What Headless Browsers Can BotRefund Detect?

How BotRefund approaches headless-browser detection

BotRefund does not maintain a static list of headless browsers it "supports." Instead, it deploys over 110 independent client-side checks that examine how a browser behaves when it renders a page. Headless Chrome, headless Firefox, and headless Edge — whether launched directly or driven by Playwright, Puppeteer, or Selenium — all leave measurable traces because automation frameworks must patch or hide native browser APIs to operate without a visible UI. Those patches create inconsistencies that BotRefund's signals capture.

Client-side signals that expose automation

Server-side logs (IP, user-agent, headers) are easy to spoof. BotRefund runs JavaScript in the visitor's browser, so it sees the actual execution environment. Three documented checks illustrate the method:

• Playwright Init Scripts — Looks for the characteristic initialization sequence that Playwright injects before page load. A normal browser does not run this code path.
• Clean Context Iframe — Creates an isolated iframe and compares its API surface to the top-level window. Automation tools often fail to replicate every property in both contexts simultaneously.
• Scrollbar Width Leak — Measures scrollbar metrics that differ between headed and headless rendering paths, especially when the browser reports zero-width scrollbars in headless mode.

Each check produces one piece of evidence. Privacy tools, corporate proxies, or unusual hardware can also trigger anomalies, so BotRefund treats every signal as evidence, not a verdict.

Why a single anomaly is not a bot verdict

The source documentation repeats a core principle: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." BotRefund keeps each signal as independent evidence, then cross-checks it against browser, network, device, and behavioral data. Only when multiple independent signals tell the same story does the AI model assign high confidence.

The 110+ signal categories

Beyond the three browser-API checks above, the homepage lists behavioral families that also catch headless automation:

• Click behavior — Ghost clicks, honeypot trap interactions
• Pointer behavior — Robotic linear mouse movements, absence of human tremor
• Motion behavior — Superhuman input speed (<1 ms), grid-aligned movement patterns
• Engagement behavior — Absence of clicks or scrolling
• Session behavior — Unnatural session durations (too short, too long, too uniform)

Headless browsers driven by scripts typically fail several of these simultaneously: they don't move a mouse, they scroll instantly or not at all, and they complete actions in sub-millisecond bursts.

How the AI prediction layer works

After the 110+ checks run, BotRefund feeds every signal into a prediction model. The model weighs the complete pattern instead of trusting any raw rule. The company states this corroboration approach yields 99% accuracy in identifying bot vs. human visits. The output is a session-level explanation — not a generic "invalid traffic" estimate — that maps each finding to a click ID, campaign, timestamp, and signal-by-signal reasoning.

Refund-ready reporting for Google and Meta

Detection is only half the workflow. BotRefund formats each flagged session into a report structure that Google and Meta reviewers expect: click IDs (GCLID, FBCLID), campaign hierarchy, placement, device, network context, and a replayable evidence trail. Across 2,500+ brand audits, 83% of clients recovered funds from Google and Meta using these reports. The high approval rate comes from three factors: 99% detection confidence, platform-ready report format, and experience negotiating claims.

Limitations and when the advice does not apply

• No guaranteed browser list — Because BotRefund targets behavioral and API inconsistencies, a new headless variant that perfectly mimics a headed browser could evade detection until a new signal is added.
• False-positive guardrails — The system deliberately avoids single-signal verdicts to protect real users on VPNs, corporate networks, or privacy-hardened browsers.
• Client-side only — If a bot never executes JavaScript (e.g., a simple curl request), BotRefund's on-page checks won't fire. Network-layer defenses are still needed for that traffic.
• Not a WAF or CDN replacement — BotRefund adds an evidence layer for ad-quality workflows; it does not provide DDoS mitigation, edge caching, or firewall rules.

