Seatext library / BotRefund evidence
When to Use Browser API Inconsistency Checks for Bot Detection: A Readiness Checklist
Use browser API inconsistency checks when you have enough traffic to establish baselines, need to catch headless browsers and automation tools that hide their presence, and can cross-reference signals instead of relying on single...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Browser API inconsistency checks detect mismatches between how a browser claims to behave and how it actually behaves. Automation tools like Playwright, Puppeteer, and Selenium often patch or hide browser APIs to appear human, but those patches break when the browser is probed from a different angle. A real browser runs standard APIs as designed; an automated one leaves seams.
These checks are not a verdict. Privacy tools, corporate networks, unusual devices, and travel can all produce unexpected behavior for genuine visitors. The signal becomes useful only when it corroborates other independent evidence — network, device, behavioral, and attribution signals. BotRefund runs 106 such checks and feeds them into a prediction model that weighs the complete pattern, reaching 99% accuracy through corroboration, not any single tell.
What browser API inconsistency checks actually do
Each check targets a specific API surface that automation frameworks tend to modify. The Playwright Init Scripts check looks for initialization artifacts that a normal browsing session does not create. The Clean Context Iframe check loads an isolated iframe and compares its API surface to the parent page — automation tools often fail to replicate the full context consistently. The Scrollbar Width Leak check measures rendering details that scripts struggle to reproduce perfectly.
These are client-side checks. They run in the visitor's browser and report back objective facts: a property value, a timing measurement, a rendering quirk. They do not block, challenge, or score the visit on their own. They add one independent piece of evidence to a larger pool.
Readiness checklist: when you should implement them
- You have baseline traffic volume. You need enough human sessions to know what "normal" looks like across devices, browsers, networks, and geographies. Without baselines, you cannot distinguish automation artifacts from legitimate variance.
- You already collect multiple signal types. Network signals (IP reputation, ASN, latency), device signals (canvas fingerprint, WebGL, battery API), behavioral signals (mouse movement, scroll patterns, click timing), and attribution signals (click IDs, campaign parameters). API inconsistency checks add the browser-evidence layer.
- You face sophisticated automation. Basic scrapers and naive bots are caught by simpler methods — user-agent analysis, IP blocklists, request-rate limits. API inconsistency checks target headless browsers running stealth plugins, residential proxy networks, and frameworks that actively evade detection.
- You need evidence for refund claims. Google and Meta require session-level proof with click IDs, timestamps, and signal-by-signal reasoning. Browser API checks produce the kind of granular, reproducible evidence that platform reviewers accept.
- You can tolerate investigation workflows. These checks generate signals that require triage. You need a process to review flagged sessions, correlate with CRM outcomes, and decide on suppression or refund requests.
- Your ad spend justifies the investment. If bot clicks consume a meaningful share of budget — BotRefund case studies show up to 20% of Google and Meta spend — the evidence layer pays for itself through recovered funds.
Signs you should wait or start elsewhere
- Low traffic volume. Under a few thousand sessions per month, baselines are noisy. Start with server-side filters: IP blocklists, known datacenter ranges, request velocity limits.
- No client-side instrumentation. If you cannot run JavaScript on your landing pages — AMP-only, strict CSP, or third-party checkout — you cannot collect browser API evidence. Server-side logs are your only option.
- Simple bot problem. If your invalid traffic is mostly obvious — single IP hitting the same URL repeatedly, generic user-agents, no JavaScript execution — basic filters catch 80% of it with less complexity.
- No refund or suppression workflow. Detecting bots without a path to act — suppressing conversion pixels, filing refund claims, adjusting bid strategies — creates alert fatigue without ROI.
- Team lacks triage capacity. Each flagged session needs human review or automated suppression rules. If nobody owns the queue, the signal pile grows unused.
How they fit into a multi-layered detection strategy
Think of detection as three concentric circles. The outer circle is server-side: IP reputation, request headers, rate patterns, geographic anomalies. Cheap, fast, catches the noisy majority. The middle circle is client-side browser evidence: API consistency, canvas fingerprint, WebGL, audio context, permissions, rendering quirks. Harder to spoof, requires JavaScript execution. The inner circle is behavioral: mouse micro-movements, scroll hesitation, click timing, form interaction patterns. Hardest to fake at scale, requires session recording.
Browser API inconsistency checks live in the middle circle. They are harder to bypass than server-side checks because the automation framework must perfectly replicate every browser internal. But they are easier to collect than behavioral signals because they fire on page load, not after minutes of interaction.
The key is cross-checking. A Clean Context Iframe mismatch alone means little. But combined with a residential proxy IP, superhuman click speed, and no scroll activity, the pattern becomes decisive. BotRefund's model evaluates 110+ signals across all three circles and outputs a session-level verdict with explanation.
