What is WebSocket?

WebSocket is a protocol that upgrades an HTTP connection into a long-lived, two-way channel over TCP. After the upgrade, client and server can push messages at any time with small frames instead of repeating full HTTP requests. It is defined in RFC 6455 and is common for chat, live dashboards, collaboration tools, and some financial or gaming web clients.

How the upgrade and framing work

The client sends an HTTP request with Upgrade: websocket and Connection: Upgrade, plus a random key. The server answers 101 Switching Protocols with a computed Sec-WebSocket-Accept value. Once upgraded, both sides exchange WebSocket frames (text, binary, ping, pong, close). Ping and pong frames help keep connections alive through proxies and firewalls that drop idle TCP sessions.

WebSocket is not the same as a raw TCP socket in the browser: it is constrained by browser security policies and uses HTTP-compatible handshakes so it traverses most corporate proxies more easily than arbitrary TCP would.

WebSocket compared to polling and SSE

HTTP polling repeats full requests to check for updates. Long polling holds a request open until the server has data. Server-Sent Events give a one-way push from server to client over HTTP. WebSocket provides symmetric push in both directions on one connection, which reduces header overhead and suits interactive sessions.

Relevance to click fraud and ad tech

Ad tags, verification scripts, and publisher tools sometimes use WebSocket for real-time updates (inventory, bidding UI, internal ops consoles). Attackers and bots can also drive WebSocket traffic where sites expose APIs without the same bot defenses used on landing pages. Automated clients may show non-browser handshake or message patterns, which can feed suspicious behavior models together with IP and device signals.

WebSocket abuse is a subset of broader ad fraud and invalid traffic problems; defenses still map to monitoring, rate limits, authentication, and dedicated fraud detection. For paid search specifically, wasted spend ties back to click fraud and suspicious clicks even when the transport is not WebSocket.