Which Browser Signals Should You Include in Your Bot Detection Cross-Check?

To build a reliable bot detection cross-check, include user-agent strings, canvas fingerprinting data, WebGL renderer details, installed font lists, timezone offsets, screen resolution, and JavaScript execution behavior patterns. No single signal is definitive: privacy extensions, corporate VPNs, and legitimate unusual devices can all trigger false flags for real users. The only reliable approach is to cross-correlate multiple independent signals to distinguish automated browsers from human visitors.

Why Relying on Single Browser Signals Fails

Modern bot tools like Selenium, Puppeteer, and headless Chrome can easily spoof individual browser signals to mimic real users. A bot can be configured to send a valid Chrome user-agent string, match a common screen resolution, and even fake a local timezone to bypass simple rule-based checks. But spoofing one signal at a time creates inconsistencies that show up when you cross-check multiple data points.

At the same time, real users often have unusual signal patterns that would trigger a false positive if you relied on a single check. A user with strict privacy settings may block canvas fingerprinting or font list reporting. A traveler using a corporate VPN may have a timezone that doesn’t match their IP geolocation. A user on an old work computer may have an outdated browser and a non-standard screen resolution. Relying on any one of these signals alone would incorrectly flag these real visitors as bots.

Core Browser Signals to Include in Your Cross-Check

Each of these signals provides an independent data point about a visit. When combined, they create a coherent picture of whether a browser is being controlled by a human or an automation script.

1. User-Agent String

The user-agent is a string the browser sends to websites to identify its name, version, operating system, and engine. Bots often use outdated, generic, or randomly rotated user-agents to avoid detection, while real users have consistent user-agents that match their installed browser. However, user-agents are easy to spoof, so this signal should never be used as a standalone check.

2. Canvas Fingerprinting

When a browser loads a page, it can render a hidden image using its built-in canvas API. Tiny differences in how GPUs, drivers, and browser settings render this image create a unique, consistent fingerprint for each device. Headless browsers and automation tools often produce identical or broken canvas outputs, as they run in minimal, standardized environments. Real users, by contrast, have unique canvas fingerprints that remain consistent across visits.

3. WebGL Renderer Details

WebGL is a JavaScript API for rendering 3D graphics in the browser. It reports the user’s GPU model, driver version, and rendering capabilities. Automation tools and headless browsers often report generic, missing, or inconsistent WebGL data, as they don’t have access to a physical GPU. Real devices have specific, consistent WebGL renderer details that match their hardware.

4. Installed Font List

Browsers can report the list of fonts installed on a user’s system. Real users typically have dozens of common system fonts, plus any custom fonts they’ve installed for work or personal use. Bots running in containerized or minimal environments have very short, generic font lists, as they don’t have a full operating system with pre-installed fonts.

5. Timezone Offset

The timezone offset is the difference between the user’s local time and Coordinated Universal Time (UTC). Real users have timezones that align with their IP geolocation, language settings, and browsing patterns. Bots often use server timezones that don’t match their claimed location, or rotate timezones randomly to avoid detection.

6. Screen Resolution

The reported width and height of the user’s display. Real users have consistent screen resolutions that match their claimed device type: a mobile user will have a narrow resolution, a desktop user a wider one. Bots often use default or common resolutions that don’t match their spoofed user-agent, e.g., a 'mobile' user-agent paired with a 1920x1080 resolution.

7. JavaScript Execution Behavior

This signal measures how a browser executes JavaScript, including the timing of function calls, handling of async operations, and response to debugger checks. Real users have small, random delays in their JS execution from reading, thinking, and system load. Bots often have unnaturally fast, perfectly timed execution, as scripts run without human intervention.

How to Correlate Signals Without False Positives

Collecting signals is only half the battle. The way you cross-check them determines how many real users you incorrectly flag as bots. Follow this process to minimize false positives:

1. Establish consistency baselines: Define what 'consistent' looks like for your user base. For example, most of your users may be in the US, so a visit from a US IP with a US timezone and English language settings is consistent. A visit from a US IP with a Moscow timezone and Russian language settings is inconsistent.
2. Weight signals by reliability: Some signals are harder for bots to spoof than others. Canvas fingerprints and WebGL details are more reliable than user-agent strings, as they require access to physical hardware. Weight higher-reliability signals more heavily in your cross-check logic.
3. Allow for exceptions: Build exceptions for common legitimate edge cases: users with privacy tools that block canvas or font reporting, corporate network users with shared IPs and generic device settings, and returning visitors with consistent historical signal patterns.
4. Require multiple conflicting signals: Never flag a visit as a bot based on a single anomaly. Require at least 3 independent conflicting signals before taking action, and always allow for manual review of flagged visits before blocking access.

