No easy and reliable programmatic solution exists. In particular in a browser game, your abilitites are limited, but reverse engineering is a thousand times easier than in a "binary" game.

The safest way to prevent botting is to make botting non-rewarding or at least less rewarding, which is much harder than it sounds. For example, you could rate-limit successes in some way, such as that only 3 wins (arbitrary number) per day count for your ranking. Of course this will also punish people who win more often legitimately.
Also, you could make it so more than 10 wins per hour (arbitrary number) trigger a security alarm which causes a moderator to review the logs in respect to your user ID and your wins. If it turns out you've been playing 28 hours straight without losing one game, they'll ban you.

None of these measures are 100% safe and are likely to catch a legitimate player who is just doing exceptionally well every now and then. Bashing someone innocent is probably as bad or even worse for your business as not punishing a cheater, so this is a two-edged sword.

Server-side timestamping may help if the bot writer is stupid. No human will make the optimal move in less than 0.1 seconds every single time. However, bot writers are not necessarily stupid and may insert random delays which will make this kind of check fail. The bots might be written to NOT make the best possible move every now and then, too.

Random events or human interaction may help, but are by no means safe. There exist bots that work all day unattended, but will play a sound (or some other notification) when someone (probably a moderator) is talking to you, so you can reply and thus "prove" that you're not a bot.

One notable example of a game implementing random events to cut down on botting in a rather successful manner was Runescape.

Quote:As I recall, the random events in Runescape were unsuccessful at stopping bots for long.
I remember seeing dozens of obvious bots completing random events without a hitch.

In the end no, intermittently for a while yes. The obvious problem is that bot writers will soon implement workarounds for the easier "click on one spot on request" challenges.

The maze event did much better, even more so as the walls were stippled semi-transparent which would make it harder for simple bots to "see" them (the bots that grabbed a screencopy). Unluckily, this also made them harder to see for humans, and total failure for someone with even slightly limited vision.
However, the problem is that while you are bashing innocent users, the more advanced bots later didn't grab screencopies, but instead emulated the whole client, which was easy enough, as a Java decompiler would give you the more or less readable source code (there were some heavy obfuscation attempts later on, don't know how successful these were). Now, a bot that emulates the whole client obviously knows the topology of the maze and thus doesn't need to guess for long...

Quote:

Quote:In this respect: Turing test.

Lol, that's what i was thinking. If these bot makers can make a bot so good that a human can't tell it apart from a real player then these bots must be intelligent!

Yeah well, the problem is that they never do the turing test. A human does the turing test, which he will obviously pass.
A dozen bots will run on the same machine unattended for hours, and when human interaction is needed (e.g. someone sends a tell), the respective bot prompts for interaction.
So, after the Turing test was passed, all you can tell for sure is that the person has for example been harvesting in the same area for 6 hours, which isn't conclusive evidence for a ban. Many legitimate players do the same thing.