Detection
Every automation system — defined, scored, explained
We don’t ship a mystery “risk number.” Each signal maps to a founder category and a recommendation you can act on. Free tier includes the full suite.
Founder categories
What your console and API detection pack show.
Not a real browser
Automation, headless Chrome, or anti-detect tools.
AI agent
AI browser agents or agent-style extensions.
Hiding their location
Datacenter IP, VPN, or timezone/language mismatches.
Throwaway or risky email
Disposable inbox or identity-graph exposure links.
Repeat offender
Linked to prior abuse or signup flood velocity.
Automation detectors
Why each family exists — so you know what “not a real browser” actually means.
Headless / webdriver
navigator.webdriver, HeadlessChrome UA, missing window.chrome — classic bot runtimes.
Playwright / Puppeteer / CDP
Framework leftovers on window/document, exposeFunction hooks, ChromeDriver CDP keys.
Anti-detect browsers
Prototype lies, UA/platform mismatches, Client Hints conflicts — stealth kits that fail consistency checks.
Behavioral
No interaction, synthetic events, teleport mouse, linear paths, robotic typing — humans don’t move like scripts.
Cloudflare Bot Management
Verified bots, low bot scores, detection IDs, JA3 — server-side when the edge sees the request.
Recommendations in the product
Every check returns an action (allow / challenge / shadow / block / review), a plain-English title, and bullets from visit drift + top signals. Your dashboard and review queue surface them so operators aren’t guessing.