Seatext library / BotRefund evidence
When to Build Your Own Bot Detection Script vs. Using a Service
Build your own bot detection when you have unique traffic patterns, strong engineering capacity, and low enough volume to iterate safely. Switch to a managed service when you need cross-signal corroboration, ad-platform refund evidence,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Most teams start with a simple script because it feels free and controllable. That works until the bots adapt, the false positives climb, or the ad platforms demand evidence you can't produce. The decision comes down to three variables: how specific your problem is, how much engineering time you can burn, and whether you need proof that holds up in a refund dispute with Google or Meta.
Quick Decision Checklist
- Build if: You protect a single endpoint, traffic is under 50k visits/month, you have a developer who enjoys browser internals, and you can tolerate a 5-10% false-positive rate while you tune.
- Buy if: You run paid campaigns on Google or Meta, you need audit-ready proof for refund claims, traffic spans multiple subdomains or apps, or your team has higher-leverage work than maintaining fingerprinting logic.
- Hybrid: Start with a lightweight script on a staging subdomain, measure false positives against real conversions for two weeks, then decide.
When Building Makes Sense
A custom script shines when the threat model is narrow and stable. If you only need to stop a known scraper hitting /api/price from a handful of ASNs, a few header checks and a rate limit may be enough. You control the logic, you pay zero recurring fees, and you can deploy changes in minutes.
Teams with deep browser-automation experience can also use a DIY approach to learn the signal landscape before committing to a vendor. Treat it as a spike, not a product. Ship a minimal detector, log every signal, and review the confusion matrix weekly. If the maintenance burden exceeds a half-day per week, the experiment has answered its question.
When a Service Wins
Managed detection pays for itself when the cost of a missed bot exceeds the subscription. Three scenarios make the case obvious:
- Ad-fraud recovery. Google and Meta require timestamped, signal-correlated evidence to approve click refunds. A homegrown script rarely produces the corroborated packet they accept. BotRefund's pipeline sends each visit through 106 independent checks across browser, network, device, and behavior layers, then feeds the complete pattern into an AI model that reaches 99% accuracy. "BotRefund sends this signal into our prediction AI, which evaluates the complete picture across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy".
- Cross-signal corroboration. Single anomalies—odd user-agent, missing cookie, fast click—happen to real users on VPNs, corporate proxies, or unusual devices. A service that treats each signal as evidence, not a verdict, and cross-checks them against independent layers, dramatically cuts false positives. "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data".
- Scale without linear effort. Adding a new fingerprint vector (canvas, audio context, WebGL) or a new evasion technique (residential proxy rotation, AI-driven mouse curvature) takes weeks in-house. A vendor absorbs that R&D across thousands of sites. "Fraud networks are now using AI model generators to simulate human mouse curvature, click intervals, and page scrolling. By introducing random, organic-like irregularities, bots easily bypass simple pattern-detection rules".
What a DIY Script Actually Requires
If you proceed, plan for these ongoing workstreams:
- Signal collection. Browser fingerprint (canvas, fonts, WebGL, audio), behavioral telemetry (mouse tremor, click intervals, scroll physics), network context (IP reputation, port anomalies, TLS fingerprint), and device consistency (battery, screen, timezone alignment).
- Evasion tracking. Headless browsers (Puppeteer, Playwright, Selenium) patch APIs differently each release. Stealth plugins evolve weekly. You need a test harness that runs the latest automation frameworks against your detector every sprint.
- False-positive governance. Every rule needs a rollback path and a human-review queue. Log the top-10 false-positive patterns weekly; if they cluster on a specific browser version or corporate VPN, you're tuning against noise.
- Refund evidence packaging. Ad platforms want GCLID/FBCLID correlation, video replay, and a narrative that maps each signal to a policy violation. Building that reporting layer is often larger than the detector itself.
Hidden Costs of Rolling Your Own
Engineering time is the visible cost. The invisible ones:
- Opportunity cost. A senior dev spending 20% of cycles on bot logic isn't shipping product features that drive revenue.
- Model drift. Bot operators A/B test against your defenses. Without a feedback loop from millions of labeled visits, your rules stale in weeks.
