Why this is hard in the first place
Simple bots are obvious: identical User-Agent, no JavaScript, instant clicks with no pause. Modern bots are harder — they run inside a real browser, emulate cursor movement and keep the landing page open for a few seconds to imitate interest. Telling one of those from a human on any single parameter is no longer possible: you need a set of signals that together add up to “real person” or “automation”.
It is made harder by the need to decide fast — ideally before the ad platform charges for the click, rather than a day later while reading logs after the fact. That shifts the approach from occasional investigation to a system that scores every click continuously and decides immediately, while something can still be done about it.
Behavioural signals
On-page behaviour is the most durable source of signal, because imitating it is expensive and hard to scale across thousands of clicks. A simple bot only needs to follow the link and perhaps click once more inside the page — reproducing the unhurried, messy rhythm of a real person is technically harder and costlier, especially at volume.
| Signal | What it indicates |
|---|---|
| Time from click to first action | a person looks around and hesitates; a bot often acts on a timer |
| Cursor trajectory | human movement is non-linear with pauses; a crude bot moves in straight lines or not at all |
| Scroll depth | a person scrolls and lingers on blocks; a bot often never interacts with the page |
| Repetition of the same path | the identical route through the site again and again is a script, not genuine interest |
| Interval between clicks from one source | suspiciously regular intervals are untypical of humans |
Technical signals
Technical signals complement the behavioural ones and are especially useful against less advanced bots that cannot afford to disguise their environment as a real browser. They are readable at the connection and device level before the visitor has interacted with anything, which makes them the fastest to filter on — sometimes before the landing page has finished loading.
| Signal | What it indicates |
|---|---|
| User-Agent inconsistent with actual browser behaviour | spoofing or outdated emulation |
| Missing or spoofed screen resolution and timezone | typical of headless browsers and emulators |
| Mass visits from one IP or subnet | a click farm or a data centre rather than residential internet |
| JavaScript or cookies disabled on a live click | untypical for an ordinary person clicking an ad |
| Landing directly with no referrer on a paid click | may indicate the click was substituted outside the ad system |
Technical signals catch the cheapest, highest-volume bots first — the ones launched by a script with no full browser emulation. As more expensive bots appear, renting real browsers and proxying through residential IPs, purely technical signals weaken and the weight of behavioural evidence grows. That is why a reliable defence never relies on one type of signal but keeps rebalancing between them. How the overall problem is framed is in what click fraud is.
What to do when signals contradict each other
In practice not every click falls neatly into “definitely a bot” or “definitely a human” — some traffic lands in a grey zone where some signals suggest automation and others suggest a live visitor. There the sensible response is not to block automatically but to lower confidence: do not spend elevated bids on it, watch its subsequent behaviour, accumulate more data before deciding. Hard blocking on any doubtful signal costs more than it appears to: behind every falsely rejected click there may be a real customer who never reached the enquiry form — not because of fraud, but because of an over-aggressive filter.
A noticeable share of traffic in any campaign sits in that grey zone. That is normal and not cause for panic. The job of the defence is not to reduce it to zero but to keep it from growing unchecked, and the equivalent problem on affiliate programmes is covered in fraud in CPA affiliate programmes.
Frequently asked questions
Can you tell from a single click whether it is a bot or a human?
Almost never from one click. Modern bots emulate a real browser and sometimes even move the cursor. A confident conclusion comes only from several signals at once — behavioural and technical, evaluated together.
Which matters more, behavioural or technical signals?
They complement each other. Technical signals — browser emulation, spoofed parameters — catch the cruder bots; behavioural ones — action timing, cursor movement, scroll depth — catch the advanced ones that are technically indistinguishable from a real browser. A defence relying on only one type loses effectiveness over time.
Can a real person look like a bot by accident?
Yes. Someone on mobile data behind a VPN, with JavaScript blocked, or who simply closed an uninteresting page quickly will produce a bot-like picture on individual metrics. Which is why a decision on one signal risks blocking a real customer — the assessment has to be cumulative.