Seatext library / BotRefund evidence
When to Trigger a CAPTCHA vs Block a Bot: A Decision Framework
Use CAPTCHAs for suspicious traffic that might still be human — such as unusual device fingerprints or borderline behavioral signals — and block traffic that shows clear, corroborated automated patterns like superhuman input speeds,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Use CAPTCHAs for suspicious traffic that might still be human — such as unusual device fingerprints or borderline behavioral signals — and block traffic that shows clear, corroborated automated patterns like superhuman input speeds, missing mouse tremor, or known data-center IPs. The choice depends on signal confidence, not a single anomaly.
The core decision trigger
Every bot response starts with a question: how sure are you that this visitor is automated? BotRefund runs 110+ independent checks across browser, network, device, and behavior layers. Each check produces evidence, not a verdict. A single anomaly — like a mismatched Playwright init script or a clean-context iframe mismatch — is kept as evidence and cross-checked against other signals before any action is taken.
When the combined pattern reaches high confidence (BotRefund reports 99% accuracy), blocking is appropriate. When signals are mixed or could stem from privacy tools, corporate networks, or unusual devices, a CAPTCHA lets a real person prove humanity without losing the session.
Signal confidence levels and what they mean
Low confidence: one or two weak anomalies
- Example: a single browser API mismatch that privacy extensions can cause
- Response: log and monitor; do not challenge
Medium confidence: several anomalies without a clear pattern
- Example: odd mouse path plus a headless-browser hint, but normal session duration and scrolling
- Response: trigger a CAPTCHA; keep attribution intact
High confidence: multiple corroborated signals across layers
- Example: superhuman input speed (<1 ms), grid-aligned mouse movements, data-center IP, no scroll events, and a known automation framework fingerprint
- Response: block and flag for refund evidence
Types of bot traffic and appropriate responses
| Bot type | Typical signals | Recommended response | Why |
|---|---|---|---|
| Basic scrapers | Known data-center IPs, default user-agents, no JS execution | Block at edge or server | Low sophistication; false-positive risk is minimal |
| Headless browsers (Puppeteer, Playwright) | Init-script mismatches, missing browser permissions, clean-context iframe leaks | CAPTCHA first, then block if failed | May be researchers or testers; give humans a path through |
| Advanced botnets / residential proxies | Real IPs, human-like mouse paths but missing tremor, superhuman click speed, form completion in milliseconds | Block with high-confidence corroboration | CAPTCHAs are often solved by CAPTCHA farms; blocking protects budget |
| Click farms / human fraud | Real devices, real browsers, but repetitive patterns, burst timing, low engagement | CAPTCHA + behavioral rate limits | Humans can solve CAPTCHAs; need pattern-based limits |
CAPTCHA limitations and when they fail
Traditional CAPTCHAs are hated by humans and don't stop determined bots. CAPTCHA-solving services and farms turn challenges into a cost of doing business for attackers. BotRefund's approach treats CAPTCHA as one tool in a tiered response, not a primary defense. If you rely on CAPTCHA alone, you lose visibility into the 83% of clients who recover funds from Google and Meta — because you lack the session-by-session evidence those platforms require.
CAPTCHAs also break attribution. When a user solves a challenge, the original click ID and campaign context can be lost if the challenge redirects or reloads the page. BotRefund preserves attribution by keeping the session intact while collecting behavioral evidence.
Blocking strategies and false-positive risks
Blocking is final. A false positive means a real customer sees an error page, your conversion pixel fires incorrectly, and your ad platform learns from bad data. That's why BotRefund requires corroboration: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." The system keeps each signal as evidence and only blocks when the AI prediction weighs the complete pattern across browser, network, device, and behavior data.
If you block at the edge (WAF, CDN) without client-side evidence, you miss the behavioral signals that distinguish a fast human from a bot. Server-side logs show IPs and headers; they don't show mouse tremor, scroll depth, or form-interaction timing.
Building a tiered response system
- Collect client-side evidence on every session. Browser fingerprint, pointer behavior, scroll behavior, input timing, session duration, and engagement signals.
- Score each signal independently. Don't let one check override others. BotRefund runs 106+ independent checks (Playwright init scripts, clean-context iframe, honeypot traps, ghost clicks, etc.).
- Cross-check context. Does the network signal (data-center IP) agree with the browser signal (automation framework)? Does the behavior signal (no scroll) agree with the device signal (missing sensors)?
