Seatext library / BotRefund evidence
Which WebGL Texture Constraints Do Bot Detection Systems Check?
Bot detection systems commonly check maximum texture size, texture filtering modes, antialiasing support, depth buffer precision, and shader precision ranges. These WebGL parameters reveal whether a browser's reported hardware matches its actual rendering behavior,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Bot detection systems check a handful of WebGL texture parameters to spot mismatches between a browser's claimed device profile and its actual graphics behavior. The most frequently tested constraints are maximum texture size, supported texture filtering modes, antialiasing availability, depth buffer precision, and shader precision ranges. When these values don't align with the expected profile for a given GPU or device, the visit gets flagged for further review.
What WebGL Texture Constraints Are
WebGL texture constraints are the limits and capabilities a browser reports about its graphics stack. They come from the underlying GPU driver and hardware, so they're difficult to fake consistently. A real browser on a physical device produces a coherent set of values that match that hardware's specifications. Automated browsers, virtual machines, and spoofing tools often report values that conflict with each other or with known device profiles.
According to BotRefund's detection methodology, the WebGL Texture Constraint check is "one of 106 independent checks BotRefund uses to build a reliable picture of whether a visit is human or automated." The system looks for "a mismatch that a real browsing session does not normally create" where "virtual machines and spoofed profiles can claim one device while their graphics, fonts, audio, or processor behavior tells another story."
Common Texture Parameters Bot Detection Checks
| Parameter | What It Reveals | Typical Bot Anomaly |
|---|---|---|
| MAX_TEXTURE_SIZE | Maximum dimension (width/height) for textures | Values that don't match the claimed GPU (e.g., mobile GPU reporting desktop limits) |
| MAX_CUBE_MAP_TEXTURE_SIZE | Maximum size for cube map textures | Inconsistent with MAX_TEXTURE_SIZE ratio for the claimed device |
| MAX_RENDERBUFFER_SIZE | Maximum renderbuffer dimensions | Mismatch with texture size limits on same GPU |
| Texture filtering modes | Support for NEAREST, LINEAR, MIPMAP variants | Missing modes that the claimed GPU/driver should support |
| Antialiasing support | Whether MSAA or other AA is available | Disabled on hardware that always exposes it, or enabled on hardware that doesn't |
| Depth buffer precision | Bits allocated for depth (16, 24, 32) | Precision that doesn't match the claimed GPU class |
| Shader precision ranges | Vertex/fragment shader float/int precision (lowp, mediump, highp) | Ranges inconsistent with the reported GPU architecture |
| MAX_VERTEX_TEXTURE_IMAGE_UNITS | Texture units accessible from vertex shaders | Zero on devices that support vertex texturing, or inflated values |
| MAX_COMBINED_TEXTURE_IMAGE_UNITS | Total texture units across shader stages | Sum doesn't match vertex + fragment limits |
How the Check Works in Practice
When a visitor loads a page, the detection script creates a WebGL context and queries the relevant parameters through gl.getParameter(). It then compares the returned values against a database of known-good profiles for the device type the browser claims to be (via user agent, client hints, and other signals).
The check doesn't operate in isolation. BotRefund's approach treats each signal as "independent evidence" that "adds one objective fact about the visit." The system then "tests whether other signals support the same story" through cross-checked context, and finally "weighs the complete pattern instead of trusting a raw rule" via AI prediction. This multi-layered approach is why they claim "99% accuracy" — "accuracy comes from corroboration, not one browser tell."
Why Single Signals Aren't Verdicts
A single anomalous texture parameter doesn't automatically mean bot. Legitimate scenarios create outliers:
- Privacy-focused browsers or extensions that randomize or mask WebGL fingerprints
- Corporate networks with virtualized desktop infrastructure (VDI)
- Unusual but genuine hardware configurations
- Travelers using devices in different regions
- Browser updates that change reported capabilities
BotRefund explicitly states: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data."
