How to Detect Bots on Your Website: Behavioural Signals
Bot signals: mouse anomalies, instant actions, fake browsers, honeypots, datacenter IPs. How to tell automated traffic from humans.
How to Detect Bots on Your Website: Behavioural Signals
Bots are becoming more "human", but they are still betrayed by behaviour patterns that are hard to fake. Here are the signals modern bot protection relies on.
Mouse behaviour anomalies
Humans move the cursor along curved trajectories with acceleration and pauses. Bots often:
- teleport the cursor — instant jumps between points;
- move the mouse along perfectly straight lines;
- click without any micro-movements before the press;
- don't move the mouse at all but click actively (taps on mobile).
Instant actions
A human cannot click a link 50 milliseconds after page load — they need time to see the element and react. Bots act instantly. The same applies to forms: instant typing of long text is almost certainly automation.
Honeypots
The most reliable method is elements that are invisible to humans but visible to bots:
- hidden links in the HTML — humans never see or click them, bots crawl the whole DOM and follow them;
- hidden form fields — bots fill everything, humans fill only what is visible;
- trap pages with no navigation links, which bots find by direct paths.
Hitting a honeypot is a 100% bot label: no false positives, because a real user physically cannot get there.
Fake browsers
A bot may claim in HTTP headers to be Chrome on Windows, but contradictions give it away: JavaScript properties don't match the claimed browser, real Chrome features are missing, or automation signals (webdriver, CDP) are present.
IP reputation
Datacenter, proxy, and VPN traffic is not a verdict on its own (real users use VPNs too), but it is a strong signal. Combined with behavioural anomalies it significantly raises the probability of a "bot" verdict.
The main rule: signals combine, one is never enough
No single signal is sufficient. A real user may be behind a VPN, and a bot may perfectly mimic behaviour. Protection works when many signals are combined into a single score, and the decision is made by threshold, accounting for the cost of each type of error.
In the next article — how the cascade analysis that combines all these signals into one decision actually works.