How to avoid getting banned botting OSRS in 2026

The one thing that matters most: session length

If you take nothing else from this article, take this: session length is the single strongest predictor of whether an account gets banned. Community experience consistently shows this across thousands of accounts and years of data, more than mouse patterns, more than script quality, more than anything else.

The evidence strongly suggests that Jagex's behavioral analysis weighs continuous playtime extremely heavily. A real human gets tired, gets distracted, gets hungry. A bot doesn't. When an account maintains perfect engagement for 10+ hours straight, that alone is enough to trigger review.

Every measure in this guide follows from one fact: detection is behavioral, driven by the heuristic data your client transmits. If you want the why behind the what, read how Jagex actually detects bots first; this article is the practical half of that pair.

Conservative session targets based on observable community patterns:

3–5 hours per session is the conservative sweet spot. Most long-surviving accounts stay in this range.
6–8 hours is survivable on high-quality scripts with good humanization, but you're pushing the envelope.
Never exceed 12–16 hours of continuous botting in a 24-hour period, even with breaks built in.
Vary both session length and break duration; never run the same duration twice in a row. If your last session was 4 hours 12 minutes, the next should be 3 hours 40 minutes or 5 hours 5 minutes, not another 4 hours 12 minutes.

For multi-account setups, split day and night rotations. Run 20 accounts during daytime hours, a different 20 overnight. This keeps individual account uptime reasonable while maintaining aggregate throughput.

The temptation is always to maximize uptime. Resist it. A plugin running 4 hours a day for 6 months generates far more total value than one running 18 hours a day for 2 weeks before a ban wipes the account.

Here's the reality check: Jagex reported banning over 67,000 OSRS accounts per week as of 2024, with only 0.36% of appeals overturned. The margin for error is essentially zero. If your account gets flagged, it's gone. Session discipline is the cheapest insurance you have.

Account warm-up: building a baseline before you automate

Brand new accounts botting from level 3 are flagged far more aggressively than established ones. This is well-documented across community experience and logically sound: fresh accounts are cheap to create and are disproportionately used for gold farming operations. Jagex's detection models almost certainly weight account age and history as risk factors.

A proper warm-up procedure costs a few hours of real play and can multiply an account's survival time dramatically.

The warm-up checklist:

Complete Tutorial Island manually. This is non-negotiable. Automated Tutorial Island completions have distinctive timing signatures that have been fingerprinted for years.
Get at least 7 quest points. This unlocks F2P trading restrictions and sends a strong legitimacy signal. Romeo & Juliet, Cook's Assistant, and Sheep Shearer will get you there quickly.
Train several skills to a modest total level. Spend a day or two getting a 200–300 total level across different skills. This creates a behavioral baseline that looks like a real new player exploring the game.
Log in and out at varied times. Real players don't log in at exactly the same time every day. Build some irregularity into your login patterns during warm-up.
Chat with other players. Say "ty" when someone helps you, ask a question in public chat, join a clan. Social interaction is a strong legitimacy signal because bots almost never do it.
Add some friends. Even if they're your own alts. An account with zero friends, zero clan activity, and zero chat history looks exactly like what it is.

Membership status matters more than people realize. Paying accounts face less aggressive detection thresholds based on observable patterns. The likely reasoning: real payment information provides a partial identity signal (credit card, PayPal account), and the economic incentive to ban a paying customer is lower than banning a free account. F2P worlds also have a vastly higher bot population density, so detection models tuned for F2P are necessarily more aggressive. If you're serious about longevity, membership is an investment, not an expense.

The time you spend on warm-up is the cheapest way to extend an account's lifespan. An hour of manual play can buy weeks of automated survival.

Activity rotation and skill selection

Accounts that repeat the exact same activity for extended periods produce a distinctive behavioral fingerprint. Even if the individual sessions look human, the macro pattern (6 hours of Woodcutting every day for two weeks straight) doesn't match how real players engage with the game.

The recommended rotation pattern: combat → skill A → skill B → quest → repeat, with daily variation. Real players have goals, but they also get bored, try new things, and switch activities when they feel like it. Your account should reflect that.

