Everything a bot check can hold against you
Sixteen rows. Each one is a thing about your browser, your machine or your network that a challenge treats as unusual — and each one is printed here with the weight it is ranked by, before anybody has read anything of yours.
This is the whole list. There is nothing else the reading can find, and nothing here is hidden behind a result — you can read every row, and every fix, without pressing anything.
The number in the right-hand column is the published challenge weight: this site's judgment of how hard a bot check acts on that signal, on a scale where a browser declaring itself automated is 1. It is a judgment, not a measurement, and the reason for each one is written out in full. The order on your own reading will differ, because there the weight is multiplied by how surprising your particular value is against a written assumption.
How to read a row on this page
Every row carries four things and none of them is a verdict. The name is what the signal is called on your reading. The number on the right is the published weight. The sentence underneath says, in plain words, what the signal means when it fires. And the line below that names who the fix belongs to — a setting on your machine, the network you are on, or the machine itself — followed by what an ordinary, unchallenged browser shows in the same place.
That last comparison is the one worth reading carefully. It is not a target and it is not a claim about how many people match it. It is the answer this site assumes is unremarkable, written out so you can see exactly what your own value is being held against and disagree with it if you think it is wrong.
Which of these can I actually change?
Rows marked a setting on this machine are the ones worth doing first: hardware acceleration, a blocker's allow list, a browser update, cookie permissions, the VPN's exit country. Between them they cover most readings, most take under a minute, and every one of them is reversible.
Rows marked the network you are on — chiefly a shared exit address — have no setting anywhere on your computer. Rows marked the machine itself describe how much processor you were given rather than how you configured it. And rows marked no setting changes it, like the set of fonts installed or a coarsened clock, are properties rather than choices at all. This site marks all three rather than inventing a fix, because a checklist that pretends everything is fixable wastes the evening of the person who most needs the honest answer.
When your top rows are all in those last two categories, the checklist has run out, and the durable answer is a browser that presents one deliberate, consistent reading instead of an accidentally strange one.
-
Automation flag 1.00
This browser is telling every site it is being driven by software.
-
Two things your browser reports about itself cannot both be true.
-
Request headers 0.80
What your browser sends with each request disagrees with what it tells the page.
-
VPN exit country 0.80
Your connection comes out in one country and your clock says another.
-
Shared exit address 0.75
Thousands of other people reach the web through the same address you do.
-
Input rhythm 0.70
Clicks or key presses on the page came from a script, not from your hands.
-
Graphics renderer 0.60
Your browser is drawing with the processor instead of a graphics chip.
-
Content blocker 0.55
A blocker is rewriting the page before the site's check can read it.
-
Execution budget 0.55
Your machine does not finish the check's work before the check gives up.
-
Connection 0.50
Something between your browser and the site is making the connection for it.
-
Privacy hardening 0.50
Your anti-tracking settings make you stand out instead of blending in.
-
Browser build 0.45
Your browser build is old enough that checks treat it as suspicious.
-
Third-party storage 0.45
The challenge cannot store the pass it just gave you, so it asks again.
-
Installed fonts 0.40
The set of fonts on this machine sits outside the ordinary band.
-
Plugin list 0.35
Desktop Chrome with an empty plugin list is a long-standing headless tell.
-
Timer resolution 0.35
Your browser's clock only moves in coarse steps, which is a hardening tell.
Nothing on this page has looked at your browser. Read it and these sixteen become rows with your own values in them, ranked, with the arithmetic shown on each.
What people ask before they run anything
- What makes a website think I’m a bot?
- Not one thing — a handful of small ones that add up below a line the site chose. The list on this page is everything a reading here can find: where your connection comes out, whether your clock agrees with it, what your extensions do to the page before the site's script runs, what your browser draws with, how quickly it finishes work, and how old its build is. Each one has a published weight and most have a fix you can do in a minute.
- Which of these causes matters most?
- On this page they are ordered by published weight, which is this site's judgment of how hard a challenge acts on each signal — a browser declaring itself automated is the 1 the scale is built on. On your own reading the order is different, because there the weight is multiplied by how surprising your particular value is. A heavily-weighted signal with an ordinary value ranks below a lightly-weighted one with a strange value.
- Can I fix all of these myself?
- Nine of the sixteen, on this site's own count. Every row is marked as belonging to a setting on this machine, to the network you are on, to the machine itself, or to nothing you can change at all. The nine marked as settings are genuinely a minute's work each. The rest have no checkbox anywhere, and they say so on the row rather than sending you round a settings screen that was never going to help.
- Why is there no total score at the bottom of this list?
- Because adding these together would imply a scale and a population to place you on, and the one these sites have is small and not the web. The weights order rows against each other; they do not sum to anything meaningful. Every page on this site that shows a number also shows the assumption it came from, and a single total would hide all of them behind one figure.
- Do I need to run the check to use this page?
- No, and nothing here is hidden behind a result. Every cause, every weight and every fix on this list is readable now, and several people will recognise their own answer in a row without pressing anything. The reading exists to tell you which of these sixteen is yours and in what order — it does not unlock content.
READ AT PRIOR TABLE ED. 1.0.0 · 2026-10-13 · ASSUMED, NOT MEASURED
The rank is taken against 15 written assumptions about how common each value is and 16 written weights about how much each one matters. 9 of them we think are probably wrong. Real counts from the browsers these sites have read appear beside a row, never inside its rank. Read the assumptions →
The rows you cannot fix from a settings page
A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.
Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.
Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.
Free · AGPL-3.0 · github.com/zhom/donutbrowser