Seatext library / BotRefund evidence
What Does a Bot Audit Include? Scope, Signals, and What to Expect
A bot audit examines your paid traffic using browser-level signals — behavioral, device, network, and attribution data — to separate human visitors from automated software. It produces a refund-ready report with session-level evidence formatted...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
A bot audit is a structured investigation of the traffic hitting your paid campaigns. It collects hundreds of independent signals from each visitor session — browser APIs, pointer movements, scroll behavior, timing patterns, network context, and device fingerprints — then cross-checks them to determine whether a visit is human or automated. The output is not a simple score; it is a session-by-session evidence package that ad platforms can review for invalid-activity credits.
BotRefund runs 106 independent checks (often described as 110+ signals) across browser, network, device, and behavior layers. Each check adds one objective fact. The system weighs the complete pattern through an AI model rather than relying on any single rule, reaching up to 99% confidence when the evidence supports it. Across more than 2,500 audits, 83% of clients have recovered funds from Google and Meta.
What a bot audit actually covers
A comprehensive bot audit looks at the full visitor journey after a paid click. It starts with the landing-page load and continues through every interaction — clicks, scrolls, form fills, navigation, and dwell time. The audit captures the click ID (GCLID, FBCLID, or equivalent), campaign metadata, timestamp, and a session recording that shows exactly what the visitor did.
The scope includes both general invalid traffic (scrapers, crawlers, data-center bots) and sophisticated fraud (residential proxy networks, headless browsers with stealth plugins, click farms). It also distinguishes accidental clicks — such as mobile mis-taps — from intentional fraud, because platforms treat them differently when issuing credits.
The signals that make up a modern bot audit
No single signal proves a visit is a bot. A reliable audit combines many independent checks, each contributing one piece of evidence. BotRefund groups its 106 checks into four categories:
- Browser and device consistency: Checks like Playwright Init Scripts, Clean Context Iframe, and Scrollbar Width Leak look for mismatches between what a real browser exposes and what automation tools reveal when they patch or hide APIs.
- Pointer and scroll behavior: Robotic linear mouse movements, absence of humanlike tremor, superhuman input speed (under 1 ms), grid-aligned movement patterns, and scrollbar anomalies.
- Click and engagement patterns: Ghost clicks (activity without human intent), honeypot trap interactions, absence of clicks or scrolling, and unnatural session durations (too short, too long, or too uniform).
- Network and attribution context: IP reputation, data-center vs residential routing, proxy/VPN signals, and correlation with campaign click IDs.
Each signal is kept as evidence, not a verdict. Privacy tools, corporate networks, travel, and unusual devices can create anomalies for real people. The audit cross-checks every signal against the others; only when a consistent cluster points to automation does the AI model assign high confidence.
Client-side vs server-side audits
Server-side audits analyze log files: IP addresses, request headers, user-agent strings. They catch basic scrapers and known bad IPs but struggle with advanced botnets that rotate residential proxies and mimic legitimate headers.
Client-side audits run in the visitor's browser. They observe actual behavior — mouse movement, scroll timing, rendering quirks, API availability — that server logs never see. This is essential for detecting headless browsers, stealth automation frameworks, and human-operated click farms. The trade-off is that client-side collection requires a lightweight script on your landing pages, which some teams treat as an infrastructure change rather than a marketing tool.
From audit to refund: the evidence chain
Finding bots is only half the job. To recover money, you need evidence formatted the way Google and Meta reviewers expect. A refund-ready report includes:
- Session recordings with signal-by-signal reasoning
- Click IDs (GCLID, FBCLID, MSCLKID, etc.) tied to each suspicious session
- Campaign, ad group, keyword, and placement metadata
- Timestamps aligned with platform reporting
- A narrative summary that maps the evidence to the platform's invalid-activity definitions
BotRefund builds reports in this format and supports the negotiation process. The 83% recovery rate across 2,500+ audits comes from three factors: 99% detection confidence, platform-ready formatting, and experience presenting cases to Google and Meta review teams.
What a good audit report looks like
A useful report is not a PDF of IP addresses. It lets you filter by campaign, date range, confidence threshold, and signal type. You can drill into a single session to see the exact checks that fired — for example, "Playwright Init Script mismatch" plus "superhuman input speed" plus "grid-aligned movement" — and watch the session replay. This granularity lets you decide which sessions to include in a refund claim and which to monitor.
The report also protects your conversion pixels. By flagging bot sessions before they fire conversion events, you prevent pixel poisoning that would otherwise corrupt bidding algorithms and lookalike audiences.
Limitations and when an audit isn't enough
A bot audit is a diagnostic snapshot. It tells you what happened during the audit window. It does not provide ongoing blocking unless you deploy the detection script continuously. It cannot recover money automatically — you or your agency must file the claim with the platform. And it cannot guarantee a refund; platforms make the final decision, though well-structured evidence dramatically improves approval odds.
Free audits typically cover a limited time window or traffic volume. They are a starting point, not a substitute for continuous protection if your campaigns run at scale. Also, audits cannot distinguish between a competitor's click fraud and a legitimate user who happens to use a privacy browser that triggers some signals — that's why cross-checking and human review of the evidence matter.
Key facts
| Aspect | Detail |
|---|---|
| Independent checks per session | 106 (described as 110+ signals) |
| Detection confidence | Up to 99% when evidence supports it |
| Client recovery rate | 83% across 2,500+ audits |
| Report format | Refund-ready: click IDs, campaign data, timestamps, session recordings, signal-by-signal reasoning |
| Platforms supported | Google Ads, Meta (Facebook/Instagram) |
| Estimated budget waste from bot clicks | Up to 20% of Google and Meta ad spend |
| Audit delivery | Free bot audit available; continuous protection via onsite script |
FAQ
How long does a bot audit take?
Most free audits complete within 24–48 hours after the tracking script is live and enough paid traffic has passed through. Deeper audits for high-volume accounts may need a few days to collect a representative sample.
Do I need to install code on my site?
Yes. Client-side detection requires a lightweight JavaScript snippet on your landing pages. It loads asynchronously and does not affect page speed for real users.
Will the audit hurt my site performance or SEO?
No. The script is designed to be non-blocking and lightweight. It does not alter page content or interfere with search crawlers.
Can I run an audit if I use Cloudflare or another WAF?
Yes. Edge protection and client-side behavioral auditing solve different problems. Many advertisers run both: the WAF handles DDoS and basic scraping, while the audit layer focuses on paid-traffic quality and refund evidence.
What if Google or Meta already issued an automatic credit?
Automatic credits cover only what the platform's systems catch. An independent audit often finds additional invalid traffic the platform missed. You can submit that evidence for a supplemental claim.
How much traffic do I need for a meaningful audit?
There's no fixed minimum, but the audit needs enough paid sessions to build a statistical picture. Very low-volume campaigns (under a few hundred clicks per month) may not yield actionable results.
What happens after I get the audit report?
You review the flagged sessions, select the ones you want to claim, and submit the formatted report to Google or Meta. BotRefund can help draft the claim and respond to follow-up questions from the review teams.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.