Cross-Validation with Other Signals
The texture constraint check gains reliability when combined with other fingerprinting vectors:
- Canvas fingerprinting: Rendering differences that correlate with texture anomalies
- GPU vendor/renderer strings: Should match the texture capabilities
- Audio context fingerprinting: Independent hardware signal
- Font enumeration: System fonts that align with OS/device claims
- Behavioral signals: Mouse movement, click timing, scroll patterns
- Network signals: IP reputation, VPN/proxy detection, port scanning
When texture constraints disagree with the claimed GPU vendor string, and behavioral signals show automation patterns, and network signals indicate data center IPs — the combined weight supports a bot classification.
Limitations and False Positives
Texture constraint checks have blind spots:
- Sophisticated spoofing: Advanced tools can inject consistent WebGL parameters matching a target device profile
- Driver updates: Legitimate parameter changes after GPU driver updates
- Browser privacy features: Firefox's
privacy.resistFingerprintingand similar features intentionally normalize values - WebGL 2 vs WebGL 1: Different parameter sets; some checks only work in one version
- Headless browsers with real GPUs: Cloud instances with GPU passthrough report authentic values
These limitations are why the check must remain one signal among many, not a gatekeeper.
Practical Checklist for Developers
If you're building or testing bot detection, verify these texture constraints:
- Query
gl.getParameter(gl.MAX_TEXTURE_SIZE)and compare to device class expectations - Check
gl.getParameter(gl.MAX_CUBE_MAP_TEXTURE_SIZE)for consistency - Verify texture filtering support:
gl.getExtension('OES_texture_float'),OES_texture_half_float,WEBGL_depth_texture - Read antialiasing via context creation attributes and
gl.getContextAttributes().antialias - Query depth bits:
gl.getParameter(gl.DEPTH_BITS) - Check shader precision:
gl.getShaderPrecisionFormat(gl.FRAGMENT_SHADER, gl.HIGH_FLOAT) - Validate
MAX_VERTEX_TEXTURE_IMAGE_UNITS> 0 for devices claiming vertex texturing support - Cross-reference all values against a maintained device profile database
- Log anomalies as evidence, not verdicts — feed into a scoring model
- Regularly update profile database for new devices and driver versions
Frequently Asked Questions
Can a bot perfectly spoof all WebGL texture constraints?
In theory, yes — a sophisticated attacker can inject a complete, consistent WebGL fingerprint matching a real device. But maintaining consistency across WebGL, Canvas, Audio, fonts, behavioral, and network signals simultaneously is extremely difficult. Most bot operations fail at one or more layers.
Do privacy browsers trigger false positives on texture checks?
Yes. Firefox with privacy.resistFingerprinting=true, Brave's fingerprinting protections, and some extensions normalize or randomize WebGL parameters. This creates anomalies that look like spoofing but are legitimate privacy features. Cross-validation with behavioral signals helps distinguish them.
How often do legitimate devices have unusual texture constraints?
Uncommon but not rare. Driver updates, unusual GPU/OS combinations, virtualized environments (VDI, cloud gaming), and embedded devices can all produce out-of-profile values. A detection system needs a regularly updated profile database and tolerance for legitimate variance.
What's the difference between WebGL 1 and WebGL 2 texture checks?
WebGL 2 exposes additional parameters (MAX_3D_TEXTURE_SIZE, MAX_ARRAY_TEXTURE_LAYERS, MAX_TEXTURE_BUFFER_SIZE) and different shader precision queries. A thorough check tests both contexts when available, since a bot might spoof one but not the other.
Can texture constraint checks run without user interaction?
Yes. Creating a WebGL context and querying parameters is silent and fast (<5ms). No user permission or interaction is required. This makes it suitable for early-page-load detection.
How do texture constraints relate to Canvas fingerprinting?
They're complementary. Canvas fingerprinting renders an image and hashes the pixel output, capturing driver-level rendering differences. Texture constraints query the API-reported limits. A spoofed Canvas hash with mismatched texture limits is a strong signal; consistent values across both increase confidence in the device profile.
What should I do if my legitimate users get flagged?
Review the specific anomaly: is it a known privacy feature, VDI environment, or new device? Adjust your scoring thresholds or add the profile to your allowlist. Never block on a single signal — use it to increase scrutiny (challenge, rate limit, manual review) rather than deny access outright.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.