Seatext library / BotRefund evidence
What BotRefund's Bot Detection Cannot Catch — And Why It Matters for Your Ad Budget
BotRefund detects automated traffic by combining 106-plus browser, network, device, and behavioral signals into an AI model that claims 99% accuracy. Its core limitations are that it only observes visitors who load your page,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
BotRefund builds a verdict from more than 100 independent checks — things like Playwright init-script anomalies, scrollbar-width leaks, and clean-context iframe mismatches — then feeds every signal into an AI model that weighs the full pattern instead of trusting any single rule. That design catches most automated traffic, but it also defines what the system cannot do.
The short version: BotRefund only sees visitors who actually execute JavaScript on your page. It cannot detect bots that never render your site, bots that perfectly replicate human behavior across every measured dimension, or bots that operate entirely through compromised residential devices. It also cannot guarantee refunds — Google and Meta approve roughly 83% of the claims BotRefund helps file.
How the detection works — so you see where the blind spots start
BotRefund runs client-side checks in the visitor's browser. Each check looks for a specific artifact that automation tools tend to leave behind: a patched API, a missing browser quirk, a mouse path that is too straight, a click that happens faster than a human can move. No single check decides "bot." Instead, every signal becomes evidence. The AI model cross-references browser fingerprints, network context, device attributes, and behavioral timing across the whole session. When enough independent signals point the same way, the model flags the visit with 99% confidence.
This corroboration approach is why the system tolerates odd but legitimate sessions — someone on a corporate VPN, a privacy-hardened browser, or an unusual device — without crying wolf. But it also means the system only evaluates what reaches the browser.
Limitation 1: Bots that never load your page
If a bot fetches your landing page via a headless HTTP request — no JavaScript execution, no rendering, no mouse movement — BotRefund never sees it. Server-side log analysis or edge-layer filtering (Cloudflare, Akamai, Fastly) catches that traffic before it reaches your site. BotRefund complements those layers; it does not replace them.
Practical impact: you still need a server-side or edge blocklist for known data-center IPs, obvious scrapers, and credential-stuffing bots that hit your endpoints directly. BotRefund's value starts at the moment a visitor runs your page.
Limitation 2: Sophisticated bots that pass every check
Advanced bot operators now use real browser engines (Chrome, Firefox) driven by automation frameworks that patch the very artifacts BotRefund hunts. They spoof canvas fingerprints, inject realistic mouse tremor, randomize scroll timing, and rotate residential proxy IPs. If a bot passes all 106-plus checks, the AI model sees a human pattern and scores the session as human.
This is an arms race. BotRefund updates its checks when new automation leaks appear, but there is always a window where a well-resourced adversary mimics every measured behavior. The 99% accuracy figure reflects historical performance across the 2,500+ audits BotRefund reports, not a guarantee against future evasion techniques.
Limitation 3: False-positive signals from legitimate environments
Privacy extensions (NoScript, uBlock Origin, Privacy Badger), hardened browsers (Tor, Brave with shields up), corporate zero-trust networks, and unusual devices (kiosks, embedded browsers, some smart-TV browsers) can produce the same anomalies that automation creates. BotRefund treats each anomaly as evidence, not a verdict, and cross-checks it against other signals. Still, a session that stacks several privacy protections may accumulate enough "weird" signals to trigger a manual review flag.
In practice, this means your team may see a small number of sessions marked "suspicious" that turn out to be real users on locked-down machines. The refund-ready reports include signal-by-signal reasoning so you can decide whether to include those sessions in a claim.
Limitation 4: Low-volume campaigns lack pattern depth
The AI model learns from patterns across many sessions. A campaign that receives only a few hundred visits per month gives the model less context to distinguish "unusual but human" from "automated." High-volume accounts benefit from richer baseline data; low-volume accounts may see more borderline scores that require human judgment.
If you run niche B2B campaigns with thin traffic, expect to spend more time reviewing flagged sessions before filing a refund request.