Not all skills carry equal ban risk. Based on years of aggregated community data, here's how they stack up:

Lowest risk:

Bank-standing skills: Cooking at the Hosidius Kitchen, Crafting at a furnace, Fletching at any bank. These activities involve minimal movement, simple repetitive inputs, and very little interaction with other players. The behavioral difference between a human and a bot doing these is genuinely small.
Idle/AFK combat: NMZ with absorption potions, Sand Crabs, Ammonite Crabs, Varlamore Crabs. These are designed to be low-attention activities. Real players routinely do these while watching Netflix. The expected input pattern is already sparse and irregular.

Medium risk:

Woodcutting: Moderate risk due to open-world visibility, but the action pattern is simple enough that good automation handles it well. Avoid popular locations during peak hours.
Mining: Slightly higher risk, especially at Motherlode Mine, which is known to be heavily monitored. The combination of high bot population and confined space makes it a frequent patrol target.
Fishing: Similar profile to Woodcutting. Barbarian Fishing is riskier than more obscure methods because of its popularity with bots.

Highest risk:

Agility: Consistently shows the highest ban rate across community data. The rooftop courses are confined, heavily trafficked, and the movement patterns are highly scripted. If you automate Agility at all, keep sessions to 1–3 hours maximum and avoid the most popular courses (Seers' Village, Ardougne).

The safest approach is to pair low-risk activities with medium-risk ones, never running the highest-risk skills for extended periods. And always mix in some manual play; even 20 minutes of real gameplay between automated sessions adds significant noise to your behavioral profile.

Input humanization

Input humanization is the difference between a script that survives for months and one that gets caught in a week. Jagex's detection models analyze three primary input channels, and each one needs attention.

Mouse movement is the most scrutinized input channel. The evidence strongly suggests that Jagex logs and analyzes mouse trajectories, not just click coordinates. A mouse that teleports between targets or moves in perfectly straight lines at constant speed is trivially identifiable.

Good mouse humanization uses Bezier curves with overshoot and correction: the cursor arcs toward the target, slightly overshoots, then makes a small corrective movement before clicking. Speed varies with distance: fast for long movements, slower and more precise for short ones. Micro-jitter on target acquisition simulates the small hand tremors that occur when a real person is precisely positioning their cursor.

Camera behavior is an underappreciated detection vector. Humans constantly rotate and adjust the camera; it's an unconscious habit that keeps spatial awareness. Bots typically don't move the camera at all because the script doesn't need to. Camera-interaction frequency is very likely a behavioral feature in Jagex's detection models. Periodic camera drift, occasional zoom adjustments, and compass resets all contribute to a more human-looking session.

Click timing should follow a Gaussian (normal) distribution around target intervals, not a uniform random distribution. The difference matters: uniform random produces an even spread of delays that looks artificial, while Gaussian produces a natural clustering around the mean with occasional outliers, matching how humans actually perform repetitive tasks. Occasional double-clicks, misclicks that get corrected, and brief hesitations before complex actions all add to the realism.

Every Pluginscape plugin implements all three layers independently of the task logic. You don't configure humanization; it's baked in.

The personality gap: what bots don't do that humans do

Most detection discussions focus on what bots do wrong. Equally important is what bots don't do that humans do naturally. The absence of normal human behavior is itself a detectable signal.

Things real players do that bots typically skip:

Check the stats tab mid-session. Even experienced players periodically open their skills panel to check XP progress. A player who never once opens the stats interface across a 4-hour session is unusual.
Open the quest log. Even if you're not questing, real players occasionally check quest status or look up requirements.
Type in public chat. Even just "ty" after a trade, "gl" to someone, or "lol" at something happening nearby. Complete chat silence for days is a red flag.
Check Grand Exchange prices. Real players look up item values, check buy/sell offers, compare gear costs.
Interact with random events. Ignoring the yellow-text dialogue from random events like the Genie or the Quiz Master is a known detection signal. Dismissing or completing them takes seconds and removes a flag. The Random Event Dismisser does the dismissing for you.
Add friends, check who's online. Social features exist. Real players use them.
Let the mouse leave the game window entirely. Real players tab out to check Discord, look something up on the wiki, reply to a message. A bot whose mouse coordinates are always inside the OSRS window for the entire session emits a distinctive signature.

