Seatext library / BotRefund evidence
Key Performance Indicators for Bot Latency: What to Track and Why It Matters
The most useful bot latency KPIs are superhuman input speed (sub-millisecond interactions), session duration anomalies, and interaction timing patterns that deviate from human baselines. These metrics help distinguish automated traffic from real users when...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
When you're trying to measure bot latency, you're really looking for timing signals that humans can't replicate. The core KPIs fall into three categories: input speed (how fast actions happen), session pacing (how long visits last), and behavioral rhythm (whether timing varies naturally). BotRefund's detection engine tracks 106 independent signals, and the latency-related ones consistently separate automated browsers from real people.
Start with these three: superhuman input speed under 1 millisecond, session durations that are too short, too long, or suspiciously uniform, and the absence of micro-tremors in mouse movement. Each signals automation rather than a slow connection or a fast user.
What bot latency means in ad fraud detection
Latency in this context isn't server response time. It's the timing fingerprint of a visitor's actions: how quickly they click after page load, whether pauses match reading speed, whether mouse curves show human tremor. Bots often operate at machine speed or follow scripted delays that feel "off" when you measure them at scale.
Google and Meta's automated filters catch some of this, but residential proxy networks and headless browsers with randomized delays slip through. That's why advertisers need their own client-side measurement — the ad platforms only see the request, not the behavior that led to it.
Core latency-related KPIs to track
Superhuman input speed
Interactions faster than 1 millisecond are physically impossible for humans. This includes clicks, form submissions, and scroll events that fire in tight clusters. BotRefund flags these as "Speed behavior: Superhuman input speed (<1ms)" — a direct latency KPI.
Session duration anomalies
Visits under 2 seconds, over 30 minutes with no idle gaps, or durations that cluster at exact intervals (e.g., 10.0s, 20.0s, 30.0s) indicate scripted sessions. The source pack lists this as "Session behavior: Unnatural session durations."
Absence of humanlike mouse tremor
Real mouse paths have micro-jitter — tiny imperfections from hand physiology. Bots using Selenium, Puppeteer, or direct API calls produce mathematically smooth or grid-aligned paths. This appears as "Motion behavior: Absence of humanlike mouse tremor" and "Path behavior: Grid-aligned movement patterns."
Ghost clicks and missing engagement
Clicks without preceding hover, scroll, or focus events — "Click behavior: Ghost click detection" — and sessions with zero scroll or field corrections — "Engagement behavior: Absence of clicks or scrolling" — are timing voids. They show the bot didn't render or interact with the page like a browser.
How these KPIs differ from human baselines
Human input speed follows a log-normal distribution centered around 100-300ms for clicks, with natural variance. Bot speed clusters at the measurement floor. Human session durations follow a power law: many short bounces, some long reads, few exact multiples. Bot sessions often show uniform bins. Human mouse tremor is 0.5-2px RMS jitter at 60-100Hz; bot paths are either perfectly smooth or snap to coordinate grids.
The key is measuring at the client side with high-resolution timestamps (performance.now() or equivalent). Server logs lose the sub-100ms detail that separates a fast user from a script.
Trade-off table: detection sensitivity vs. false positives
| KPI | High sensitivity threshold | Balanced threshold | Low sensitivity threshold | Typical false positive source |
|---|---|---|---|---|
| Input speed | < 5ms | < 50ms | < 100ms | Pre-rendered pages, cached clicks |
| Session duration | < 3s or > 20min | < 5s or > 30min | < 10s or > 45min | AMP pages, single-page apps, background tabs |
| Mouse tremor | 0px jitter | < 0.3px RMS | < 0.5px RMS | Touchscreens, accessibility tools, remote desktop |
| Ghost clicks | Any click without hover | Click < 50ms after load | Click < 200ms after load | Keyboard navigation, autofill, browser extensions |
| Grid-aligned paths | > 80% points on grid | > 60% points on grid | > 40% points on grid | Snapping UI, drag-and-drop, canvas apps |
Choose the balanced column for most campaigns. Move to high sensitivity only when you have confirmed bot volume and can manually review flagged sessions. Low sensitivity misses sophisticated bots that add randomized delays.
