What to Do When BotRefund Activation Fails: A Diagnostic Guide

Immediate steps when activation fails

Copy the full error text, screenshot the screen, and note the timestamp. Open your browser's developer console (F12) and check the Network tab for failed requests to botrefund.com or cdn.botrefund.com. A 403 or 401 usually means the API key is missing or the domain isn't authorized; a 500 suggests a temporary service issue. If the script loads but the dashboard shows "Inactive," the snippet may be on a page that never receives paid traffic, so the handshake never completes.

How BotRefund activation works

BotRefund adds a lightweight client-side script to your site. That script observes pointer, scroll, timing, and navigation behavior, then sends a behavioral fingerprint to the BotRefund backend. The backend matches the fingerprint against 50+ detection vectors and, when confidence is high, tags the session as invalid. The activation flow is: you paste the snippet (or deploy via GTM), the script loads on a page that receives a paid click, the first session completes the handshake, and the dashboard flips to "Active." The homepage states typical setup takes about one minute and requires no credit card to start the free bot audit.

Three common error categories

1. Script placement errors

• Snippet placed inside a <noscript> block or after a deferred loader that never fires.
• Content Security Policy (CSP) blocks script-src to BotRefund's CDN.
• Tag manager rule fires only on specific URLs that don't match landing pages.

2. Domain verification errors

• Domain in the BotRefund account doesn't match the live URL (www vs non-www, staging vs production).
• Cross-origin iframe (e.g., a form hosted on a subdomain) prevents the script from reading the top-level referrer and click IDs.

3. Ad-account permission errors

• Google Ads or Meta account linked to BotRefund lacks "Admin" or "Standard" access, so the refund engine cannot pull click IDs (GCLID / FBCLID).
• Auto-tagging is off in Google Ads, so GCLIDs never arrive.

Diagnostic sequence: follow this order

1. Confirm the snippet loads. Open the Network tab, filter for "botrefund," and verify a 200 response for the main JS file.
2. Check console for CSP violations. Look for "Refused to load script" or "blocked by CSP." Add https://cdn.botrefund.com to script-src and connect-src directives.
3. Trigger a paid click. Click your own ad (use a test click or a colleague's device) and watch the dashboard for a session record within 5 minutes.
4. Verify click IDs appear. In the session detail, confirm GCLID (Google) or FBCLID (Meta) is captured. If missing, re-check auto-tagging and UTM parameters.
5. Check domain match. In BotRefund settings, ensure the registered domain exactly matches the browser address bar (including subdomain).
6. Review ad-account link. In Integrations, confirm the Google Ads / Meta account shows "Connected" and the email has admin rights.

Common mistakes that look like activation errors

Mistake: Installing the snippet on a thank-you page only. The script must load on the landing page that receives the paid click, otherwise it never sees the click ID.
Mistake: Using a staging domain (e.g., staging.example.com) while the BotRefund account is registered to example.com. The handshake fails because the origin doesn't match.
Mistake: Disabling first-party cookies via a consent banner before the script runs. BotRefund needs a first-party cookie to stitch the session to the click ID.
Mistake: Expecting instant "Active" status without any paid traffic. The dashboard stays "Inactive" until at least one paid session completes the handshake.

When to contact support

If you've completed the diagnostic sequence and the dashboard still shows "Inactive" or an error code persists, open a support ticket from the dashboard. Include: the exact error text, a HAR file or console screenshot, your domain, the ad account ID, and the timestamp of a test click. The team can then check backend logs for handshake failures, rate limits, or account-level flags. The homepage notes an 83% refund approval rate across client claims, which implies the activation pipeline is mature — most remaining issues are configuration-specific.

Key facts

Fact	Detail	Source
Typical setup time	About one minute to add BotRefund to a website	S2
Free audit	No credit card required to start the free bot audit	S2
Detection vectors	50+ behavioral and technical signals analyzed per session	S7
Refund approval rate	83% of customers successfully get a refund	S2
Supported platforms	Google Ads and Meta Ads (Facebook, Instagram, Audience Network)	S1, S3, S5
Click ID capture	Auto-captures GCLID and FBCLID for dispute evidence	S3
Historical recovery	Can recover Google Ads spend dating back to 2017	S2

Limitations of this guide

This article covers the most frequent activation issues reported by BotRefund users. It does not replace the official help center or account-specific support. Edge cases — such as custom CSP nonces, server-side rendering frameworks that strip client-side scripts, or enterprise single-sign-on configurations — may require engineering assistance. The source pack does not document specific error codes, so the diagnostic sequence is based on general web-integration patterns and BotRefund's described architecture.

Terminology

• Handshake: The first successful round-trip where the client script sends a behavioral fingerprint and receives a session token from the BotRefund backend.
• Click ID (GCLID / FBCLID): Unique identifiers appended by Google Ads and Meta Ads to landing-page URLs; required to link a session to a specific paid click for refund claims.
• Pixel poisoning: When bot traffic triggers conversion pixels, causing the ad platform's optimization algorithms to target more bot-like users.
• CSP (Content Security Policy): A browser security header that restricts which scripts, styles, and connections a page may load.

FAQ

Why does the dashboard stay "Inactive" after I pasted the snippet?

The dashboard only flips to "Active" after a paid click lands on a page where the script loads and completes the handshake. Test by clicking your own ad (or ask a colleague) and wait up to five minutes.

My CSP blocks the script. What domains do I allow?

Add https://cdn.botrefund.com to both script-src and connect-src directives. If you use a nonce, apply the same nonce to the BotRefund script tag.

Can I activate BotRefund on a staging environment?

Yes, but register the exact staging domain (e.g., staging.example.com) in your BotRefund account. The domain must match the browser address bar exactly.

Do I need admin access on the ad account?

At minimum, "Standard" access on Google Ads and "Advertiser" role on Meta. The integration needs permission to read click IDs and submit refund requests.

What if auto-tagging is off in Google Ads?

Enable auto-tagging in Google Ads → Settings → Account Settings. Without it, GCLIDs won't appear in URLs, and BotRefund cannot link sessions to clicks.

How long before I see the first bot detection?

Detections appear as soon as invalid traffic hits a page with the active script. The free audit starts immediately; the homepage notes a typical 1-minute setup before the audit begins.

Can BotRefund work alongside Cloudflare or other WAFs?

Yes. The Cloudflare alternatives article explains that BotRefund operates at the marketing layer, capturing onsite behavior after the request reaches the page. It does not replace edge security.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Need a refund due to a bot error? - Scrap.TF Forums
• r/ConsumerAdvice on Reddit: I got scammed by ChatbotApp.ai / Chatbot ...
• How can I get a refund? | Chatbot App

Learn more

Visit the website for more information.