This last point is particularly interesting. Simulating the absence of input is itself valuable humanization. Periodically doing nothing (having the character stand idle for 30 seconds to 2 minutes while the mouse is "outside the window") mimics the natural rhythm of a player who's multitasking. It's counterintuitive, but intentional inactivity makes automated activity more believable.

AFK skills and low-interaction methods

Some activities are naturally almost indistinguishable between manual and automated play because the legitimate manual approach already involves minimal, sporadic input. These are the safest starting points for validating your setup.

Nightmare Zone (NMZ) with absorptions is the gold standard of safe automation. The legitimate strategy is to set up absorption potions, click once every few minutes to stay active, and otherwise do something else. The expected input pattern is already so sparse that a bot implementing it looks identical to a real player. Sessions of 4–6 hours are completely normal for NMZ even among legitimate players.

Sand Crabs, Ammonite Crabs, and Varlamore Crabs follow similar logic. The meta for training combat on crabs is to stand in one spot, auto-retaliate, and reset aggro every 10–15 minutes. Input frequency is naturally low, spatial movement is minimal, and the activity is commonly done for long stretches.

Bank-standing skills (High Alchemy, cooking wines, crafting jewelry, fletching darts) involve clicking in the same small area repeatedly. The behavioral difference between a human doing this and a well-implemented bot is genuinely difficult to distinguish. These activities are where good click-timing humanization pays dividends because the spatial component is essentially eliminated.

Blast Furnace pumping for Strength XP is another low-interaction method that's naturally AFK-friendly and sees minimal monitoring compared to the ore-processing side of Blast Furnace.

Use these activities to validate that your session management, break patterns, and humanization are working correctly before moving to higher-risk content. If an account survives two weeks doing NMZ and bank-standing, your foundation is solid.

The 85% rule: why tick-perfect play is a tell

Here's something counterintuitive: being too efficient is itself a detection signal.

Tick-perfect play (executing every action on the exact game tick with zero wasted time) is achievable by the best human players, but only in short bursts and only when fully focused. Nobody maintains 100% tick efficiency for 4 hours straight. The sustained attention and precision required is beyond normal human performance.

Based on observable patterns, intentionally running at 85–90% of theoretical maximum XP per hour produces a rate distribution that matches a very good human player rather than a machine. This means:

Missing the occasional game tick deliberately
Taking slightly longer to react to inventory changes or skill completions
Occasionally cancelling and redoing an action (clicking the wrong item, then correcting)
Brief pauses before complex multi-step actions (like equipment switches)
Gradual efficiency decay over the course of a session, as a tiring human would exhibit

The 85% efficiency principle applies across all automated activities. A Woodcutting bot that cuts exactly as many logs as theoretically possible in an hour looks more suspicious than one that's slightly below the maximum. The small efficiency cost buys significant detection resistance.

Think of it this way: you're not trying to be the best player on the server. You're trying to be an unremarkably good one.

Other practical tips

Gear matters. The OSRS Wiki specifically notes that wearing stereotypical bot gear (Dragon med helm, Granite platebody, Abyssal whip, Anti-dragon shield) is a known identifying signature. Players and moderators use gear choice as a quick heuristic for spotting bots. Use varied, contextually appropriate gear. If a real player at your level would wear a Helm of Neitiznot, wear one.

Spatial patterns are observable. Setting Hunter traps in a perfect straight line, standing on the exact same tile every session, or running the exact same path between the bank and a resource are all detectable patterns. Randomize spatial behavior even when it costs a small amount of efficiency. Stand on slightly different tiles. Vary your pathing. Place traps in slightly different configurations.

World selection affects exposure. Heavily botted worlds attract more moderator attention and more player reports. Medium-population worlds and unusual training locations reduce your visibility. Avoid the default worlds that new accounts spawn on. If your account qualifies for total-level worlds, use them; the bot population is lower and reporting is less common.