- Apply the decision rule. Medium confidence → CAPTCHA. High confidence → block. Low confidence → monitor.
- Preserve attribution for refunds. Every blocked or challenged session keeps click IDs, campaign details, timestamps, and signal-by-signal reasoning in a refund-ready report format that Google and Meta accept.
- Feed outcomes back. Verified human sessions that passed CAPTCHA improve the model. Verified bot sessions that were blocked strengthen the evidence for future claims.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Detection confidence | 99% confidence in flagged bot traffic | S2 |
| Signal count | 110+ behavioral, browser, hardware, network, and attribution signals | S2 |
| Independent checks | 106+ checks including Playwright init scripts and clean-context iframe | S1, S5 |
| Refund recovery rate | 83% of 2,500+ audited clients recover funds from Google and Meta | S2 |
| Evidence format | Refund-ready reports with click IDs, campaign details, timestamps, session recordings, signal-by-signal reasoning | S2 |
| Bot budget impact | Bot clicks steal up to 20% of Google and Meta ad budgets | S2 |
| Single-anomaly policy | "A single anomaly is not a bot verdict" — kept as evidence, cross-checked | S1, S5 |
Limitations and when this advice does not apply
- If your only traffic data is server logs (IP, user-agent, headers), you cannot reliably distinguish sophisticated bots from humans. Client-side collection is required for behavioral signals.
- If you run a non-advertising site (e.g., content, SaaS login), the refund-evidence workflow is irrelevant; focus on account takeover and scraping prevention instead.
- If you cannot add JavaScript to your pages (strict CSP, AMP-only), client-side detection cannot run. Consider server-side heuristics plus edge challenges.
- This framework assumes you control the landing page. If traffic goes to third-party platforms (e.g., lead forms hosted by Meta), you lose the client-side layer.
Terminology
- Pixel poisoning: When bot conversions corrupt the ad platform's optimization algorithm, causing it to target more bot-like users.
- Click ID (GCLID, FBCLID): Unique identifier appended to landing-page URLs by ad platforms; essential for tying a session to a specific paid click.
- Invalid activity credit: Google's term for refunds issued when clicks are deemed non-genuine (accidental, automated, or fraudulent).
- Attribution preservation: Keeping the original click ID and campaign context intact through challenges, redirects, or blocks so refund claims remain valid.
- Corroboration: Requiring multiple independent signals to agree before taking action, rather than trusting a single rule.
FAQ
What if a real user gets blocked?
With a corroboration-based system, false blocks are rare. If one occurs, the session evidence (including the signals that triggered the block) is available for review. You can whitelist the user's fingerprint or IP and adjust thresholds.
Can I just use Cloudflare's bot management instead?
Cloudflare excels at edge protection (DDoS, WAF, known bad IPs). It does not produce the session-level behavioral evidence and refund-ready reports that Google and Meta require for invalid-activity claims. Many advertisers run both: edge layer for infrastructure, marketing layer for ad-quality evidence.
How many signals do I need before blocking?
There's no fixed number. BotRefund's AI weighs the complete pattern across browser, network, device, and behavior layers. A cluster of 3-4 corroborated signals from different layers (e.g., automation fingerprint + superhuman speed + data-center IP + no engagement) typically reaches high confidence.
Does a CAPTCHA solve count as proof of humanity?
No. CAPTCHA farms employ humans to solve challenges at scale. A solved CAPTCHA only proves someone solved it — not that the original visitor was the same person, or that the session wasn't automated up to that point.
What happens to my ad pixel when I block a bot?
If you block before the pixel fires, the platform never sees the conversion — which is correct. If you block after the pixel fires (e.g., on a thank-you page), you need to send a conversion correction or rely on the platform's invalid-activity detection. BotRefund's approach blocks early and preserves the pre-click evidence for refund claims.
How do I know if my current CAPTCHA is wasting money?
Check your conversion rate on CAPTCHA-challenged sessions. If it's near zero, you're either blocking humans or bots are solving them. Check your invalid-activity credits in Google Ads and Meta. If they're low but you see bot signals (burst traffic, superhuman speed, form spam), your CAPTCHA isn't catching the right traffic.
When should I escalate to a refund claim instead of just blocking?
When you have corroborated, session-level evidence across multiple clicks and campaigns — click IDs, timestamps, behavioral recordings, and signal reasoning formatted for the platform's review process. BotRefund's 83% recovery rate comes from packaging evidence the way Google and Meta reviewers expect it.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.