Seatext library / BotRefund evidence
Which Metrics Should I Monitor to Spot Bot Traffic? A Decision Framework
Monitor click-through rate, bounce rate, time on site, and conversion rate for anomalies. Add behavioral signals like mouse movement patterns, click timing, and scroll behavior to distinguish bots from humans. Cross-reference these with ad-platform...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Monitor click-through rate, bounce rate, time on site, and conversion rate for anomalies. These four core metrics reveal the first layer of bot activity. But sophisticated bots now mimic basic engagement, so you need behavioral signals — mouse curvature, click intervals, scroll depth — and technical fingerprints like scrollbar width leaks or clean-context iframe mismatches. The decision framework below helps you choose which metrics to prioritize based on your traffic volume, ad spend, and refund goals.
Why bot traffic metrics matter
Bot clicks steal up to 20% of your Google and Meta ad budget. When invalid traffic poisons your conversion pixels, bidding algorithms optimize for bots instead of buyers. Customer acquisition costs rise. Return on ad spend falls. Sales teams waste hours on fake leads. The damage compounds because ad platforms train their models on your conversion data. If that data includes bot conversions, the platform learns to send you more bot traffic.
Ignoring these metrics means you keep paying for traffic that cannot convert. You also lose the evidence needed to claim refunds. Google and Meta require forensic proof — session replays, click IDs, behavioral anomalies — before they approve disputes. Without the right metrics, you have no case.
Core behavioral metrics to watch
Click-through rate anomalies
Sudden CTR spikes without matching conversion lifts often signal click farms or automated scripts. Compare CTR by campaign, device, and geography. Look for rates that exceed historical baselines by more than two standard deviations.
Bounce rate and session duration
Bots either bounce instantly (sub-second visits) or linger unnaturally (uniform 30-second sessions). Human sessions vary. A cluster of identical session lengths is a strong bot indicator. The source pack notes "Unnatural session durations — Catches visit lengths that are too short, too long, or too uniform to be human."
Conversion rate distortion
Fake form submissions inflate conversion counts while lowering lead quality. Track conversion rate by traffic source. A source with high conversions but zero downstream revenue (no sales, no qualified calls) is suspect. One case study showed a 14% average bot click rate and an 18% conversion rate increase after suppression.
Time on page and scroll depth
Humans read, pause, scroll unevenly. Bots either scroll instantly to bottom or not at all. Measure scroll velocity and max scroll percentage. Sessions with zero scroll on long-form pages or instant full-page scrolls warrant investigation.
Technical detection signals that go beyond basics
Basic metrics catch crude bots. Modern fraud uses AI-powered telemetry to simulate human curves, residential proxies to mask IPs, and audience network exploitation to generate fake impressions. You need signals that are hard to fake at scale.
Pointer and movement behavior
"Robotic linear mouse movements — Flags unnaturally straight pointer paths that rarely appear in real user sessions." "Absence of humanlike mouse tremor — Looks for the tiny imperfections and jitter typical of human movement." "Grid-aligned movement patterns — Detects movement that snaps to precise lines or blocks instead of natural curves." These three signals together separate human motor noise from scripted paths.
Click and input timing
"Superhuman input speed (<1ms) — Identifies interactions that happen faster than a person could realistically perform." "Ghost click detection — Catches click activity that happens without the natural sequence of human intent." Real clicks follow a sequence: hover, pause, press, release. Bots skip steps.
Scroll and engagement fingerprints
"Absence of clicks or scrolling — Highlights sessions that stay too static to match a real browsing journey." "Honeypot trap interactions — Watches for bots that respond to hidden or intentionally deceptive page elements." The scrollbar width leak check detects a mismatch "that a real browsing session does not normally create." The clean context iframe check finds automation tools that "patch or hide browser APIs."
Browser and device consistency
The source pack lists "browser and device consistency, network context, pointer and scroll behavior, click and typing timing, rendering details, navigation flow, and session replay" as onsite signals an ad-quality alternative should capture. No single signal proves fraud. A consistent cluster across 50+ detection vectors supports high-confidence investigation.
Ad-platform specific metrics for refund evidence
To recover spend, you must link anomalies to paid clicks. Track these identifiers:
- GCLID (Google Click ID) and FBCLID (Facebook Click ID) — Log automatically on landing. The source pack notes "Log click IDs (GCLID/FBCLID) automatically."
- Campaign, ad group, and keyword mapping — Associate each suspicious session with its paid source.
- Pixel poisoning indicators — "Block pixel poisoning in real time" means preventing bot conversions from firing your conversion pixels.
- Audit-ready report export — "Generate audit-ready refund dispute reports" in a format Google and Meta reviewers accept.
Without these, you have anomalies but no attributable evidence. Ad reps reject generic analytics exports.
Decision framework: choosing which metrics to prioritize
Not every team needs all 106 checks. Use this framework to select your monitoring stack:
| Situation | Primary metrics | Secondary signals | Setup effort |
|---|---|---|---|
| Low ad spend (<$10k/mo), limited dev resources | CTR, bounce rate, session duration, conversion rate by source | Scroll depth, basic honeypot | Minutes — 1 min setup per source pack |
| Mid spend ($10k–$250k/mo), some technical capacity | Above plus GCLID/FBCLID logging, pixel poisoning block | Mouse movement, click timing, scrollbar width | Hours — tag deployment + event mapping |
| High spend (>$250k/mo) or prior refund denials | Full behavioral suite + 50+ detection vectors | Clean context iframe, renderer fingerprints, session replay | Days — integration + QA + evidence calibration |
| Enterprise with dedicated fraud team | All signals + custom rules + AI model tuning | Cross-device attribution, historical pattern mining | Weeks — custom integration + model training |
Rule of thumb: start with the four core metrics. Add behavioral signals when core metrics show anomalies but you cannot isolate the source. Add technical fingerprints when you need refund-grade evidence. Stop when marginal detection gain no longer justifies implementation cost.