Practical scenarios: when to prioritize each KPI
High-volume lead gen on Meta
Prioritize session duration anomalies and ghost clicks. Form-filling bots hit the landing page, submit instantly, and leave. You'll see clusters of 2-3 second sessions with zero scroll — the "Engagement behavior: Absence of clicks or scrolling" signal.
Competitor click fraud on Google Search
Prioritize input speed and mouse tremor. Competitors often use simple scripts that click ads in rapid succession from the same IP or device fingerprint. Superhuman speed between ad click and next action is the tell.
Affiliate fraud with residential proxies
Prioritize grid-aligned paths and session uniformity. These bots mimic human timing better but still fail at micro-behavior: mouse moves in straight lines between form fields, sessions last exactly the same duration across hundreds of visits.
Limitations of latency-only detection
A single anomaly is not a bot verdict. Privacy tools (VPNs, Tor), corporate proxies, accessibility software, and unusual devices (gaming consoles, smart TVs) can produce unexpected timing. BotRefund's approach — "A single anomaly is not a bot verdict… BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data" — reflects this.
Latency KPIs work best as part of a weighted model. The source pack notes: "BotRefund sends this signal into our prediction AI, which evaluates the complete picture across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy."
Don't block or refund based on one KPI. Use latency signals to prioritize manual review, build evidence for platform disputes, or feed a scoring model that combines 20+ signals.
Terminology quick reference
- GCLID: Google Click Identifier — a parameter appended to ad URLs that ties a click to a session. Essential for refund requests.
- Headless browser: A browser running without a UI (e.g., Puppeteer, Playwright). Often used for automation; detectable via missing APIs and timing anomalies.
- Residential proxy: An IP address assigned to a real household, rented to route bot traffic. Defeats IP reputation lists but not behavioral signals.
- Click Quality team: Google's internal group that reviews invalid click disputes. They require client-side evidence, not just server logs.
- Invalid traffic (IVT): Google/Meta's term for clicks they agree to refund — includes bots, competitor clicks, publisher fraud, and accidental clicks.
FAQ
Can I measure bot latency with Google Analytics 4?
Not reliably. GA4 samples high-traffic sites, aggregates events, and doesn't expose sub-100ms timestamps or raw mouse coordinates. You need a dedicated client-side script that captures performance.now() timestamps and pointer events at 60Hz+.
What's the difference between bot latency and page load time?
Page load time is server/network performance. Bot latency is the visitor's behavioral timing — how fast they click, move, scroll, and pause. A slow page can still have bot traffic; a fast page doesn't prove human traffic.
How many sessions do I need before latency KPIs are statistically meaningful?
At least 1,000 sessions per campaign/placement to establish human baselines. With fewer, you can't distinguish a fast user from a bot. BotRefund's free audit starts producing signal separation within minutes because it compares your traffic against a global baseline of 106 checks.
Do sophisticated bots fake human latency?
Yes. Advanced scripts add randomized delays (Gaussian, log-normal) and simulate mouse curves with Perlin noise. They still fail at cross-signal consistency: network timing won't match browser timing, device sensors won't match user agent, and 106-check correlation breaks down.
What latency KPI is most predictive for refund approval?
Superhuman input speed combined with GCLID correlation. Google's Click Quality team looks for "clicks that occur faster than humanly possible" tied to specific click IDs. Pair sub-1ms clicks with the GCLID from the ad click, and you have the evidence format they require.
Should I track latency differently for mobile vs desktop?
Yes. Mobile touch events have no hover state, so ghost click detection changes. Touch tremor is different from mouse tremor. Session durations are shorter on mobile. Build separate baselines per device class.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.