- Compliance risk. Collecting behavioral biometrics (mouse dynamics, typing cadence) may trigger GDPR, CCPA, or biometric-privacy laws. Vendors typically handle consent flows and data-processing agreements.
- Integration debt. Adding the script to every marketing landing page, SPA route, and third-party checkout iframe becomes a coordination tax.
How BotRefund's Approach Differs
BotRefund doesn't sell a script; it sells a corroboration engine. Each visit runs through 106 independent checks—examples include Console Debug Evaluator (detects patched browser APIs), Suspicious Ports (flags proxy/VPN mismatches), Ghost Click Detection (catches clicks without human intent sequence), and Superhuman Input Speed (sub-millisecond form fills). "One of 106 independent checks BotRefund uses to build a reliable picture of whether a visit is human or automated" "One of 106 independent checks BotRefund uses to build a reliable picture of whether a visit is human or automated".
No single check blocks. The AI weighs the full pattern. This architecture means a new evasion technique only needs one new check added to the 106, not a rewrite of the decision logic. Setup is a single script tag; the free audit runs in about one minute. "Add BotRefund to your website in about one minute. No credit card required".
Key Facts
| Metric | Detail | Source |
|---|---|---|
| Independent checks per visit | 106 | S1, S7 |
| Reported accuracy | 99% | S1, S7 |
| Core detection layers | Browser, network, device, behavior | S1, S7 |
| Setup time | ~1 minute | S2 |
| Ad platforms supported for refunds | Google Ads, Meta Ads | S2, S4, S6 |
| Lookback window for refund claims | Dating back to 2017 | S2 |
| Case-study recovery example | FinTrust: $140,000 refunded, 14% avg bot click rate, +18% conversion rate | S4 |
| Behavioral signals tracked | Ghost clicks, honeypot traps, robotic mouse paths, missing tremor, superhuman speed, grid-aligned movement, static sessions, unnatural durations | S2, S6 |
Limitations & When This Advice Doesn't Apply
- Ultra-low traffic. If you get <5k visits/month and run no paid ads, a simple Cloudflare Turnstile or honeypot field may suffice.
- Regulated biometrics. If your legal team forbids any client-side behavioral collection, you're limited to server-side signals (IP reputation, header analysis) regardless of build vs. buy.
- On-premise only. Organizations that cannot load third-party JavaScript need a self-hosted engine; evaluate open-source fingerprinting libraries (FingerprintJS Pro self-hosted, Castle) instead of SaaS.
- Single-page internal tools. Admin panels behind VPN + MFA rarely need bot detection; focus on auth hardening instead.
FAQ
How long does a credible DIY prototype take?
Two to four weeks for a single-endpoint detector that logs 15-20 signals and produces a confusion matrix. Expect another month to harden against the top 5 evasion frameworks.
What's the minimum ad spend where a refund-focused service pays off?
Around $10k/month on Google or Meta. Below that, the absolute refund amount rarely covers the subscription; above it, even a 5% bot-click rate justifies the cost. "Bot clicks steal up to 20% of your Google and Meta ad budget".
Can I run both a script and a service simultaneously?
Yes. Many teams keep a lightweight edge rule (block known bad ASNs, rate-limit /login) and layer the service for behavioral corroboration and refund evidence. The service's script tag adds ~2kb gzipped.
What happens if the service misclassifies a real user?
BotRefund's corroboration model requires multiple independent signals to agree before flagging. False positives are rare; when they occur, the dashboard shows the exact signal stack so you can whitelist the specific pattern without disabling protection.
Does the service work on single-page apps and shadow DOM checkouts?
The client-side collector attaches to the document lifecycle, not specific routes, so it captures interactions inside SPAs, iframes, and shadow roots. The free audit validates coverage on your exact stack.
How often does the vendor update evasion coverage?
Continuously. New automation frameworks, stealth plugins, and proxy networks are tested against the 106-check suite weekly; new checks are pushed without customer action.
What's the first step if I'm unsure?
Run the free bot audit on a staging subdomain. It installs in one minute, requires no card, and returns a labeled visit breakdown you can compare against your own script's output. "Get my free bot audit".
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.