence layer that catches bots using residential proxies and full JavaScript execution — the ones that pass edge filters.
What if Meta rejects my refund claim?
BotRefund's team reviews the rejection reason, supplements the evidence if gaps exist, and resubmits. The 83% recovery rate includes cases that required multiple rounds.
Does BotRefund work for Google Ads (Search/Display/YouTube) as well as Meta?
Yes. The same script captures gclid, wbraid, gbraid and protects Google Ads conversion tags. The refund workflow follows Google's invalid-activity credit process.
How do I know the bot verdicts are accurate and not blocking real customers?
Run the baseline audit (step 4 above) without blocking. Review the session replays for flagged visits. You'll see the same patterns — no scroll, linear mouse, instant form fill — that your sales team already recognizes as fake leads. Only enable blocking after you've verified.
What pricing model does BotRefund use?
Pricing is tiered by monthly ad spend. The site shows an "Under $10,000/mo" tier and an Enterprise tier; exact rates are provided after a free bot audit.
Common mistakes to avoid
| Mistake | Why it hurts | Fix |
|---|---|---|
| Installing the script only on the thank-you page | Misses the pre-conversion behavior that proves the session was automated | Deploy site-wide on every page that loads the pixel |
| Blocking bots immediately without a baseline audit | Risk of false positives; no session replays to validate verdicts | Run 7–14 days in monitor-only mode first |
| Submitting a claim with only IP lists or user-agent strings | Platform reviewers reject server-side-only evidence | Use BotRefund's session recordings and signal breakdowns |
| Assuming all bad leads are bots | Wastes effort on low-intent humans; misses the real automation | Cross-check CRM outcomes (contactability, demo booked) with BotRefund verdicts |
| Neglecting click-ID capture | Cannot tie a bot session to the specific paid click for a refund | Ensure fbclid/gclid pass through your landing page URLs |
Verification step: confirm the pixel is clean
After enabling real-time blocking, watch your Meta Events Manager for 48 hours. The "Event Match Quality" score for your protected events should stabilize or improve. Compare the lead-to-contact rate in your CRM before and after — a rising contact rate with stable or lower lead volume confirms the pixel is no longer being poisoned.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.