Seatext library / BotRefund evidence
Which CMS Platforms Work With the Console Debug Evaluator? A Compatibility Guide
The Console Debug Evaluator runs as a lightweight JavaScript snippet, so it works with virtually any CMS that lets you paste code into the <head> or before the closing </body> tag — WordPress, Shopify,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
The Console Debug Evaluator is one of 106 independent checks BotRefund uses to build a reliable picture of whether a visit is human or automated. It runs entirely in the visitor's browser, so the only requirement on the CMS side is the ability to deliver a small JavaScript payload to every page you want protected.
If your CMS lets you insert a script tag in the global header, footer, or via a tag manager, the evaluator will load. The exception is any CDN, edge worker, or security layer that rewrites, delays, or removes inline scripts before they hit the browser — that breaks the timing and API checks the evaluator relies on.
What the Console Debug Evaluator actually does
The evaluator looks for a mismatch that a real browsing session does not normally create. Automation tools often patch or hide browser APIs, but those changes can break when the browser is checked from another angle. A normal browser runs standard browser APIs as they were designed. Its built-in properties, permissions, and rendering contexts remain consistent without needing to hide automation.
This signal adds one objective fact about the visit. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data. Accuracy comes from corroboration, not one browser tell.
Core compatibility requirement: script delivery
Every CMS that powers a public website already has a mechanism to inject third-party JavaScript — analytics, chat widgets, consent banners, heatmaps. The Console Debug Evaluator uses the same pathway. You need one of the following:
- Access to the global
<head>or<body>template to paste a<script>tag. - A tag manager (GTM, Tealium, Segment, etc.) that fires on all pages.
- A plugin or app marketplace entry that injects custom code site-wide.
- Server-side rendering that includes the snippet in the initial HTML response.
If you can add Google Analytics or a Meta pixel without a developer, you can add the evaluator.
Major CMS platforms and how they handle the snippet
WordPress
Use a header/footer plugin (e.g., WPCode, Header Footer Code Manager), your theme's functions.php, or Google Tag Manager. All three methods deliver the script before the page becomes interactive. Avoid caching plugins that combine or defer JavaScript unless you exclude the evaluator's script handle.
Shopify
Paste the snippet in Online Store > Themes > Edit code > theme.liquid just before </head>. Shopify's CDN does not strip inline scripts, so the evaluator loads normally. If you use Shopify Scripts or Shopify Functions for checkout customization, the evaluator still runs on storefront pages — checkout.liquid is no longer editable, but the evaluator is not required there for ad-click protection.
Webflow
Project Settings > Custom Code > Head Code. Webflow outputs the snippet in the initial HTML. Its hosting CDN passes inline scripts through unchanged.
Drupal
Add a custom block in the header region, use the Asset Injector module, or place the script in your theme's html.html.twig. Drupal's aggregation can bundle the evaluator with other JS — disable aggregation for that specific script or add it via a library with header: true and minify: false.
Joomla
Custom HTML module assigned to the debug or head position, or edit the template's index.php. JCH Optimize or similar aggregators must exclude the evaluator's script.
Headless / static-site generators (Next.js, Astro, Gatsby, Nuxt, Hugo)
Insert the snippet in the shared layout component (_document.js, Layout.astro, gatsby-ssr.js, app/head.nuxt, partials/head.html). Because these frameworks hydrate on the client, the evaluator runs during hydration and catches automation signals that appear after the initial paint.
Custom PHP, Python, Node, Java, .NET stacks
Any template system that renders a full HTML page can include the snippet. If you use a middleware that rewrites HTML (e.g., Cloudflare Workers, CloudFront Functions, Varnish VCL), ensure the script tag survives untouched.
The CDN / edge wrapper trap
This is the single most common compatibility failure. A CDN or edge security product that does any of the following will break the evaluator:
- Strips inline
<script>tags for "security". - Defers all JavaScript until after
DOMContentLoaded. - Rewrites script
srcattributes to a proxy domain. - Injects a Content-Security-Policy header without
'unsafe-inline'or a nonce that matches the evaluator's inline script.
If you use Cloudflare, check Speed > Optimization > Rocket Loader — turn it off for the evaluator's script or disable it site-wide. If you use Cloudflare Zaraz, add the evaluator as a custom HTML tool instead of a third-party tag. On AWS CloudFront, verify your Lambda@Edge or CloudFront Functions do not modify the response body. On Akamai, confirm Property Manager rules do not enable "Script Minification" or "Inline Script Removal".
How to verify the evaluator loaded
- Open any protected page in an incognito window.
- Open DevTools > Console.
