Why every session starts at 100
Botardo assumes every session is a bot until it earns its way down. Here's the reasoning, and what it means for your integration.
Most scoring systems start neutral and move toward a verdict as evidence arrives. Botardo doesn't. Every session opens at a score of 100 — maximum suspicion — and only moves down as signal layers confirm the session looks human.
Why start at the ceiling
On the open web, automated traffic now outnumbers or rivals genuine human traffic on most public endpoints. Treating an unscored session as neutral, or worse, as human by default, gets the prior backwards: the safer assumption going in is "bot," not "human." A neutral starting point also quietly rewards silence — a session that never generates enough signal ends up looking no worse than an average visitor, when in practice a total lack of signal is itself unusual for a real person.
Starting at 100 makes that explicit. Nothing lowers a session's score except a layer actively reporting evidence consistent with a human. Absence of evidence isn't neutral — it's simply undischarged suspicion.
How the score comes down
The three signal layers described in how scoring works each get a portion of that ceiling to release, and only release it when they have something to release it for:
- Environment fingerprint relieves score when the runtime looks like an ordinary, fully-featured browser — consistent canvas/WebGL rendering, plausible font enumeration, no headless tells.
- Network signals relieve score when the request comes from a clean, non-hosting, non-exit-node address.
- Behavioral baseline relieves score as mouse movement, keystroke cadence, scroll, and focus timing accumulate and match natural human variance.
A layer that never reports — because the session ended too quickly, because a script was blocked, because there was no interaction to measure — simply never releases its share. The score stays elevated, not because anything incriminating was found, but because nothing exonerating was.
What this resolves
Two cases that are easy to get wrong under a neutral-default model fall out naturally here:
JS is enabled, but that's not proof of anything. Headless browsers execute JavaScript too. Capability checks (JS ran, cookies persisted) aren't human evidence on their own — they're a prerequisite for the layers that actually produce evidence. The score only comes down once environment and behavioral signals independently confirm a human pattern, not the moment a script successfully executes.
A session that connects and immediately submits a token gets no discount. There's no time for the behavioral layer to observe anything, so its portion of the ceiling stays intact. The session lands with a high score — correctly, since "no observable interaction before submission" is itself a strong bot pattern, not a data gap to shrug off.
Reading the result
Because a high score can mean either "confirmed bot" or "never got the chance to prove otherwise," always read it alongside confidence:
| Score | Confidence | What it means |
|---|---|---|
| High | High | Layers actively found bot-consistent signal. Safe to block. |
| High | Low | Little or no signal ever arrived — outage, blocked script, instant submission. Route to a challenge rather than a silent block. |
| Low | High | Multiple layers independently confirmed human behavior. Safe to allow. |
| Low | Low | Rare — treat like a low-confidence high score and prefer a challenge. |
A missing or empty verification token follows the same rule: it's the strongest case of "no layer ever reported," so it resolves to a near-maximal score with low confidence — see the FAQ for the exact returned shape.