Use keyboard and mouse together. F-key inventory and prayer switching while the mouse targets game objects is common in legitimate play and adds significant behavioral complexity. Bots that use only mouse input miss an entire dimension of normal human behavior. If your setup supports it, incorporating keyboard inputs (even just F-key tab switching) makes your input profile considerably more realistic.

Don't bot during or immediately after game updates. Wednesday morning maintenance windows and the hours following a game update are when monitoring is likely elevated. Let things settle for a few hours before resuming automated play.

How ban waves work

Everything above is easier to get right once you know how bans actually arrive. Most of them come in waves, not one at a time, and that changes how you should read your own results.

Bans are batched, not instant

Here's something that catches almost everyone off guard the first time: most OSRS bans don't happen in real time. You can bot for a week without issues, log in on a random Tuesday, and find your account permanently banned, for something you did eight days ago.

This is by design. Jagex collects behavioral data over days or weeks, runs detection passes against that data, and then deploys bans in waves. The flag and the ban are separate events separated by a deliberate delay.

A Jagex moderator confirmed this directly in a player appeal response:

"It's important to mention that whenever a ban is added to an account, you are not necessarily banned for the actions being carried out at that specific time. The actions could have been committed a few weeks prior to the ban wave... Note: these bans are issued at a random time interval after the macroing is detected to protect the macroing detection systems."

The deliberate delay serves two purposes. First, it obscures which specific behavior triggered detection. If bans were instant, botters could trivially A/B test their scripts: change one variable, run for an hour, see if you get banned. The delay breaks that feedback loop. Second, it allows Jagex to batch-process large groups of accounts sharing the same behavioral fingerprint in a single pass.

Real-time detection does exist, but it's reserved for egregious behavior: teleport hacks, speed manipulation, actions that are impossible in normal play. For standard botting, the detection-to-ban pipeline runs on a delay measured in days to weeks.

This changes how you evaluate risk. If you botted aggressively last week and haven't been banned yet, that doesn't mean you're safe. It means the wave hasn't hit yet. And if you get banned today, don't assume it was something you did today; it was almost certainly flagged earlier.

How big the waves are

Beyond the 67,000 weekly bans quoted above, Jagex's 2024 disclosure gives these numbers:

6.9 million accounts banned in 2023 alone
2,800 of the weekly OSRS bans are specifically for boss-related botting
~900 billion GP removed from the OSRS economy per week through bans
Only 38 bans were overturned on appeal in all of 2024

Out of roughly 3.5 million bans issued in 2024, thirty-eight were reversed. When Jagex bans an account, they are overwhelmingly confident it was botting. The appeals process exists, but statistically, it almost never results in an overturn.

For historical context, the most notorious single wave was "Bot Nuking Day" on 25 October 2011, when Jagex rewrote the client's obfuscation layer (breaking most injection and reflection bots) and banned over 1.5 million accounts in a single wave. The total active player count dropped by roughly 60% overnight. That event reshaped the botting landscape permanently and led directly to the development of Botwatch, the ML-based system that replaced brute-force client detection.

A former anti-cheat team member who worked at Jagex for seven years publicly reported applying over 12 million offences during his tenure. That's one person, on one team. The operation is industrial-scale.

The fingerprint clustering problem

Jagex doesn't just analyze individual accounts in isolation. The evidence strongly suggests they cluster accounts exhibiting similar behavioral fingerprints and target those clusters as a unit.

Imagine 500 accounts all running the same public script with default settings. They share the same click timing distribution: the same mean delay, the same variance, the same distribution shape. They follow the same interaction sequence: click tree, wait, click tree, drop inventory, repeat. They take breaks at the same intervals. They walk the same path between the bank and the resource.

Individually, each account might look plausible. But collectively, 500 accounts with statistically identical behavioral signatures form a cluster that stands out clearly against the background noise of normal player behavior. When Jagex identifies that cluster, validates it against confirmed bot accounts, and builds a detection pass targeting that fingerprint, every account matching the pattern gets swept in a single wave.

This explains several patterns the community observes:

Public free scripts with thousands of users have the highest ban rates. The cluster is massive. Thousands of accounts sharing an identical behavioral fingerprint is trivially identifiable, and a large, high-value target that's worth the engineering time to classify.