Key facts

Fact	Detail	Source
Total independent checks	110+ behavioral, browser, hardware, network, and attribution signals	S2
Stated detection confidence	99%	S1, S2, S3, S6
Brands audited	2,500+	S2
Client refund recovery rate	83% recover funds from Google and Meta	S2
Report format	Refund-ready with click IDs, campaign details, timestamps, session recordings, signal-by-signal reasoning	S2
Example browser-API checks	Playwright Init Scripts, Clean Context Iframe, Scrollbar Width Leak	S1, S3, S6
Behavioral signal families	Click, pointer, motion, engagement, session	S2

Practical scenarios

Scenario 1: Playwright-driven headless Chrome scraping product pages

The Playwright Init Scripts check fires. Clean Context Iframe reveals mismatched API surfaces. Pointer and motion signals show zero mouse data. The AI model sees a consistent automation pattern across five independent categories and flags the session with high confidence.

Scenario 2: Headless Firefox via Selenium on a corporate VPN

Selenium's WebDriver patches leave traces in browser APIs. Scrollbar Width Leak may trigger. However, the corporate VPN and legitimate user context produce conflicting network/device signals. The model weighs all evidence; if behavioral signals (mouse, scroll, timing) look human, the session may score low bot probability despite the API anomalies.

Scenario 3: Simple curl request hitting a landing page

No JavaScript executes, so client-side checks never run. BotRefund does not see this request. A network-layer filter (WAF, Cloudflare, server logs) must catch it.

Terminology

• Headless browser — A browser binary run without a graphical UI, typically controlled by an automation script.
• Automation framework — Libraries like Playwright, Puppeteer, Selenium that drive browsers programmatically.
• Client-side check — JavaScript executed in the visitor's browser that inspects runtime properties, APIs, and behavior.
• Signal — One independent measurable observation (e.g., "Playwright init script present").
• Corroboration — Requiring multiple independent signals to agree before assigning a bot verdict.
• Refund-ready report — Evidence package formatted to Google/Meta invalid-traffic claim specifications.

FAQ

Does BotRefund block headless browsers automatically?

No. BotRefund detects and documents automated sessions. Blocking or challenging traffic is a separate decision you make using the evidence. The platform focuses on producing refund-ready proof for ad platforms.

Can a sophisticated headless setup evade all 110+ checks?

In theory, a perfectly mimicked headed browser could avoid detection. In practice, each automation framework leaves multiple independent fingerprints (API patches, timing, input behavior, rendering quirks). The corroboration model makes evasion exponentially harder because the attacker must perfect every signal simultaneously.

What if my legitimate users run privacy-hardened browsers that look like bots?

The system's design accounts for this. Privacy tools, VPNs, and corporate networks can trigger individual signals, but they rarely reproduce the full behavioral cluster (mouse tremor, scroll variance, human timing) that real users exhibit. The AI model weighs the complete pattern, so isolated anomalies from privacy tools seldom produce a high bot score.

How quickly are new headless-browser variants covered?

When a new automation tool or browser version introduces detectable inconsistencies, BotRefund adds a new independent check. The 110+ count grows over time. You benefit automatically because the detection runs on BotRefund's infrastructure.

Do I need to install anything on my server?

BotRefund runs via a lightweight JavaScript snippet on your pages (similar to analytics). No server-side installation or log access is required.

Can I use BotRefund alongside Cloudflare or a WAF?

Yes. The Cloudflare alternatives article notes that many advertisers keep their edge layer for DDoS/WAF and add BotRefund for the marketing-layer evidence that supports ad refunds. The two jobs coexist.

What does the free bot audit include?

The audit runs BotRefund's detection on your live traffic and shows you the volume and type of automated visits, with sample session evidence. It requires adding the snippet and waiting for traffic to accumulate.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Headless Browser Detection: Techniques and Strategies to Outsmart ...
• Headless Browser Detection: How Sites Know You're a Bot - DEV ...
• The Best Headless Chrome Browser for Bypassing Anti-Bot Systems

Learn more

Visit the website for more information.