How bot detection works
The four detection layers, what each one can and cannot prove, and the specific mistakes the design is built to avoid.
Last updated
Four layers, one score
Every visit is scored from 0 to 100 by four independent layers. No single layer decides a verdict on its own, and each signal it contributes carries its own reason string.
| Layer | What it examines | What it can prove |
|---|---|---|
| 1. User agent | About 120 signatures covering AI crawlers, search bots, SEO tools, monitoring, HTTP libraries, and headless browsers, plus a referrer spam blocklist | That a client declared itself. It cannot prove anything about a client that lies |
| 2. IP verification | Published crawler ranges from OpenAI, Google, Microsoft, Perplexity, and DuckDuckGo, plus roughly 19,000 data center ranges | That a crawler is genuine, or that a user agent claiming to be Googlebot is not |
| 3. Browser behavior | Pointer movement, viewport, scroll depth, time on page, and the webdriver flag | That a real browser ran, and that a person interacted with the page |
| 4. Session and source shape | Instant bounces, request velocity, and whether a whole traffic source looks like a real audience | Patterns no single visit reveals |
Data center IP ranges are a first class signal
A headless browser presenting a normal Chrome user agent passes layer 1 without a scratch. What it usually cannot hide is where it is running: a cloud provider IP range rather than a residential one. That is why roughly 19,000 data center ranges are matched on every visit, rather than treated as a supporting hint.
The mistakes this design exists to avoid
- Accusing a real crawler. A reverse DNS lookup that returns nothing is not the same as one that returns a wrong answer. Google and Microsoft are verified against their published ranges, which needs no lookup at all.
- Punishing correct targeting. A geo targeted campaign that delivers 100 percent traffic from one country is the campaign working, not a bot farm, so country level concentration is not scored. City level concentration is.
- Letting one bad slice condemn a whole source. A zone is judged on everything it sent, never on its worst hour.
- Treating a suspicion as proof. Signals that describe a whole traffic source are capped well below the level where they could decide a verdict on their own.