Frequently asked questions

We don't file refunds with the ad platforms. On Meta you mostly pay for impressions, not clicks, and Meta doesn't charge you for clicks it flags as invalid. Where you really save is before any of that happens: we stop the bots before they hit your page or fire your pixel, so Meta learns from real people and stops spending your budget on bots.

On Google, you aren't charged for the invalid clicks Google catches itself, and you can dispute the ones it misses with the IP addresses and click IDs from our blocked-click data. That's how Cardone Capital got $212,000 in click fraud credited back, and how Chicago Steak Company got a $60,000 attack, racked up in 5 minutes, refunded after we blocked it.

Nothing. When a paid click scores as a bot, our edge answers with an empty response — HTTP 204 No Content — before your page loads. No page, no form, no pixel, no error message, so the bot never touches your funnel or your data. Real visitors pass straight through and are never shown a challenge, and traffic that isn't from your ads isn't touched.

Four steps, and your live campaigns stay untouched:

1. Tell us which landing pages your ads send traffic to, and who manages your DNS.
2. Your IT adds the DNS records we send for a subdomain such as ads.yourdomain.com — a few minutes.
3. We copy your top campaigns and point the copies at the subdomain.
4. You watch every click's bot score in the dashboard.

No code on your site and no changes to your ad accounts. The trial is free, so start there.

One to three records on a new subdomain, and nothing else in your DNS changes — not your main site, not other subdomains, not email. The record that routes your ad traffic is a CNAME from the subdomain (for example ads) to proxy.adbotdetection.ai. Depending on how the certificate validates, we may also send a TXT record that proves ownership and a CNAME for the SSL certificate. We send the exact values; the certificate issues and renews automatically. If your DNS is on Cloudflare, set the record to DNS only (grey cloud).

Use a subdomain of the domain your ads already advertise — for example ads.yourdomain.com — so the ad still shows your own domain. The name is up to you. Behind it we proxy to your real landing pages: ads.yourdomain.com/landing-page serves yourdomain.com/landing-page, and the ad platforms treat it as your domain. If your IT prefers, we can test on staging first. Your main site, organic traffic and SEO aren't touched — only traffic sent to the subdomain goes through bot detection.

Bot detection runs on Cloudflare's network, through custom hostnames your IT controls in your own DNS — remove the records and it's gone. For your ad traffic we process request data — IP address, user agent, request fingerprint and behaviour signals — to decide whether each visit is human. For that data you are the controller and we act on your instructions, and we don't sell personal information. Our privacy policy lists what we collect and who receives it; whether your own policy needs a line is a question for your counsel.

Edge detection scores the click on Cloudflare's network before your page exists for that visitor. A bot gets an empty response, so it never loads your page, fills your forms, or fires your pixel and Conversions API. On-site tools run JavaScript inside the page, so by the time they decide, the page has loaded and your tags may already have fired. Server-side tools only see the request after it reaches your server. We sit in front of all of it.

It's the first-party pixel — our second product, Verified Visitor ID — and it is a client-facing feature. It resolves anonymous visitors on your site into person-level records. It sits behind bot detection, so identification is only spent on real humans, and it installs through Google Tag Manager. Bot detection itself needs no script at all.

The pixel identifies about 40% of visitors, and those match well to the visitors our bot detection scores as human. Identified visitors go into retargeting audiences in Meta, with custom events set up for them. Because these people never typed in their own email, we keep them out of automated email sequences. We can put in onboarding hours to set it all up with your Meta and CRM.

Pricing is tiered, so book a call and we'll quote you. We guarantee a 30% ROAS lift, and we only take on clients we know we can massively improve. The trial is free, so start there — tons of value, and it doesn't cost anything.

A setter only reaches the leads that made it into your CRM. Bots that click your ads and never fill in a form still spend your budget and teach the ad platforms to find more traffic like them — none of that shows up on a setter's call list. Blocking bots at the click is what makes the leads that do arrive real people, which is what our 98% Human Traffic Guarantee covers.

Keep Google's credits — they cover the invalid clicks Google identifies itself. We work on a different layer: bots that identify themselves, including Google's and Meta's own crawlers, are let through, and traffic that presents as a person but that Cloudflare scores as automated is blocked before it reaches your page, your pixel or your targeting. More than half of all internet traffic is now automated.

It's a proxy, not a redirect. The visitor stays on your own ads subdomain and sees your real page, served from your own site — nothing bounces them anywhere, and the world sees your domain. The bot check happens on Cloudflare's network before the page is served, and your Google Tag Manager and Analytics keep firing on the page.

Everyone has bots — the question is how many. Across the major ad platforms, invalid traffic runs from about 8% on Google and Meta to 24% on TikTok, and B2B lead generation sees the most of any vertical. The trial replaces the guess with your own number.

There's nothing to install on your site — no code and no pixel — just DNS records for a subdomain your IT controls. It works as a bodyguard in front of your ads' landing pages, protecting your data, your pixel and your targeting. To remove it, point the ads back at the original page, then delete the records.

No. Copy your top campaign in Google and Meta, keep the original running, and use your ads subdomain as the link in the copy's ads. As soon as the copy is published, we see every click it gets — bot, fake human or real person.

No. Bot detection stores technical request data and ad attribution — no name, email address, phone number, physical address, login or payment details. The IP address and device details arrive with every web request and are used for traffic analysis and bot detection. Click records are kept in a Cloudflare D1 database.

No — we don't file refunds with the ad platforms. On Meta you mostly pay for impressions, not clicks, and Meta doesn't charge you for clicks it flags as invalid. Where you really save is before any of that happens: we stop the bots before they hit your page or fire your pixel, so Meta learns from real people and stops spending your budget on bots. For Google, we give you the blocked-click data — IP addresses, click IDs and timestamps — to submit through Google's invalid-click form.

No. Only the traffic you send to your ads subdomain goes through bot detection. Organic and direct visitors — and Google's crawler — keep going straight to your site, and the proxied ad pages are set to noindex so they don't compete with your real pages.

Only when the ad sends people to your site. With an instant form the person stays inside Facebook or Instagram, so there is no click to your page to score. Once the form sends them on to your site, we see that click. To get the full picture, test ads that drive to a form on your own site.