If you want to detect a Bot that is clicking on a button when he has to, could you look how long the left button stays down before being up again? I mean a script like this one (python):
import win32api, win32con
win32api.SetCursorPos((x,y))
win32api.mouse_event(win32con.MOUSEEVENTF_LEFTDOWN,x,y,0,0)
win32api.mouse_event(win32con.MOUSEEVENTF_LEFTUP,x,y,0,0)
Will click really fast. Probably faster than a human. And always at (really closely) the same speed. Could an anti-bot system detect that?
So you can add a time.sleep(float) instruction between the two mouse_event's. But should it be randomised? We probably have a slight difference of time between two clicks, less precise than a computed click.
So how much time should we make the sleep last (min and max of the randrange)?
It's probably too much effort for being undetected but is that possible?
So quick recap:
Can we detect a bot on the click speed and click time never changing even a bit?
How long does an average person press the button down before letting it go up? If I want to stay undetected should I randomise this time, and with which min and max?
(I'm not talking about other existing security like checking if you press the same pixel over and over.)
Yes, bots can and are detected this way.
Yes, adding a random offset to the click speed, delay, mouse path, movement speed, and many more things is the standard solution to circumvent this kind of detection. There are many other ways to detect bots though.
To get an average click speed, write a short program that logs the timestamps for mouseDown and mouseUp events and click in it.