Seatext library / BotRefund evidence
Free Bot Audit Tools: What Exists, What They Miss, and How to Choose
Free bot audit tools fall into three categories: platform-built filters (Google and Meta), open-source detectors (like BotD), and vendor free tiers (like BotRefund's audit). Platform tools only see their own network; open-source scripts catch...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
If you run paid ads, you already know bots click them. The question is which free tool actually shows you the evidence you can use. Free bot audit tools fall into three buckets: platform filters built into Google Ads and Meta Ads Manager, open-source detection scripts you host yourself, and vendor free tiers that hand you a complete, session-level report. Platform filters only see traffic on their own network. Open-source scripts catch basic automation but do not produce the click-ID, timestamp, and signal-by-signal reasoning that Google and Meta reviewers expect. Vendor free tiers like BotRefund's audit give you the full behavioral picture across 100+ client-side checks and a refund-ready report formatted for platform review teams.
What a bot audit actually checks
A bot audit is not a vulnerability scan. It does not look for malware, open ports, or outdated CMS versions. It examines each visit that came from a paid click and asks: did a human make this session? The audit collects browser fingerprints, pointer dynamics, scroll behavior, timing patterns, network context, and device signals. Each signal is an independent fact — for example, whether the browser's navigator.webdriver flag is set, whether mouse moves show human tremor, or whether scrollbar dimensions match a real UI. No single signal proves fraud. The audit weighs the whole pattern and outputs a confidence score plus a session replay you can hand to a platform reviewer.
Three categories of free bot audit tools
1. Platform-built invalid-traffic filters
Google Ads and Meta Ads Manager both run automated invalid-activity detection. Google's system looks for rapid clicking, duplicate click signatures, known bad IP ranges, and abnormal patterns at the server level. Meta's system flags suspicious lead bursts, instant form submits, and placement-level anomalies. These filters are free and automatic. They also have two blind spots: they only see traffic inside their own network, and they rarely expose the raw evidence you need to dispute a denied credit. You get a credit line item, not a session recording.
2. Open-source detection scripts
Projects like BotD (fingerprintjs/botd) and headless-detector run in the browser and flag common automation frameworks — Puppeteer, Playwright, Selenium, headless Chrome. They are free to self-host and useful for blocking obvious bots at the edge. They do not, however, correlate visits with click IDs (GCLID, FBCLID), preserve session replays, or format findings for a Google or Meta refund claim. They also miss advanced bots that run on real devices with residential proxies and patched browser APIs.
3. Vendor free tiers with refund-ready output
BotRefund offers a free bot audit that installs a lightweight script, records every paid session, runs 106 independent client-side checks (including Playwright init-script traps, scrollbar-width leaks, and clean-context iframe tests), and produces a report structured for Google and Meta review teams. The report includes click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning. Across 2,500+ audits, 83% of clients recover funds from Google and Meta. The free tier covers sites under $10,000/mo ad spend and gives you the same evidence layer paid plans use — just without ongoing monitoring and pixel-poisoning protection.
Decision criteria: which free tool fits your need
| Criterion | Platform filters | Open-source scripts | Vendor free tier (BotRefund) |
|---|---|---|---|
| Network coverage | Single platform only | All traffic on your site | All paid traffic (Google, Meta, others) |
| Evidence depth | Credit line item only | Binary bot/human flag | 100+ signals, session replay, click IDs |
| Refund-ready format | No | No | Yes — built for Google/Meta reviewers |
| Setup effort | Zero (automatic) | Dev time to integrate & maintain | One script tag, 5-minute install |
| Ongoing monitoring | Continuous but opaque | You maintain it | Free tier is a one-time audit snapshot |
| Ad-spend recovery focus | Partial (auto credits only) | None | Core purpose — 83% recovery rate |
Choose platform filters if you only care about automatic credits inside one ad network and do not need to prove anything to a reviewer.
Choose open-source scripts if you have engineering bandwidth, want to block basic bots at the edge, and do not need refund evidence.
Choose a vendor free tier if you run paid campaigns on Google or Meta, suspect invalid clicks are wasting budget, and want a dossier you can submit for a manual refund review.