Readiness Checklist for Your Bot Detection Cross-Check

Use this checklist to confirm your cross-check is ready for production use:

• Signal collection is performant: You can capture all required browser signals without adding noticeable load time to your pages.
• Consistency rules are defined: You have clear rules for when signals align with expected user behavior and when they conflict.
• False positive mitigations are in place: You have exceptions for privacy tool users, corporate network users, and returning visitors with consistent historical patterns.
• Cross-check logic requires multiple anomalies: You require at least 3 independent conflicting signals before flagging a visit as automated, rather than acting on a single anomaly.
• Testing is ongoing: You regularly test your cross-check against known bot traffic (e.g., headless Chrome, Puppeteer scripts) and real user traffic to measure false positive and false negative rates.
• Manual review is available: You have a process to review flagged visits manually before blocking access, to avoid locking out real customers.

Common Mistakes to Avoid When Building Your Cross-Check

• Relying on a single signal: A mismatched user-agent or blocked canvas fingerprint alone is not enough to flag a bot. Always correlate multiple independent signals before taking action.
• Blocking visits immediately on anomaly: A single conflicting signal from a privacy tool or unusual device can incorrectly block a real customer. Always require multiple anomalies and allow for manual review.
• Ignoring behavioral signals: Browser signals alone can miss bots that run on real devices via residential proxies. Pair browser signals with behavioral signals like click patterns, mouse movement, and session duration to catch these cases.
• Not updating for new bot techniques: Bot developers constantly update their tools to spoof common detection signals. Test your cross-check against new bot frameworks every 1-2 months to keep it effective.

When to Use a Pre-Built Bot Detection Solution

Building and maintaining an in-house bot detection cross-check requires dedicated engineering time to implement signal collection, define consistency rules, test for false positives, and update the system as bot techniques evolve. For small teams or businesses without a dedicated security or engineering team, this ongoing maintenance can be a significant burden.

Pre-built solutions like BotRefund handle this work for you, using 106 independent browser, network, device, and behavior signals cross-correlated by AI to deliver 99% accuracy. BotRefund also provides additional features for advertisers, including automatic capture of GCLID/FBCLID click identifiers, video proof of bot clicks, and negotiation support for Google and Meta refund claims for invalid traffic dating back to 2017. For teams that need to protect ad spend as well as site performance, a pre-built solution eliminates the overhead of building and maintaining a custom cross-check.

Frequently Asked Questions

1. Can I use only canvas fingerprinting for bot detection?
   No. Canvas fingerprinting is a strong signal, but bots can be configured to render consistent canvas outputs, and privacy tools often block canvas entirely, leading to false positives for real users. Always pair it with at least 2 other independent signals.
2. How many signals do I need to cross-check to avoid false positives?
   Most experts recommend requiring at least 3 independent conflicting signals before flagging a visit as automated. This reduces false positives from privacy tools, corporate networks, and unusual legitimate devices.
3. Do bot detection signals violate privacy laws like GDPR?
   Browser fingerprinting signals are generally considered anonymous, as they don’t collect personal identifiable information (PII) on their own. However, you should disclose your bot detection practices in your privacy policy and comply with local regulations in your operating regions.
4. How often do I need to update my bot detection cross-check?
   You should test your cross-check against new bot frameworks every 1-2 months, as bot developers constantly update their tools to spoof common detection signals. Pre-built solutions like BotRefund update their checks automatically as new bot techniques emerge.
5. Can I use these signals to recover wasted ad spend from bot clicks?
   Yes, but you will also need to capture click identifiers (GCLID for Google Ads, FBCLID for Meta) and link bot visits to invalid clicks to qualify for refunds from ad platforms. Pre-built solutions like BotRefund automate this process and provide the audit-ready evidence required for successful refund claims.