Common implementation mistakes
| Mistake | Why it fails | Better approach |
|---|---|---|
| Treating a single check as a block rule | Privacy tools, corporate proxies, and unusual devices trigger false positives | Use every check as evidence; require corroboration from 2+ independent signal types before action |
| Running checks without baseline data | Cannot distinguish automation artifacts from legitimate variance | Collect 2-4 weeks of clean traffic first; establish per-browser, per-device norms |
| Ignoring attribution context | Cannot link bot sessions to specific campaigns, click IDs, or refund claims | Capture GCLIDs, fbclids, and campaign parameters alongside every signal |
| No suppression or refund workflow | Detection without action wastes the evidence | Integrate with conversion APIs to suppress bot events; format reports for Google/Meta refund teams |
| Assuming 100% coverage | New automation frameworks and evasion techniques appear constantly | Treat detection as ongoing; update check library regularly; monitor false-negative rate |
Key facts
| Fact | Detail | Source |
|---|---|---|
| Number of independent browser checks | 106 (including Playwright Init Scripts, Clean Context Iframe, Scrollbar Width Leak) | S1, S6, S7 |
| Detection principle | Cross-checked corroboration across browser, network, device, and behavior signals | S1, S6, S7 |
| Reported accuracy | 99% when full signal set is evaluated by prediction model | S1, S2, S6, S7 |
| Single-check verdict policy | Never; each signal is evidence, not a verdict | S1, S6, S7 |
| Refund success rate | 83% of clients recover funds from Google and Meta | S2 |
| Bot click budget impact | Up to 20% of Google and Meta ad spend | S2 |
| Evidence format | Session-level with click IDs, timestamps, signal-by-signal reasoning | S2 |
| Platform acceptance | Reports structured in format Google and Meta reviewers use | S2 |
Limitations and edge cases
Browser API inconsistency checks require JavaScript execution. Visitors with scripts disabled, strict Content Security Policies, or privacy-focused browsers (Tor, hardened Firefox) may not run the checks or may produce atypical results. These are not false positives — they are missing data. Treat missing signals as a separate category, not a bot indicator.
Corporate environments often deploy endpoint security tools that modify browser APIs. Antivirus, DLP, and remote-browser isolation products can trigger inconsistency signals. Maintain an allowlist of known enterprise tools or correlate with ASN/organization data to avoid flagging legitimate business traffic.
Mobile browsers have different API surfaces than desktop. Some checks simply do not apply. Build separate baselines per device class. A scrollbar width check is meaningless on touch-only viewports.
New automation frameworks and stealth plugins appear monthly. A check that works today may be bypassed tomorrow. The check library must be maintained, not deployed once. BotRefund updates its 106 checks continuously; self-built systems need equivalent maintenance commitment.
FAQ
How many browser API checks do I need?
There is no magic number. BotRefund uses 106 because each covers a different API surface. Start with the highest-signal checks: automation framework init scripts, iframe context isolation, and rendering leaks. Add more as you identify evasion patterns in your traffic.
Can I build these checks myself?
Yes. The Playwright Init Scripts check, for example, compares browser state before and after known automation initialization sequences. The Clean Context Iframe check creates an iframe and diffs its API surface against the parent. The Scrollbar Width Leak measures CSSOM rendering details. Each is implementable in a few hundred lines of client-side JavaScript. The hard part is maintaining them, establishing baselines, and building the cross-signal correlation logic.
Do these checks work against residential proxy botnets?
They help. Residential proxies solve the IP reputation problem but not the browser consistency problem. A bot running on a real residential device still uses automation frameworks that leave API seams. The checks catch the automation layer regardless of the network layer.
What about false positives from privacy tools?
Privacy tools (Privacy Badger, uBlock Origin, Brave Shields) modify browser APIs intentionally. They can trigger inconsistency signals. The solution is correlation: a privacy-tool signal combined with human-like mouse movement, normal scroll behavior, and a residential ISP is likely a real user. A privacy-tool signal combined with datacenter IP, linear mouse paths, and zero scroll is likely a bot masking behind a privacy extension.
How do I know if my baseline is reliable?
Segment by browser version, device type, and geography. If Chrome 120 on Windows 10 in the US shows 0.5% inconsistency rate on the Clean Context Iframe check, but Chrome 120 on Windows 10 in Germany shows 12%, investigate the German segment — it may be a corporate proxy, a localized privacy tool, or a botnet. Reliable baselines are stable within segments over time.
When should I suppress conversion events vs. request refunds?
Suppress immediately when the session-level verdict crosses your confidence threshold — this protects your pixel training data in real time. File refund claims monthly or quarterly with aggregated, session-level evidence packages. Google and Meta require click IDs, timestamps, and signal reasoning; suppression requires only the verdict.
What if I only run Meta or only Google ads?
The checks are platform-agnostic. They detect automation on your landing pages regardless of traffic source. If you run only Meta lead campaigns, the same browser API inconsistencies reveal form-filling bots. The refund workflow differs — Meta's process uses different evidence formats — but the detection layer is identical.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund runs 106 browser API inconsistency checks — including Playwright Init Scripts, Clean Context Iframe, and Scrollbar Width Leak — as part of a 110+ signal detection system. Each check adds one independent fact; the prediction model weighs the complete pattern across browser, network, device, and behavior evidence to reach 99% accuracy. You get session-level reports with click IDs, timestamps, and signal-by-signal reasoning formatted for Google and Meta refund teams. 83% of clients recover ad spend. The free bot audit shows exactly what percentage of your traffic is automated and which campaigns are affected.
Limitation: you must be able to run JavaScript on your landing pages. Server-only environments (AMP, strict CSP, third-party checkout) cannot collect client-side browser evidence. The system also requires enough traffic volume — typically a few thousand sessions per month — to establish reliable baselines per browser, device, and geography segment.