Seatext library / BotRefund evidence
When BotRefund Runs Browser Signal Checks During a Session
BotRefund evaluates browser signals continuously at key interaction points — page load, form submission, checkout, and other high-value moments — to catch automated traffic in real time. Each check adds one piece of evidence...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
BotRefund does not wait until the end of a visit to decide whether traffic is automated. It runs its 106 independent browser checks at the moments that matter most for ad spend: when a page loads, when a visitor interacts with a form, when a checkout step fires, and whenever the session produces a conversion event. Each check returns a single piece of evidence — a hardware fingerprint mismatch, a missing mouse tremor, a superhuman click speed — that the prediction model cross-references against network, device, and behavioral signals before scoring the visit.
Why Timing Matters for Ad Protection
Ad platforms charge for clicks the moment they happen. If a bot clicks your Google or Meta ad and bounces before any detection runs, you have already paid. BotRefund’s architecture places signal collection at the earliest reliable browser touchpoints so the verdict can feed back into suppression lists and refund claims while the campaign is still running.
The system also re-evaluates when the session context changes. A visitor who looks human on the landing page may reveal automation when they hit a multi-step form or a payment page. Running checks at each transition catches bots that delay their telltale behavior until after the initial page load.
Primary Checkpoints in a Typical Session
- Page load / DOM ready — Hardware and GPU fingerprinting, CPU concurrency, navigator properties, and canvas entropy are collected before the visitor scrolls.
- First meaningful interaction — Mouse movement, click timing, and scroll behavior feed biometric and behavioral signals (ghost click detection, linear path detection, tremor analysis).
- Form focus and submission — Field completion speed, paste events, autofill patterns, and honeypot interactions are recorded.
- Checkout or conversion step — Payment tokenization calls, address validation, and final submit buttons trigger a fresh round of network, device, and behavioral checks.
- Session boundaries — Tab visibility changes, window.open calls, and navigation events feed the impossible-tab-speed and window-tamper checks.
Each checkpoint runs the subset of the 106 checks that are relevant to that context. A page-load checkpoint emphasizes hardware and GPU signals; a form-submission checkpoint emphasizes speed and biometric signals. The AI model receives a time-ordered stream of evidence rather than a single snapshot.
How Real-Time Scoring Works
When a checkpoint fires, the JavaScript collector packages the new signals and sends them to BotRefund’s prediction API. The model updates the visit’s bot-probability score immediately. If the score crosses the customer’s suppression threshold, the visit ID is added to the exclusion list that feeds back to Google Ads and Meta via their conversion APIs. This loop typically completes in under 200 milliseconds, fast enough to prevent the same bot from triggering another paid click in the same session.
The same evidence stream is stored for refund claims. When a customer files a billing dispute with Google or Meta, BotRefund exports a session-level report that shows every checkpoint, every signal, and the model’s reasoning at each step. Ad-platform reps accept this audit trail because it ties each refunded click to a specific, timestamped detection event.
Cross-Checking Across Signal Categories
A single anomaly — say, a CPU concurrency value that does not match the reported GPU — is never treated as a verdict. BotRefund holds it as independent evidence (source S1) and waits for corroboration from at least one other category: network (VPN exit node, suspicious port), device (font list mismatch, battery API anomaly), or behavior (superhuman click speed, grid-aligned mouse path). The AI prediction step (source S1) weighs the complete pattern instead of trusting a raw rule, which is how the system reaches its stated 99% accuracy.
This design also protects legitimate users on corporate networks, privacy browsers, or unusual devices. A privacy tool may spoof one fingerprint, but it rarely spoofs hardware, network, and behavior simultaneously. The cross-check requirement keeps false positives low while still catching sophisticated bots that pass any single test.
What Changes If You Ignore Checkpoint Timing
- Late detection — Bots that only reveal automation at checkout still consume click budget on the landing page and every intermediate step.
- Weaker refund evidence — Ad platforms require proof that the click was invalid at the moment it occurred. A single end-of-session score is harder to defend than a timestamped checkpoint log.
- Poorer suppression — Exclusion lists updated only after the session ends cannot stop the same bot from clicking again in the next session.
Limitations and Exceptions
- First-party cookie dependency — If a visitor blocks all storage, BotRefund cannot stitch checkpoints into a single session profile. Each page load looks like a new anonymous visit.
- Heavy client-side filtering — Aggressive script blockers may prevent the collector from firing at one or more checkpoints, reducing evidence density.
- Server-side rendering without hydration — Pages that never execute the BotRefund script in the browser (pure SSR with no client hydration) produce no browser-layer signals. Network and device signals still apply.
- Single-page applications with soft navigation — If the SPA router changes the URL without a full page load, you must call the BotRefund checkpoint API manually on each virtual page view.
Key Facts
| Fact | Detail | Source |
|---|---|---|
| Total independent checks | 106 | S1 |
| Primary checkpoint types | Page load, first interaction, form submission, checkout/conversion, session boundaries | S1, S2, S6, S7, S9 |
| Signal categories | Browser/hardware, network/VPN/geo, device, behavior/biometric | S1, S6, S7, S9 |
| Scoring latency | Under 200 ms per checkpoint | S2 |
| Stated model accuracy | 99% | S1 |
| Setup time | About one minute to add to a website | S2 |
| Refund lookback window | Google Ads spend dating back to 2017 | S2 |
| Average bot click rate on ad traffic | Up to 20% of Google and Meta ad budget | S2 |
Frequently Asked Questions
Does BotRefund run checks on every single page view?
Yes, on every page where the script loads. The checkpoint logic decides which of the 106 checks are relevant for that page type and interaction state.
Can I add custom checkpoints for single-page app routes?
Yes. The JavaScript API exposes a botrefund.checkpoint() method you can call on each virtual navigation. Pass a label (e.g., "checkout-step-2") so the audit trail shows the context.
What happens if a visitor blocks the BotRefund script?
That visit produces no browser-layer signals. Network and device signals collected at the edge (CDN/WAF layer) still apply, but the behavioral and biometric evidence is missing. The model scores with whatever evidence exists and flags the reduced signal density in the audit report.
How quickly does a suppression update reach Google Ads or Meta?
BotRefund pushes the visit ID to the platform’s conversion API within seconds of the checkpoint that crosses your threshold. The platforms typically ingest the exclusion within minutes, fast enough to stop the same bot from clicking another ad in the same session.
Does the timing differ for mobile vs. desktop?
The checkpoint sequence is the same, but the signal mix shifts. Mobile sessions emphasize touch-event timing, accelerometer noise (when permissioned), and battery API behavior. Desktop sessions emphasize mouse tremor, scroll physics, and keyboard interaction patterns.
Can I see the raw signal log for a specific session?
Yes. The dashboard’s session explorer shows every checkpoint, every signal value, and the model’s intermediate scores. You can export the log as JSON or PDF for refund submissions.
What if a legitimate user triggers a checkpoint anomaly?
The cross-check requirement protects them. A single anomaly (e.g., a corporate proxy that trips the suspicious-ports check) is held as evidence, not a verdict. The model only scores the visit as a bot when multiple independent categories agree. You can also whitelist known corporate IP ranges in the dashboard.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund places its 106 browser checks at the exact moments bots reveal themselves — page load, first click, form submit, checkout — so you stop paying for automated traffic before the session ends. The real-time scoring loop feeds suppression lists back to Google and Meta in seconds, and the timestamped audit trail is what ad-platform reps accept for refund claims going back to 2017. Setup takes about a minute with no credit card. The main requirement is that your pages execute the BotRefund JavaScript in the visitor’s browser; pure server-rendered pages without client hydration will not produce browser-layer signals.