- Look for a log line containing
BotRefundorz8y— the evaluator announces itself once per session. - Switch to the Network tab, filter by "JS", and confirm the evaluator script returns 200 with a JavaScript content type.
If you see a CSP violation error referencing the evaluator's inline script, your CSP header needs 'sha256-...' for that exact script content or 'unsafe-inline' (less ideal but functional).
Decision framework: choose your integration path
| Situation | Recommended path | Effort | Risk |
|---|---|---|---|
| Marketing team owns the site, no dev sprint available | GTM or header/footer plugin | 5 minutes | Low — same as adding GA4 |
| Dev team controls deployments, strict CSP | Add nonce to script tag in template, update CSP header | 30–60 minutes | Low — version-controlled |
| Headless framework, edge middleware in front | Inject in layout component; audit edge function for script stripping | 1–2 hours | Medium — test staging first |
| Legacy CMS with aggressive aggregation plugin | Exclude evaluator from aggregation; add via template override | 30 minutes | Medium — plugin updates may reset exclusion |
| Enterprise with WAF that blocks unknown inline scripts | Request WAF allowlist for evaluator hash; or serve evaluator from your own domain via proxy | 1–3 days (change request) | High — requires security team approval |
Choose the path that matches who can change code today. The evaluator does not require a database, cookies, or server-side endpoint — it is pure client-side JavaScript.
Key facts
| Property | Detail |
|---|---|
| Signal type | Browser API consistency check |
| Delivery method | Inline JavaScript snippet |
| Load timing | Before DOMContentLoaded (preferred) or during hydration |
| Dependencies | None — no external requests, no cookies, no localStorage |
| CSP requirement | script-src 'self' 'sha256-...' or 'unsafe-inline' |
| CDN compatibility | Works unless edge layer strips or defers inline scripts |
| Tag manager support | GTM, Tealium, Segment, Zaraz (as custom HTML), Matomo Tag Manager |
| Framework compatibility | React, Vue, Svelte, Solid, Angular, Next, Nuxt, Astro, Remix, Gatsby, Hugo, Jekyll |
| CMS compatibility | Any CMS that allows global script injection |
| Verification | DevTools Console + Network tab |
Limitations and when this advice does not apply
- The evaluator is one signal among 106. It does not make a bot/ human decision on its own. BotRefund's AI weighs the complete pattern across browser, network, device, and behavior evidence.
- Privacy tools, corporate proxies, unusual devices, and travel can produce anomalies for genuine visitors. The evaluator's output is evidence, not a verdict.
- If your site serves only API traffic (no browser-rendered HTML), the evaluator has nowhere to run. BotRefund's network and device signals still apply.
- Sites that intentionally disable JavaScript for all visitors (rare) cannot use this signal.
Frequently asked questions
Do I need a plugin for WordPress?
No. Any method that places the snippet in the <head> of every page works — a plugin is just the easiest non-technical route.
Will the evaluator slow down my page?
The snippet is under 2 KB gzipped, executes in microseconds, and makes zero network requests. It adds no measurable latency.
Can I load it asynchronously?
You can, but the evaluator works best when it runs before automation tools have a chance to patch browser APIs. Synchronous in <head> is ideal; defer in <head> is acceptable; async or bottom-of-body increases the chance a sophisticated bot mutates APIs first.
What if my CSP blocks inline scripts?
Add a SHA-256 hash of the exact script content to your script-src directive, or use a nonce generated per request and apply it to the script tag. Both are standard CSP practices.
Does it work on AMP pages?
AMP forbids custom JavaScript. The evaluator cannot run on valid AMP pages. If you serve AMP and canonical versions, place the snippet on the canonical version only.
Can I test it locally before deploying?
Yes. Paste the snippet into a local HTML file, serve it with any static server (npx serve, python -m http.server), and open DevTools. The evaluator will log its presence.
What happens if the CDN strips the script?
The evaluator simply never runs. You lose one of 106 signals. BotRefund's accuracy comes from corroboration across many signals, so the system still functions — but you forfeit the specific browser-API-consistency evidence.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund installs with a single script tag and starts collecting the Console Debug Evaluator signal — plus 105 other browser, network, device, and behavior checks — immediately. The free bot audit shows you exactly how much of your Google and Meta ad spend is going to automated clicks, and the platform handles the refund dispute paperwork with the ad platforms. You only pay when money is recovered.
The only integration requirement is that your CMS or edge layer delivers the inline script to the browser unmodified. If you have a strict CSP or a CDN that rewrites HTML, your dev team will need to allowlist the script hash or serve the evaluator from your own domain. That's a one-time configuration, not an ongoing maintenance burden.