botcheckme

What changed in this reading

A reading is only meaningful next to the edition that produced it. Every change to the signals read, to the assumptions they are ranked against, and to the weights that order them lands here with a date on it.

Bot checks retune continuously. A setup that passed in March can start failing in August without a single setting moving on your machine, which is the whole premise of this site — and it applies to this site too. When the assumptions here change, your old reading was produced under the old ones, and this page is how you tell which.

There are two editions so far. This page is not going to pretend otherwise by inventing a history.

What counts as a change worth recording here

Four things, and nothing else. A signal added to or removed from what the reading looks at. An assumption's number moved. A weight's number moved. A fix's wording changed in a way that alters what it tells you to do. Typography, layout and copy edits do not appear, because they cannot change what a reading says about you.

That boundary matters more than it looks. A changelog that logs everything is one nobody reads, and a reading is only comparable to a later one if you can see at a glance whether anything between them touched the arithmetic. These four are exactly the changes that do.

Why an edition date is printed on every page

Because a ranking is meaningless without the table it was ranked against, in the same way an eye chart is meaningless without the distance it was read from. The band at the foot of most pages here carries the edition, the date, and the word assumed — and it is set at reading size rather than tucked into a footer, because a calibration that has to be hunted for is not a calibration.

There is one failure mode this arrangement is designed to catch, and it is worth naming. Assumptions about what counts as a current browser go stale on their own: nobody touches them and they become wrong anyway, firing the browser-build row on a browser that is perfectly up to date. If the date on your reading is old, that row is the first one to distrust.

  1. Edition 1.1.0: the network, the headers and the hand

    2026-10-13

    16 readable causes, 15 written assumptions and 16 published weights. Three causes are new, and the site now records visits and stores readings.

    • New: request headers compared with what the page reads, the connection (HTTP and TLS version) compared with what the browser negotiates on its own, and input rhythm: scripted events and constant-speed pointer movement.
    • The VPN row now compares your clock with the network location's time zone directly, in hours, and the shared-address row reads the network type (data centre, household, mobile, university, government).
    • Rows show real counts beside the rank: how many of the devices these eight sites have read share your value. The counts do not enter the rank.
    • Every visit is recorded and one full reading of each browser is stored, as the privacy page sets out. A reading can be shared as a link.
    • Assumed-current builds moved to Chromium 156, Firefox 157 and Safari 26, firing at more than 4 releases behind.

  2. Edition 1.0.0: first public reading

    2026-08-14

    The site opened with 13 readable causes, 11 written assumptions and 13 published weights. Everything in all three tables was an assumption or a judgment.

    • Rows were ranked as surprisal against a written prior, multiplied by a published challenge weight, with both numbers printed on the row itself.
    • Extension detection was by side effect only, a bait element and a same-origin asset, and never by asking whether an extension identifier resolves.
    • The network half of the reading came from a lookup that was echoed back and not stored, and nothing was read before the button was pressed.
    • Assumed-current builds: Chromium 154, Firefox 155, Safari 26, firing at more than 4 releases behind.

  1. Rubric 1.0.0

    First public rubric. All priors are reasoned assumptions; none are measured. Groups and discount published alongside.

These are not aspirations. Each one is an assumption or a weight in the current edition that the author believes is wrong, recorded at the time it shipped rather than discovered later. They are marked on the rows they affect, and they are what the next edition is for.

  • A content blocker is installed

    assumption · p 0.3400

    This is the assumption most likely to be wrong for this site's actual visitors. Somebody arriving here has already been challenged repeatedly, which correlates with having a blocker — the population reading this page is not the population the prior describes.

  • The exit address is carrier-grade NAT

    assumption · p 0.0900

    Almost certainly wrong outside North America and Western Europe, where CGNAT is far more common than this number.

  • A full read of the browser took longer than 20 seconds

    assumption · p 0.1500

    This one is measurable and should stop being an assumption. The readings these sites now store will make it countable once there are enough of them.

  • The browser build is more than four releases behind

    assumption · p 0.1400

    The four-release threshold is arbitrary. It was picked because it is roughly a quarter of a year on Chromium's cadence, which is a reason but not evidence.

  • Shared or hosting-network exit address

    weight · 0.75

    Probably too flat. A datacentre ASN and a mobile carrier NAT are both 'shared' and are almost certainly not weighted the same by any real vendor.

  • A content blocker rewriting the page

    weight · 0.55

    Probably too high for the mainstream blockers, which most vendors have long since learned to tolerate. It is more defensible for aggressive custom filter lists.

  • Coarsened or unusual timer resolution

    weight · 0.35

    Probably close to zero in practice. Kept on the list because it is cheap to read and because cross-origin isolation changes it for reasons that have nothing to do with the visitor.

  • Input events not made by a device

    weight · 0.70

    Probably too low for scripted events and too high for the constant-speed test, which a steady trackpad swipe can come close to.

  • A connection the browser did not make itself

    weight · 0.50

    Unknown in practice. Edge networks see the connection fingerprint directly and almost certainly weigh it more finely than this one number.

The two tables in full: the assumptions and the weights, with the method that combines them. Corrections to either get an entry here, dated, whether or not they came from us.

What people ask when nothing on their machine changed

Why did the captchas start happening even though I changed nothing?
Because the thing reading you changed. Anti-bot vendors retune thresholds, add signals and re-weight existing ones continuously, and one vendor serves thousands of sites — so an adjustment appears everywhere at once. Two other explanations fit the same story: your provider handed you a different address, or your browser quietly stopped updating some months ago.
Does my old reading still mean anything after an edition changes?
It means what it meant under the edition that produced it, which is why every reading and every page carries the edition date. A reading taken under one set of assumptions and compared against a later ranking is comparing two different rulers. This page is how you tell which ruler you were holding.
Why are there only two editions on this page?
Because there have only been two, and inventing a history to look established would be the same failure as inventing a population to score you against. When the assumptions change, the entry appears here with a date on it and says what moved.
What is queued for the next edition?
Assumptions and weights that the author already believes are wrong, recorded at the moment they shipped rather than discovered later. Each one is listed further down this page with what is suspected and why, and each is also marked on the row it affects, so a reading never quotes a number this site privately doubts without saying so.
How do I get a number on this site corrected?
Show a better one. Both tables live in the source in the same shape they render on the assumptions and method pages, so a correction is a change to one line with a reason attached. It lands here with a date whether or not it came from us — a methodology that only accepts corrections from its author is not published, it is announced.

The rows you cannot fix from a settings page

A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.

Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.

Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.

Download Donut Browser

Free · AGPL-3.0 · github.com/zhom/donutbrowser