How Skrypte filters bots before an ad is served.

Before Skrypte can build anything smarter on top of its ad delivery, the traffic underneath it has to be trustworthy. That's the part we built first, and it runs on every single ad request. Here's what actually happens between a page asking for an ad and Skrypte deciding whether to serve one.

Rate limiting, per visitor

Each request is tied to a hashed version of the visitor's IP address, and that hash is used to count how many requests are coming from the same source within a rolling one-minute window. Past 20 requests in that window, the visitor is treated as a bot and the request is blocked. This catches scripted traffic hammering a page far faster than a real visitor ever would.

A bot score, checked against a hard limit

The client reports a bot score between 0 and 100 with each request. Anything at 80 or above is treated as automated traffic and blocked outright, no exceptions.

Signals that point to a headless or automated browser

On top of the score, the request is checked against a specific set of signals known to indicate automation frameworks or virtual browser environments: things like a webdriver flag, known automation tool fingerprints such as PhantomJS or Selenium, a software renderer where a real GPU should be, or a canvas signature that matches a known headless setup. These same underlying signals, canvas and WebGL renderer checks, exist specifically to catch automated and virtual browsers. They are not used to re-identify a specific human visitor across sessions.

Domain and site verification

Every ad unit belongs to a registered site with its own key. A request has to present the right key and come from a domain that actually matches the registered site, or it's treated as a mismatch and blocked. This stops an ad unit from being embedded somewhere it wasn't approved for.

What happens after the check

Requests that fail any of the above are blocked before an ad is served, and nothing about them is billed. Requests that pass fall through to delivery, which today means a single fallback creative shown to every visitor while campaign matching is being built on top of this same verified traffic. Filtering comes first because a matching system built on top of unverified traffic just amplifies fraud instead of reach.