Why every session starts at 100

Most scoring systems start neutral and move toward a verdict as evidence arrives. Botardo starts every session at 100, the most suspicious score, and lowers it only as signal layers confirm the session looks human.

Why start at the ceiling

On the open web, automated traffic now rivals or outnumbers real visitors on most public endpoints. Treating an unscored session as neutral, or as human by default, gets the odds backwards, so we assume a bot until we see otherwise. A neutral start also rewards silence. A session that never sends enough signal would end up looking like an average visitor, when real people almost always leave some trace.

Starting at 100 makes that explicit. The only thing that lowers a score is a layer reporting evidence that fits a human. If no evidence arrives, the suspicion stays where it started.

How the score comes down

The three signal layers described in how scoring works each get a portion of that ceiling to release, and only release it when they have something to release it for:

• Environment relieves score when the runtime looks like an ordinary, fully-featured browser with nothing that gives away automation.
• Network relieves score when the connection looks like an ordinary visitor's.
• Behavior relieves score as the way the visitor moves, scrolls and types builds up and looks like a person.

A layer that never reports keeps its share. That happens when the session ends too quickly, a script gets blocked, or there's no interaction to measure. The score stays high because nothing showed the session was human.

What this resolves

Two cases that are easy to get wrong under a neutral-default model fall out naturally here:

JS is enabled, but that proves little on its own. Headless browsers run JavaScript too. Capability checks like JS running or cookies persisting only make the other layers possible. The score comes down once environment and behavior signals each confirm a human pattern.

A session that connects and immediately submits a token gets no discount. The behavior layer has no time to observe anything, so its share of the ceiling stays put and the session lands with a high score. We think that's right: submitting before any interaction is a strong bot pattern in itself.

What it means for your integration

A high risk can mean either "confirmed bot" or "never got the chance to prove otherwise". You don't have to tell them apart: we do it before we answer. Verify says block only when we found clear signs of automation. A session that showed us too little, from a slow connection, a blocked script or an instant submission, is challenged before its token exists, so a real person proves themselves in a few seconds and is never silently blocked.

A missing or empty token is the strongest case of "no layer ever reported": there's no session to score at all, and no way to challenge the visitor either. Verify answers it with the status token.invalid, no risk, and the decision block, because a bot that skips the snippet looks exactly like this. The FAQ covers this case in more detail.

This is also why you shouldn't turn people away on risk alone: the number doesn't carry the difference. See using risk.