Why does my antivirus make websites think I’m a bot?

Because when it scans encrypted traffic it opens the connection to the site itself. The site’s edge sees a connection that no browser would make, carrying a browser’s name, and treats the mismatch as automation. Turning off HTTPS scanning, or excluding the site, puts your browser back in charge of its own connection.

What is TLS fingerprinting?

Recognising the program that opened an encrypted connection from the details of its first message: the TLS version, the list of ciphers and extensions, and their order. Browsers each have a stable pattern. Scripts, proxies and scanners have different ones, which is why this check sits so early in a challenge.

Can a VPN cause this?

An ordinary VPN does not. It carries your browser’s connection inside a tunnel without remaking it, so the site still sees your browser’s own opening message. A VPN changes where the connection comes from, which is a different row.

Something is making the connection for your browser

Before any page code runs, the site’s edge network sees how your browser opened the connection: which protocol, which TLS version, which ciphers in which order. Each browser does this its own way. When the connection does not look like the browser that claims to have made it, the check knows something else made it.

Every current browser, Chrome, Edge, Firefox and Safari alike, connects to a large edge network the same modern way: HTTP/2 or HTTP/3, over TLS 1.3. The details of the opening message (the ClientHello) differ by browser and version, and edge networks keep track of which details belong to which browser.

So when a request says “I am Chrome 156” but arrives over HTTP/1.1, or over TLS 1.2, or with an opening message no Chrome sends, the request is not lying about the page. It is telling the truth about something else: the connection was opened by a program that is not that browser.

The ordinary programs that do this

Antivirus HTTPS scanning. Many security suites decrypt your traffic to scan it and open a new connection to the site themselves. The site then sees the antivirus’s connection, not your browser’s. The setting is usually called HTTPS scanning, web shield, SSL inspection or encrypted connection scanning.
Company gateways. Work networks often inspect traffic the same way, on purpose, for every device on the network.
Proxy settings and proxy extensions. A local proxy, a debugging tool left running, or an extension that routes traffic through a helper.
Parental-control and ad-filtering apps that sit at the system level rather than inside the browser.

How to tell which one it is

Open your antivirus and look for the HTTPS or SSL scanning setting. Turn it off, restart the browser and take a reading.
Look for a system proxy. Windows: Settings → Network & internet → Proxy. macOS: System Settings → Network → your connection → Details → Proxies.
Try a different network, for example a phone hotspot. If the row clears there, the connection is being made by the network you were on, not by your machine.

Is it safe to turn HTTPS scanning off?

Your browser already checks every certificate itself and already blocks known malicious sites in most configurations. HTTPS scanning adds a second inspection and, as a side effect, replaces your browser’s connection with the scanner’s. Turning it off for a test is low risk; whether you leave it off is your call. If you keep it, add the sites that keep challenging you to its exclusion list. Most scanners have one.

Connection

Something between your browser and the site is making the connection for it.

In your antivirus, find the setting called HTTPS scanning, web shield or SSL inspection and turn it off for a test.
Check for a system or browser proxy: Windows Settings → Network → Proxy, macOS System Settings → Network → Details → Proxies. Turn off any you did not set up on purpose.
On a work network a company gateway does this on purpose. That is not yours to change; ask whoever runs it to exclude the site you need.

When a company gateway makes the connection, no browser setting changes what the site sees.

What an ordinary browser shows: HTTP/2 or HTTP/3 over TLS 1.3, as every current browser negotiates on its own
Whose fix this is: Belongs to the network you are on, not to your browser
The word this prints on your plate: PROXY

This is the general case. Read your own browser and the row will say whether it applies to you, in your machine's own values.

A row's place on your reading is one multiplication, and both halves of it are published. Neither half is a measurement.

Surprisal −log₂ of an assumed probability of 0.0300 for “a current browser arrives over http/1.1 or below tls 1.3”: 5.06 bits
Challenge weight A connection the browser did not make itself — how much a bot check is judged to act on it: 0.50
Rank The product. It orders the rows and nothing else.: 2.53

Why that assumption

Antivirus HTTPS scanning and company gateways are the common ordinary causes. Assumed from how widely those are deployed, not counted.

Why that weight

A current browser negotiates HTTP/2 or HTTP/3 over TLS 1.3 with any large edge network. An older protocol under a current browser's name means a proxy, a scanner or a script made the connection, and the edge sees that before any page code runs.

We think this one is probably wrong
Unknown in practice. Edge networks see the connection fingerprint directly and almost certainly weigh it more finely than this one number.

Every assumption, with its number → · Every weight, and what is deliberately not measured →

Questions about the “Connection” row

Why does my antivirus make websites think I’m a bot?: Because when it scans encrypted traffic it opens the connection to the site itself. The site’s edge sees a connection that no browser would make, carrying a browser’s name, and treats the mismatch as automation. Turning off HTTPS scanning, or excluding the site, puts your browser back in charge of its own connection.
What is TLS fingerprinting?: Recognising the program that opened an encrypted connection from the details of its first message: the TLS version, the list of ciphers and extensions, and their order. Browsers each have a stable pattern. Scripts, proxies and scanners have different ones, which is why this check sits so early in a challenge.
Can a VPN cause this?: An ordinary VPN does not. It carries your browser’s connection inside a tunnel without remaking it, so the site still sees your browser’s own opening message. A VPN changes where the connection comes from, which is a different row.

READ AT PRIOR TABLE ED. 1.0.0 · 2026-10-13 · ASSUMED, NOT MEASURED

The rank is taken against 15 written assumptions about how common each value is and 16 written weights about how much each one matters. 9 of them we think are probably wrong. Real counts from the browsers these sites have read appear beside a row, never inside its rank. Read the assumptions →

The rows you cannot fix from a settings page

A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.

Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.

Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.

Download Donut Browser

Free · AGPL-3.0 · github.com/zhom/donutbrowser