Private or custom scripts survive significantly longer. A script used by 5 people generates a cluster of 5. That's virtually indistinguishable from noise in a dataset of millions of active accounts.

"Suicide botting" with disposable accounts trains the detection system against that script's fingerprint. Every throwaway account that gets flagged contributes data to the labeled training set. The more accounts using a script that get caught, the better Jagex's classifier gets at identifying that specific fingerprint, making it progressively more dangerous for everyone still using the same script.

The same script can go from safe to banned overnight. Not because the script changed, but because the cluster grew large enough to be worth targeting, or because Jagex's classifier improved enough to detect it.

This has a direct implication for plugin choice: behavioral uniqueness is a structural safety property. Plugins that produce genuinely different behavioral fingerprints per user (different timing distributions, different action sequences, different randomization seeds) prevent the formation of large, detectable clusters. When a wave targets a specific pattern, you want your account to be noise, not signal.

Waves vs individual bans

Not all bans come from waves. Understanding the difference matters for assessing your risk profile.

Waves target a specific behavioral fingerprint. Jagex identifies a pattern (a particular click timing distribution, a specific action sequence, a characteristic session structure), validates it against known bots, runs the classifier across the active account population, and bans every match. Waves tend to be activity-specific: the 2,800 weekly bans for boss-related botting suggest that Jagex runs content-area-specific detectors, not one monolithic classifier.

Individual bans are more often triggered by player reports combined with suspicious activity flags. Jagex has confirmed that player reports accelerate review: a reported account gets moved to the front of the queue for manual or automated assessment. The community-built Bot Detector plugin for RuneLite has reportedly made individual bans happen faster since its widespread adoption.

Gold farming accounts get hit harder than personal-use automation, because more signals stack on top of behavioral analysis. Wealth transfer patterns (one-directional trades to mule accounts, interaction with known RWT networks), progression mismatches (high GP but low quest points, high combat but zero non-combat skills) and IP or device linkage to other banned accounts all add to the behavioral flags.

The practical takeaway: if you're automating personal account progression (varied skills, normal-looking wealth levels, no mule transfers), your risk profile is fundamentally different from someone running a 20-account gold farming operation. Both can get banned, but the detection surfaces are different.

Why account age raises the threshold

The warm-up checklist works because of baseline establishment. An account with months of varied manual play has a behavioral profile on Jagex's servers: typical session lengths, click patterns, activity distribution, XP rates. When that account starts botting, the automated behavior needs to deviate substantially from its established baseline to trigger detection. A brand-new account has no baseline. Everything it does is evaluated from scratch against the general population model, where the priors on "is this a bot?" are much less favorable.

The investment in manual play compounds over the account's lifetime. An hour of real gameplay doesn't just help today; it shifts the baseline permanently, making every future automated session incrementally safer.

Ban timing and hotspots

Community observation (correlational, not causal) suggests that larger waves tend to cluster around Monday through Wednesday during UK office hours, often in the period after Wednesday game updates. Jagex's anti-cheating team works from their Cambridge office on UK business hours. While the ban system itself is automated, the deployment of new detection passes and the processing of flagged accounts may follow office schedules.

A community discussion puts the limit of that well: "There are no set times on when Jagex ban people... Yes it makes sense that there may be more bans during office hours, simply because Jagex employees are in the office actively processing account bans, investigations etc. but this does not mean you are guaranteed to be banned during this or any other time." Ban timing is noisy enough that you can't game it. If your strategy depends on "I only bot on weekends when Jagex isn't in the office," you're relying on a weak, unverifiable signal.

Location is more actionable. The Bot Detector plugin's users cluster in popular botting hotspots: Motherlode Mine, Wintertodt, Blast Furnace, rooftop Agility courses. That is where you're most likely to be scanned by other players and fast-tracked by reports. It doesn't protect you from Jagex's own behavioral analysis, which runs regardless of where you are.

This is the engineering philosophy behind every Pluginscape plugin: randomized breaks, human-like input profiles, camera drift, and session management built in, so you can focus on gains, not anxiety.

Further reading: How Jagex actually detects bots → · The RuneLite Bot Detector plugin explained →