New bot signals, missed by V1
Real engine upgrades — not cosmetics.
Visit-frequency throttling
Tracks every IP per campaign over a rolling 30-minute window using in-memory cache. More than 5 visits → blocked. More than 10 visits → auto-blacklisted.
Catches scrapers, ad-network re-validation bots, and automated review tools.Headless browser scoring
Browser fingerprint analyzed across 8 headless indicators — webdriver flag, plugin count, screen geometry, canvas behavior, hardware concurrency, device memory, Chrome runtime. Score > 40 → blocked.
Stops Puppeteer, Playwright, Selenium and most automation frameworks cold.Universal hosting blocking
V1 had hardcoded exceptions for legacy campaigns that allowed hosting traffic through. V2 removes all exceptions: every datacenter / hosting IP is blocked, no special cases.
Closes the AWS / DigitalOcean / Vultr / OVH bot pipeline.Fewer false positives
V1 used loose stripos() truthy checks — match at position 0
returned falsy and let real Google/Facebook bots through. V2 uses explicit
!== false — every match is caught.
Referrer captured per request
V1 dropped referer headers from logs — making post-mortem analysis impossible. V2 stores referrer alongside every request so you can see exactly where blocked traffic came from.
Drill into stats by source — find which ad placements attract bots.IP validation hardening
V2 validates every IP as IPv4 format before processing — closing an attack vector where malformed headers could be injected into downstream lookups.
Your platform, hardened.V1 vs V2 — what gets caught
Same battle-tested core
What didn't change: the campaign filter flags (11 booleans + delay), the 17 supported ad networks (Facebook, Google, TikTok, Bing, Snapchat, Taboola, Outbrain, Pinterest, Yahoo, Twitter, Propeller, PopAds, 50onRed, Instagram, Google Search/Display, "No Rules"), the 9 integration methods (PHP redirect/iframe/insert-html/reverse-proxy/reCAPTCHA, JavaScript, Shopify, WordPress plugin, REST API), and the 4-level Maxmind geo whitelist.
Migration is zero-effort — no campaign re-config, no code change on your safe pages. V2 is a drop-in upgrade that catches more, leaks less, and gives you better data.