- DataDome's verdict is not binary — it is a probability score in the spirit of a 0–100 scale for how automated a request looks.
- The score stacks four signal families — behavior, technical fingerprint, network origin and cross-network reputation — computed by continuously updated machine-learning models in milliseconds.
- The site owner sets thresholds that map the score to three actions: allow, challenge with a device check, or block. Setting the threshold high or low is a trade-off between misses and false positives.
- For advertisers, this edge score and the ad platform's own invalid-traffic judgement are two stacked layers with different definitions — read them as layers.
What a bot score actually is
A bot score is, at heart, a probability estimate: how likely this request came from automation rather than a real person. DataDome does not return “yes/no”; it gathers many signals, feeds them to machine-learning models, and emits a continuous score. Picture a scale from 0 to 100 where higher means more automated. The decision is not made by the score itself but by the line the site owner draws on that scale — the threshold. For the groundwork, start with our primer on bot traffic detection and the overview of what DataDome is.
Why a probability instead of a hard rule? Because automation disguises itself. A rule like “block anything from a datacenter IP” both lets residential-proxy bots through and hits real users on a VPN. A probability score weighs many weak signals together, which draws a steadier line between “looks human” and “looks automated.”
What builds the score
The score is not set by any single signal but by four families stacked together. Understanding them explains why the combination is what matters:
- Behavioral signals — mouse paths, scrolling, dwell time, click cadence and request rhythm. Humans are irregular; millisecond-perfect intervals, zero scroll and mechanical page-flips push the score up.
- Technical fingerprint — browser and device fingerprints, TLS/HTTP fingerprints, the JavaScript execution environment, headless-browser traits, and missing or spoofed browser APIs.
- Network origin — IP reputation (datacenter vs residential), ASN, proxy/VPN traits, and whether geolocation matches expectations.
- Cross-network reputation — how the same fingerprint or IP has behaved across DataDome's entire customer network. A fingerprint that just misbehaved elsewhere already carries a mark when it reaches you.
The verdict always comes from the combination. “Datacenter IP + headless fingerprint + zero scroll + a fingerprint that hammered forms elsewhere last week” stacks up to a score high enough to trigger a block; no single signal is enough to convict on its own. For how a session is remembered and stitched across requests, see our breakdown of the DataDome cookie and how bot-detection sessions work.
How thresholds turn a score into a verdict
Once there is a score, the site owner decides where to act on the scale. Typically there are three bands:
| Score band | Verdict | What it means |
|---|---|---|
| Low (looks human) | Allow | The request passes straight into your business logic; the visitor notices nothing. Most real traffic sits here. |
| Middle (uncertain) | Challenge | Triggers a device check (DataDome's own verification rather than a classic image puzzle). Real users usually clear it seamlessly; automation often cannot. |
| High (looks automated) | Block | The request is stopped before it reaches your landing page, conversion pixels or retargeting audiences. |
Where the threshold sits is a trade-off, not a “correct answer.” Set it too loose (block only the very highest scores) and misses rise — dirty traffic seeps in. Set it too tight (block even the middle band) and false positives rise — real users can get caught. Most teams tune it per surface: tighten high-value paths like login and checkout, loosen ordinary browse pages. This is the same thinking behind ad-platform landing-page verification — they, too, draw a line between “looks human” and “looks automated.”
Why the same visitor can get a different verdict
A common confusion: the same person is sometimes allowed and sometimes challenged. The reason is that the score reflects context, not just identity. Several things push it up:
- A changed network path — switching from home Wi-Fi to a datacenter VPN or proxy instantly worsens the network-origin signal.
- An atypical browser session — a headless or script-driven browser leaks tells in its technical fingerprint.
- A sudden burst of requests — high-frequency requests in a short window make the behavioral rhythm look non-human.
- A dirtier fingerprint history — the same fingerprint or IP recently tripped controls elsewhere, so cross-network reputation raises its starting score.
In other words, the same person on a normal browser and a normal connection typically stays comfortably in the allow band; the same person on a suspicious network path may be challenged. That is why any “trust a fingerprint forever after one human visit” approach to protection is never stable.
An often-missed point: ad-platform landing-page verification uses this same scoring logic — verification visits carry atypical fingerprints to check whether your page behaves consistently for different visitors. So understanding this score both helps you read traffic quality and helps you keep your landing page consistent and compliant for every visitor. Further reading: how ad platforms check whether a page branches by identity.
The edge score vs the platform's invalid-traffic count
If you buy traffic, keep the two judgements separate. DataDome (or any edge bot detector) scores and blocks at your own edge, protecting your conversion pixels and retargeting audiences; the ad platforms — Google, Meta, TikTok — run their own invalid-click/invalid-traffic judgement and adjust billing and account health accordingly. The two definitions are not identical, so you will see cases where your own dashboard looks clean but the platform still flags some traffic as invalid. That is usually not a bug — it is two layers each working from its own vantage point. To understand how invalid traffic itself is graded, see our explainer on invalid traffic and the breakdown of general (GIVT) versus sophisticated (SIVT) invalid traffic.
To compare the shared logic and differences across engines (DataDome, Cloudflare, HUMAN), see our comparison of bot detection systems; for defending against the click-fraud form specifically, see click fraud protection.
Frequently asked questions
What is a DataDome bot score?
It is a probability estimate of how likely a request is automated rather than a real human. Instead of yes/no, the engine combines four signal families — behavior, device fingerprint, network origin and cross-network reputation — and machine-learning models turn them into a single score in milliseconds. The site owner sets a threshold that decides whether a given score is allowed, challenged or blocked.
Why does the same visitor sometimes get a different verdict?
Because the score reflects context, not just identity. A changed network (Wi-Fi to a datacenter VPN), a headless or automated browser, a burst of rapid requests, or a fingerprint that misbehaved elsewhere on the network can all move the score. The same person on a normal browser and connection usually stays in the allow band; the same person on a suspicious path may be challenged.
What does the bot score mean for advertisers?
It is one of two stacked judgements on your traffic. An edge score like DataDome's filters automation before it reaches your landing page, pixels and retargeting audiences; the ad platform runs its own invalid-traffic judgement with a different definition. Read both as layers and it explains why your dashboard can look clean while a platform still flags some traffic as invalid.
Personalize without the ban risk
Same landing-page URL for every visitor — in-page A/B testing, audience-aware content and invalid-traffic filtering. No cloaking, no sneaky redirects.