Seatext library / BotRefund evidence
When to Upgrade from Rate Limiting to Dedicated Bot Detection: A Readiness Checklist
Upgrade when bots rotate IPs to bypass your limits, headless browsers pass your challenges, or origin servers still degrade despite rate rules. Dedicated detection adds hardware fingerprinting, behavioral analysis, and network anomaly checks that...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
You should upgrade from rate limiting to dedicated bot detection when you notice bots rotating IPs to bypass limits, headless browsers passing basic challenges, or your origin servers still degrading despite rate limit rules being in place. Rate limiting counts requests per IP or session; it cannot see the browser, device, or behavior behind the request.
Comparison — rate limiting vs. dedicated bot detection
| Criterion | Rate limiting | Dedicated bot detection (BotRefund) |
|---|---|---|
| Primary mechanism | Request counting per key (IP, token, session) | 106 independent client-side + network signals fed to AI model |
| Stops IP rotation | No — each new IP resets the counter | Yes — device & browser fingerprint persists across IPs |
| Detects headless browsers | No — headless executes JS like a real browser | Yes — canvas, font, audio, WebGL, and behavioral gaps expose automation |
| Protects ad spend | Indirect — may reduce bot traffic volume | Direct — proves bot clicks, captures video proof, enables Google/Meta refunds |
| False positive handling | Block or challenge by IP — collateral damage | Evidence weighted, not verdict; privacy tools treated as context |
| Recommendation | Keep for volume | Upgrade if you see IP rotation, headless bypass, or origin degradation |
What rate limiting actually stops (and what it misses)
Rate limiting throttles traffic based on volume thresholds. It counts requests per minute, per IP, or per API key. It stops crude scrapers that hammer endpoints from a single address. It does not stop a botnet that spreads requests across thousands of residential proxies. It does not stop a headless Chrome instance that mimics human timing, moves a mouse cursor, and scrolls pages. It does not detect a browser that claims to be Chrome on Windows but renders fonts like a Linux container.
Rate limiting treats every request as equal once it passes the count check. Dedicated bot detection evaluates each visit across 106 independent signals. It checks hardware, GPU, fonts, audio, network ports, mouse dynamics, click sequences, and session rhythm. It weighs them together through an AI model that reaches 99% accuracy by corroboration, not by any single rule.
Readiness checklist — 7 signs you have outgrown rate limiting
- Bots rotate IPs faster than you can block them. Your blocklist grows daily but attack volume stays flat. Residential proxy networks give attackers clean IPs on demand.
- Headless browsers pass your CAPTCHA or JavaScript challenges. Modern automation frameworks (Puppeteer, Playwright, Selenium with stealth plugins) execute JS, render canvas, and solve simple challenges.
- Origin latency or error rates rise even though rate-limit counters look normal. Traffic stays under your thresholds but server CPU, database connections, or bandwidth spike — signs of low-and-slow scraping or credential stuffing.
- Ad platforms report invalid clicks you cannot explain. Bot clicks steal up to 20% of Google and Meta ad budgets. If your click-through rates look human but conversion quality drops, bots are clicking ads.
- You see impossible browser configurations in logs. Chrome 120 on Windows 10 reporting zero installed fonts, or a Safari user agent with a Linux TCP fingerprint. Rate limiting never inspects these mismatches.
- Behavioral anomalies appear in session replays. Mouse paths that snap to grid lines, clicks faster than 1 millisecond, sessions with zero scroll events, or durations clustered at exact second intervals. These are behavioral signals rate limiting ignores.
- Network signals disagree. A visitor claims a US residential IP but connects through a data-center port, or their timezone, language, and TLS fingerprint point to different continents. The Suspicious Ports check catches this; rate limiting does not.
How dedicated bot detection works differently
Rate limiting is a counting rule. Dedicated bot detection is an evidence engine. BotRefund runs 106 independent checks per visit. Each check produces one piece of evidence — not a verdict. The Empty Font Canvas check looks for a mismatch between claimed device and actual font rendering. The Suspicious Ports check looks for network facts that disagree with each other. The Monitor Sync Anomaly check looks for timing and movement patterns that scripts cannot reproduce. Ghost click detection catches clicks without human intent precursors. Robotic linear mouse movements, superhuman input speed under 1ms, grid-aligned paths, absence of humanlike tremor, static sessions, and unnatural durations all feed the same pool.
The AI prediction layer weighs the complete pattern across browser, network, device, and behavior evidence. A single anomaly — a privacy tool, a corporate proxy, an unusual device — stays evidence, not a block decision. Corroboration across multiple independent signals drives the 99% accuracy claim.
Key detection signals that rate limiting cannot see
| Signal category | What it checks | Why rate limiting misses it |
|---|---|---|
| Hardware & GPU fingerprinting | Canvas rendering, WebGL parameters, audio context, processor behavior | Rate limiting never executes client-side code |
| Font canvas | Installed font list vs. rendered glyph metrics | No request header carries font data |
| Network & port anomalies | Open ports, proxy headers, TLS fingerprint, geolocation consistency | Rate limiting sees only source IP |
| Mouse & pointer dynamics | Tremor, curvature, speed, hesitation, click precursors | Behavioral telemetry requires client instrumentation |
| Click & engagement patterns | Ghost clicks, honeypot interactions, scroll depth, session rhythm | Rate limiting counts requests, not interaction quality |
| Session duration & uniformity | Too short, too long, or statistically identical visit lengths | Rate limiting has no session concept |
When to wait before upgrading
- Your traffic is purely internal APIs with known clients and no public endpoints.
- Attack volume is low, single-source, and already stopped by existing WAF rules.
- You have no client-side surface (no website, no landing pages, no ad campaigns).
- Engineering bandwidth is fully committed to higher-risk vulnerabilities (unpatched CVEs, auth flaws).
Rate limiting is a necessary layer. It is not a sufficient layer when attackers use distributed infrastructure, headless browsers, or behavioral mimicry.
Limitations and exceptions
- Dedicated detection requires a JavaScript execution environment. Pure API endpoints without a browser client cannot feed behavioral or fingerprint signals.
- Privacy-hardened browsers (Tor, Brave with strict shields, some enterprise VDI) may produce anomalies that look like bots. The corroboration model reduces false blocks but cannot eliminate them.
- Refund recovery applies only to Google Ads and Meta platforms with eligible spend history. Not all ad networks support the same dispute process.
- The 99% accuracy figure reflects the AI model's aggregate performance across corroborated signals; individual signal accuracy varies.
FAQ
How fast can I see results after adding dedicated detection?
The script loads in about one minute. The free AI audit starts immediately and produces a report you can export to your Google or Meta rep for refund claims.
Does this replace my WAF rate limits?
No. Keep rate limiting for volumetric protection. Layer detection on top for identity and behavior decisions.
What if my corporate network uses a forward proxy that strips client headers?
The script runs in the visitor's browser, not on your proxy. Fingerprint and behavioral signals survive corporate egress as long as the browser executes JavaScript.
Can I test detection before committing?
Yes. The free bot audit runs on your live traffic with no credit card required.
How does the refund process work?
BotRefund captures video proof of each bot click, compiles the evidence, and submits disputes to Google and Meta on your behalf. Refunds can reach back to 2017 spend.
What happens to legitimate users who trigger one anomaly?
One anomaly is evidence, not a verdict. The AI weighs the full pattern. Privacy tools, travel, and corporate networks routinely produce single anomalies without triggering blocks.
Is there a traffic minimum to benefit?
Sites with any public ad spend or login endpoints see value. The pricing tiers start under $10,000/mo ad spend.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.