Limitations of every free option
Platform filters: you cannot appeal a denied credit with evidence you do not have. Open-source scripts: you own the false positives, the maintenance, and the lack of click-ID correlation. Vendor free tiers: BotRefund's free audit is a snapshot — it shows you what happened during the audit window. It does not include real-time blocking, conversion-pixel protection, or ongoing monitoring. If you need continuous protection and pixel-poisoning prevention, the paid plan adds those layers. The free audit is designed to answer "do I have a problem worth pursuing?" not "protect me forever."
How BotRefund's free audit works in practice
- Add one script tag to your site (or use GTM).
- The script activates on visits that carry a GCLID, FBCLID, or other paid-click parameter.
- It runs 106 independent checks — browser API consistency, pointer tremor, scrollbar geometry, iframe context, input timing, navigation flow, and more.
- Each check produces an independent evidence flag. The AI model weighs the full pattern across browser, network, device, and behavior signals.
- You receive a report with session recordings, click IDs, campaign mapping, and a signal-by-signal explanation formatted for Google and Meta review teams.
- If the evidence supports a claim, BotRefund helps you file and negotiate the refund.
The audit covers sites spending under $10,000/mo on ads. Larger spenders move to the Enterprise tier with dedicated support and continuous monitoring.
Key facts
| Fact | Detail |
|---|---|
| Independent checks per session | 106 (free audit) / 110+ (paid) |
| Detection confidence | 99% when session evidence supports it |
| Clients recovering funds | 83% across 2,500+ audits |
| Bot click waste estimate | Up to 20% of Google/Meta ad budget |
| Free tier eligibility | Sites under $10,000/mo ad spend |
| Report format | Refund-ready: click IDs, timestamps, session recordings, signal reasoning |
| Platforms supported | Google Ads, Meta Ads (Facebook/Instagram), other paid channels |
When the free audit is not enough
The free audit is a diagnostic snapshot. It does not block bots in real time, protect your conversion pixels from poisoning, or monitor new campaigns automatically. If you confirm invalid traffic and want ongoing protection — plus the ability to suppress bot conversions before they corrupt your bidding algorithms — you need the paid tier. The free audit's job is to give you the evidence to decide whether that investment pays off.
Terminology quick reference
- GCLID / FBCLID — Click identifiers Google and Meta append to landing-page URLs. They link a session to a specific ad click.
- Pixel poisoning — When bot conversions train the ad platform's optimization algorithm to target more bots.
- Invalid activity credit — Google's term for refunds on clicks deemed non-human or accidental.
- Client-side detection — Checks that run in the visitor's browser (fingerprinting, behavior). Catches bots that pass server-side IP/UA filters.
- Refund-ready report — Evidence packaged in the structure platform review teams expect: click IDs, timestamps, session replay, signal reasoning.
FAQ
Does Google's automatic invalid-activity credit catch everything?
No. Google's systems catch obvious patterns — rapid clicks, known data-center IPs, duplicate signatures. They miss sophisticated bots on residential IPs with real browser fingerprints. That is why advertisers still file manual claims with extra evidence.
Can I use an open-source detector and still file a refund claim?
You can, but the claim will lack click-ID correlation, session replays, and the signal-by-signal reasoning reviewers expect. Approval rates drop sharply without that structure.
What does the free BotRefund audit cost?
Zero. It covers sites under $10,000/mo ad spend. No credit card, no auto-upgrade.
How long does the audit take?
Typically 7–14 days to collect a statistically useful sample, depending on your traffic volume.
Will the audit script slow my site?
The script is under 30 KB gzipped, loads asynchronously, and runs checks without blocking page interaction. Core Web Vitals impact is negligible.
What if I spend over $10,000/mo?
You qualify for the Enterprise tier, which includes continuous monitoring, real-time blocking, pixel-poisoning protection, and dedicated claim support.
Can I run the free audit alongside Cloudflare or another WAF?
Yes. BotRefund operates at the marketing layer — it observes the visitor journey after the request reaches the page. It does not replace edge protection; it adds the evidence layer edge tools do not provide.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.