To investigate whether bots are clicking your ads, connect evidence of automation to identifiable paid visits. Bots elsewhere on your website, a proxy flag, or a visitor leaving without buying do not establish that your advertising budget was spent on bots.
There are three questions to answer: what activity looks automated, whether it connects to an ad click, and what the platform actually charged. Keeping those questions separate makes the result more useful.
Bots on a website are not automatically bots clicking ads
Button's desktop-browser consistency study examined 1,409 IPs with eligible desktop Chromium readings across three small websites. Of those, 882 failed one browser-consistency check. No identified ad click was recorded for those 882 IPs.
That was a substantial technical finding, concentrated mostly on one site. It was not a measured paid-click fraud rate. The collected data did not link that flagged cohort to advertising clicks.
The distinction also prevents an easy reporting mistake: dividing all suspicious website visitors by paid clicks. Those counts describe different populations and cannot form a meaningful advertising-fraud percentage.
What evidence should you collect?
| Evidence | What it helps establish | What remains to check |
|---|---|---|
| Ad click identifier and landing time | A connection between the observed visit and an advertising click identifier | Billing, platform validity and possible repeated or copied identifiers |
| Browser automation or consistency evidence | A technical reason to investigate the client | Supported browser versions, benign configurations and independent validation |
| IP and network information | Hosting, proxy or location context | Shared networks, label freshness and legitimate customer use |
| Timing and page sequences | The activity carried out during the visit | Normal campaign journeys, integrations and collection artefacts |
| Verified order or qualified lead | A commercial outcome | Its linkage to this visit; the outcome does not establish who operated the browser |
Look for corroboration that adds information. Three labels derived from the same network feed are not three independent checks.
A browser fingerprint has two different jobs
Fingerprinting can help recognise a returning browser. Browser consistency checks can also expose contradictions in what a client reports. Recognition and automation detection are different tasks.
A plausible fingerprint does not establish a human operator: automation can use an ordinary browser. An unusual fingerprint also needs context, because privacy settings, in-app browsers, accessibility features and collection errors can change observations.
Our published consistency study describes one check, the eligible browsers, a comparison group and its limits. It does not establish a universal detection rate or prove reliable device recognition across IP changes. Those would require separate tests.
A proxy flag can include potential customers
In the residential-proxy study, flagged IPs included payment-success-page observations. Within the paid subset, two of 363 flagged IPs reached that page, compared with three of 397 unflagged IPs.
Those are small counts from about 46 hours on one store, not independently confirmed orders. They do show why a proxy label alone was insufficient grounds for discarding the whole group. The same study documents a logging gap for VPN-classified traffic, so its VPN outcomes cannot be read as an unbiased comparison of customer behaviour.
For a broader investigation, see how ecommerce teams detect bots behind proxies.
Do not turn missing collection into a bot finding
In the October research exports, roughly one in ten IPs sent only an initial request carrying no page or ad information. Those observations could not be attributed to an ad in that dataset.
“No fingerprint arrived” is a collection state. Establish whether the browser loaded the script, whether collection was blocked or interrupted, and which fields the collector was expected to send before interpreting the absence.
Likewise, a consistency check applies only where the browser supports the relevant API. A missing reading and a failed check need separate counts.
Connect technical evidence to the advertiser's decision
Start with one campaign and a declared observation window. Count identifiable paid clicks, report collection coverage, and inspect journeys with technical evidence. Keep unresolved cases visible. Review examples that contradict the suspected rule, especially visits associated with meaningful outcomes.
Then ask what response the evidence supports. It might be a targeting review, a tracking repair, a controlled protection experiment or continued observation. A technically suspicious visit does not automatically justify suppressing an entire campaign.
If the question is financial, reconcile the website observations with platform reporting, invalid-click adjustments and actual spend. An on-site classification does not establish a charged click or refund entitlement.
Questions advertisers ask
Can a bot complete a form or reach a thank-you page?
Yes. A recorded action describes what happened, not who operated the browser. Verify the commercial outcome separately and retain the technical evidence. This guide reports no measured fake-lead detection results.
Does a data-centre IP prove a fraudulent ad click?
No. It supplies network context. Establish the paid-click linkage, inspect the activity and distinguish an automation finding from a billing claim.
What should I inspect first?
Choose the paid campaign where the concern is concentrated, then inspect the underlying visits and collection coverage. Our campaign investigation guide explains how to compare groups. If the concern began with disappointing sales, start with the clicks-without-sales diagnostic.
Sources and method
This guide interprets Button's published proxy and desktop-browser studies. The three sites had different observation windows between 9 and 14 October 2026. The browser study counts IPs with eligible readings, excludes crawlers and is heavily influenced by one site's traffic. The proxy outcome comparison uses page observations rather than reconciled orders. See the public dataset and scripts for definitions and reproduction. No new traffic analysis or detection benchmark is reported here.
Read how Button presents traffic evidence or start observing your own site.
AI disclosure: Written by ChatGPT (AI), drawing on studies originally analysed by Claude (Anthropic), with research signals and data supplied by Nathan Pankowsky. Editor: Nathan Pankowsky.