The words these systems use, in plain English
Nothing on this site needs you to already know a vocabulary. Where a word could not be avoided, it is here, in one sentence, next to the page where the thing it names is actually measured.
Two vocabularies collide on the screen that just stopped you. The first belongs to the people who build anti-bot systems and is written for other engineers. The second belongs to support replies and error pages, and is written to be vague on purpose. Neither is written for the person who simply wanted to buy a ticket, which is why words that sound like accusations — automated, suspicious traffic, unusual activity — arrive with no way to check what they mean.
Everything below is defined the way it is actually used by these systems, not the way it is used in marketing. Where a definition would need jargon to stay short, it gets longer instead. Where it points at something this site measures, the link goes to the page where the measuring is explained rather than to another definition.
If you are here because one specific word appeared in front of you, use your browser's find-on-page. If you are here to understand the whole apparatus, the method page puts these terms to work on a single row, end to end, with the arithmetic shown.
- Bot check
-
Any system that scores how ordinary your request looks before deciding whether to let it through. It does not decide whether you are a person — it decides whether your request resembles the run of requests it usually sees, which is a different question and the reason you can fail it.
- Challenge
-
What a bot check shows you when the score came out low: a captcha, an interstitial, a slow page that reloads, or a plain refusal. The wording is deliberately vague, because telling you what failed would also tell an automated client what to change.
- Interstitial
-
The “checking your browser” page between you and the site. It hands your browser a computation, waits a few seconds for the answer, and either lets you through or starts again.
- Exit address
-
The internet address your traffic appears to come from, which is your VPN's or your employer's if you use one and your household's if you do not. It is the one thing about a request a server can be certain of, so it is weighted heavily.
- CGNAT
-
Carrier-grade network address translation: your provider ran out of public addresses and put you behind one shared with hundreds or thousands of other subscribers. Normal on mobile networks, and increasingly normal on fixed lines.
- ASN
-
A number identifying who operates the network your traffic came out of, published openly. It is how a site tells a household broadband connection from a data centre without knowing anything else about you.
- Hosting network
-
A network where servers live rather than people. Almost all automated traffic comes from one, which is why a commercial VPN exit — which is a server — is scored more harshly than a home connection.
- Time zone mismatch
-
Your traffic comes out in one country while your computer's clock is set to another. Neither half is unusual; doing both at once, in the same request, is what a VPN produces and what a check notices.
- Content blocker
-
An extension that cancels requests and hides elements before the page's own script runs. A blocked page and a scraped page look alike from inside a challenge script, which is the whole problem.
- Side-effect detection
-
Working out that something is installed by watching what happened to the page, rather than by asking your browser what you have. This site only ever does the first, and never requests an extension's own resources.
- Hardware acceleration
-
Your browser drawing with the graphics chip instead of the processor. When it is off or unavailable, the browser reports a software renderer, which is also what a browser inside a server reports.
- Renderer string
-
The name of the graphics adapter your browser reports when a page asks for it. On an ordinary machine it names real hardware; “SwiftShader”, “llvmpipe” or “basic renderer” mean there was none to use.
- Hardening
-
Privacy settings that make everyone report the same values — a UTC clock, a rounded screen, two processor cores. Against a tracker that helps; against a bot check it inverts, because the combination is one almost nobody arrives at by accident.
- Third-party storage
-
Whether a challenge is allowed to save the pass it just gave you against an origin other than the site's own. When it is refused there is no pass to read back, and the captcha is served again.
- Execution budget
-
The few seconds a challenge allows your browser to finish its computation and answer. A machine that misses the deadline is indistinguishable, from the challenge's side, from one that refused to run it.
- Timer resolution
-
How finely your browser's own clock can measure elapsed time. Some browsers deliberately coarsen it as a privacy feature, and a challenge that times itself can tell.
- Headless
-
A browser running without a visible window, which is how automated tests and scrapers usually run one. Several of the things this site reads — an empty plugin list, a declared automation flag — are the residue such a browser leaves.
- Automation flag
-
A value your browser sets to announce that software is driving it. It is the one row on this site where the reading is not a misreading: a browser setting it is telling the truth about itself.
- Contradiction
-
Two things your browser says about itself that cannot both be true — a Windows graphics chip on a browser claiming macOS, say. Vendors act on these hard, because a contradiction shows intent in a way that being unusual never does.
- Prior
-
A written assumption about how common a value is, stated as a probability, with the reasoning attached. Every number on this site is measured against one of these and against nothing else.
- Surprisal, and bits
-
How unexpected a value is under an assumption, expressed as −log₂ of its assumed probability. A value assumed to occur in one browser in a hundred is about 6.6 bits of surprisal; one in four is 2.
- Challenge weight
-
This site's judgment of how much a bot check actually acts on a signal, on a scale where a declared automation flag is 1. It is a judgment, published with its reasoning, and several are marked as probably wrong.
- Rank
-
Surprisal multiplied by challenge weight, which is the only arithmetic this site performs. It orders the rows on your reading and does nothing else — it is not a score and it does not add up to one.
- Population
-
The real browsers a value is counted against. Here it is every device these eight sites have read in the last year: real, still small, and made of people who visit pages like these, so it is shown as a count beside a row and never turned into a percentile.
A word missing from this list is a defect in it. The site's whole argument is that you should not need to learn a trade's vocabulary to find out why a checkout keeps throwing you out.
The questions the vocabulary is usually hiding
- What does “bot detection” actually mean when a site says it?
- It means the site is scoring how ordinary your request looks and gating on the result — not deciding whether a human is present. Nothing in the process establishes that you are a person; it establishes whether your request resembles the run of requests the system usually sees. That is why an ordinary person can fail it repeatedly without doing anything wrong.
- What is a browser fingerprint, in plain English?
- The collection of small facts your browser volunteers to every page it loads: the clock, the languages, the window size, the graphics adapter, which fonts resolve. None of them identifies you on its own. Taken together they describe a setup, and how ordinary that setup looks is what a bot check is scoring. This site avoids the word on most pages because you should not need it.
- What is the difference between a captcha and a challenge?
- A captcha is one shape a challenge can take. A challenge is whatever the site puts between you and the page after the score came out low — a captcha, an interstitial that runs code in your browser, a slow page that reloads, or a plain refusal. Knowing which shape you have matters, because they fail for different reasons and need opposite fixes.
- What does “surprisal” mean on this site?
- How unexpected a value is under a written assumption, expressed in bits. A value assumed to occur in about one browser in a hundred carries roughly 6.6 bits; one in four carries 2. It is arithmetic on an assumption, never a count of real people, and the assumption it was calculated from is printed on the same row.
- Do I need to understand any of these words to fix my problem?
- No, and the site is arranged so you do not have to. Start from the screen you are looking at, follow it to its causes, and do what the fix says. This page exists for the moments when a word appears anyway — in an error message, in a support reply, in something a colleague said — and you would rather look it up than nod along.
The rows you cannot fix from a settings page
A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.
Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.
Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.
Free · AGPL-3.0 · github.com/zhom/donutbrowser