Limitation 5: Refund approval is not in BotRefund's control
BotRefund prepares the evidence — click IDs (GCLID, FBCLID), timestamps, session recordings, signal breakdowns — in the exact format Google and Meta reviewers expect. Across 2,500-plus audits, about 83% of clients recover funds. The remaining 17% either had insufficient invalid traffic to meet the platform's threshold, submitted claims outside the review window, or faced platform discretion.
BotRefund cannot force a credit. It can only make the evidence as clear and complete as the platforms allow.
Limitation 6: Installation and configuration are required
You must add BotRefund's script to your site (or tag manager) and verify it fires on every landing page. If the script is blocked by a CSP policy, loads after the visitor bounces, or is stripped by a third-party optimizer, the session goes unanalyzed. The system also needs correct click-ID capture (auto-tagging enabled in Google Ads, Meta Pixel configured) to tie flagged sessions to specific campaigns for refund claims.
Key facts
| Aspect | Detail |
|---|---|
| Independent checks per session | 106+ (browser, network, device, behavior) |
| Signal categories | Behavioral, browser, hardware, network, attribution |
| Claimed detection confidence | 99% |
| Refund success rate (client-reported) | 83% across 2,500+ audits |
| Evidence format | Refund-ready reports with click IDs, timestamps, session recordings, signal-by-signal reasoning |
| Detection scope | Client-side only (requires JavaScript execution) |
| False-positive handling | Each anomaly is evidence, not a verdict; cross-checked across signals |
| Platforms supported for refunds | Google Ads, Meta Ads (Facebook/Instagram) |
When to pair BotRefund with other layers
- Edge/WAF layer (Cloudflare, Akamai, Fastly): blocks known bad IPs, data-center ranges, and obvious scrapers before they hit your server.
- Server-side log analysis: catches headless HTTP bots that never render JavaScript.
- BotRefund: analyzes every browser-rendered session, builds refund-grade evidence, and manages the claim workflow with Google and Meta.
Most advertisers do not need to replace their edge layer. They need the marketing-focused evidence layer that BotRefund provides — session replay, click-ID attribution, and reports written in the language platform reviewers read.
FAQ
Does BotRefund block bots in real time?
No. It detects and documents automated visits. You can use its signals to feed your own blocking rules, but the core product is investigation and refund evidence, not an inline blocker.
Can it detect click farms using real people on real devices?
If a human physically clicks, moves the mouse, and scrolls naturally, the behavioral signals will look human. BotRefund flags automation artifacts, not low-intent human labor. Click farms that use real people on real devices generally pass as valid traffic.
What happens if a legitimate user gets flagged?
The report shows exactly which signals triggered and why. You can exclude that session from a refund claim. The system does not auto-block or auto-submit; you control what goes to Google or Meta.
How long does a refund claim take?
Google and Meta set their own review timelines — typically weeks. BotRefund prepares the package in days once you approve the flagged sessions.
Does it work on single-page apps or React/Vue/Next.js sites?
Yes, as long as the script loads and the router fires page-view events that BotRefund can hook. SPA navigation is treated as a continuous session with new attribution captured on each virtual page view.
Is there a minimum spend or traffic threshold?
No published minimum. Very low-volume sites may see fewer actionable flags simply because the model has less pattern data, but the script runs the same checks regardless of volume.
Can I export raw signals for my own analysis?
The dashboard lets you filter and download flagged sessions with full signal breakdowns. API access for programmatic export is available on enterprise plans.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund helps
BotRefund installs a lightweight script that runs 106-plus browser, network, device, and behavioral checks on every visitor who loads your page. Each check produces one piece of evidence — not a verdict. The AI model weighs the full pattern across all signals and flags sessions with 99% confidence when the evidence aligns.
For every flagged session you get a refund-ready report: click IDs (GCLID, FBCLID), timestamps, session replay, and a signal-by-signal breakdown written in the format Google and Meta reviewers expect. Across 2,500-plus audits, 83% of clients recover money.
Limitations to know: the script only sees visitors who execute JavaScript; it cannot catch headless HTTP bots or click farms using real humans on real devices; privacy tools and corporate networks can create borderline signals that need your review; and refund approval always rests with the ad platform.