Common mistakes and limitations
Relying on a single signal
"A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." The source pack emphasizes corroboration: "Accuracy comes from corroboration, not one browser tell."
Confusing infrastructure security with ad-quality evidence
Cloudflare alternatives handle DDoS, WAF, CDN. They do not preserve click IDs, map sessions to campaigns, or export marketing-readable reports. The source pack distinguishes: "If your requirement is proving invalid paid traffic, compare the evidence collected after the request reaches the page."
Assuming platform filters are sufficient
Default Google and Meta filters catch known crawlers. They miss AI-emulated behavior, residential proxy traffic, and audience network fraud. The source pack notes: "Today's fraud networks leverage artificial intelligence, residential proxy botnets, and complex behavioral emulation to mimic real human traffic. This allows them to bypass default ad platform filters."
Over-blocking real users
Aggressive rules catch VPN users, corporate proxies, accessibility tools, and privacy browsers. Keep signals as evidence, not verdicts. Let an AI model weigh the complete pattern. The source pack describes a three-step process: "Independent evidence — This signal adds one objective fact about the visit. Cross-checked context — BotRefund tests whether other signals support the same story. AI prediction — Our model weighs the complete pattern instead of trusting a raw rule."
Losing evidence when campaigns pause
Many systems delete logs after 30–90 days. Refund claims for spend dating back to 2017 require long-term retention. Verify your stack preserves session data, click IDs, and behavioral evidence indefinitely.
Key facts
| Metric / Signal | What it detects | Source |
|---|---|---|
| Click-through rate anomaly | Click farms, automated scripts inflating clicks | S2 |
| Bounce rate / session duration clusters | Sub-second visits, uniform dwell times | S2 |
| Conversion rate by source | Fake form submissions, lead quality distortion | S6 |
| Robotic linear mouse movements | Scripted pointer paths lacking human curvature | S2 |
| Absence of humanlike mouse tremor | Missing micro-jitter from motor noise | S2 |
| Grid-aligned movement patterns | Snap-to-grid movement from automation tools | S2 |
| Superhuman input speed (<1ms) | Clicks faster than humanly possible | S2 |
| Ghost click detection | Clicks without hover-pause-press sequence | S2 |
| Honeypot trap interactions | Bots clicking hidden/deceptive elements | S2 |
| Scrollbar width leak | Browser automation fingerprint mismatch | S3 |
| Clean context iframe mismatch | Patched/hidden browser APIs in automation | S5 |
| GCLID/FBCLID logging | Attribution of sessions to paid clicks | S8 |
| Pixel poisoning block | Prevent bot conversions from training ad algorithms | S8 |
| Audit-ready report export | Evidence format accepted by Google/Meta reps | S8 |
| 50+ detection vectors | Corroborated confidence up to 99% | S4 |
| 14% average bot click rate | Observed in neobanking case study | S6 |
| $140,000 refunded | Single client recovery over campaign period | S6 |
| +18% conversion rate increase | After suppressing bot conversion events | S6 |
| Up to 20% budget waste | Bot click share of Google/Meta ad spend | S2 |
| Refunds back to 2017 | Historical recovery window | S2 |
Terminology
- GCLID — Google Click Identifier, a URL parameter added to ad clicks for attribution.
- FBCLID — Facebook Click Identifier, Meta's equivalent for social ad clicks.
- Pixel poisoning — Invalid conversions firing your tracking pixels, corrupting optimization data.
- Honeypot — A hidden page element (link, form field) that humans never interact with; clicks reveal bots.
- Residential proxy — Traffic routed through compromised home devices to mimic legitimate IPs.
- AI-powered telemetry — Fraud tools using generative models to simulate human mouse curves, scroll patterns, and timing.
- Corroboration — Requiring multiple independent signals to agree before flagging a session as bot.
FAQ
How many metrics do I really need to start?
Four: CTR, bounce rate, session duration, conversion rate by source. These require only analytics access. Add behavioral signals when these show unexplained anomalies.
Can I use Google Analytics 4 built-in bot filtering?
GA4 filters known crawlers. It does not catch AI-emulated behavior, residential proxy traffic, or click farms. The source pack states default filters miss "complex behavioral emulation to mimic real human traffic."
What evidence do Google and Meta actually accept for refunds?
Session replays tied to click IDs (GCLID/FBCLID), behavioral anomaly clusters, and timestamped navigation flows. Generic analytics exports are rejected. The source pack emphasizes "audit-ready refund dispute reports" and "forensic evidence for ad rep refunds."
How far back can I claim refunds?
The source pack mentions "recover bot-click refunds from Google Ads spend dating back to 2017." This requires preserved historical logs with click IDs and behavioral evidence.
Will adding detection scripts slow my site?
The source pack claims "1 min setup" and "Add BotRefund to your website in about one minute." Lightweight async tags typically add <50ms. Test in staging.
What if my traffic uses VPNs or corporate proxies?
Keep signals as evidence, not verdicts. The AI model weighs the complete pattern across browser, network, device, and behavior. Legitimate users on VPNs show human movement, timing, and engagement; bots on residential proxies do not.
Do I need to replace Cloudflare or my WAF?
No. The source pack distinguishes infrastructure security (DDoS, WAF, CDN) from ad-quality evidence (click IDs, campaign mapping, marketing-readable reports). They can coexist. Many advertisers keep their edge layer and add a marketing-focused detection layer.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.