Bot detection test
The automation half of the liarjs scan on its own: does anything on this page say a program, not a person, is driving your browser? Every rule is listed below with what it found.
- navigator.webdriverChecking…
The flag WebDriver-driven browsers set to true. Selenium and stock Playwright and Puppeteer leave it on.
id: webdriver - navigator.webdriver removedChecking…
Chrome 89 and later always define the flag, as false. A browser claiming Chrome with no flag at all had it deleted by a stealth patch.
id: webdriver-missing - DevTools protocol attachedChecking…
Playwright and Puppeteer switch on the DevTools Runtime domain on every page they drive, and it changes how errors are inspected in ways the page can measure. An open DevTools window does the same.
id: cdp-runtime - Automation framework residueChecking…
Globals and properties Selenium, chromedriver and Puppeteer leave on the page.
id: auto-residue - window.chromeChecking…
A browser that claims to be Chrome but has no window.chrome object.
id: chrome-object - navigator.languagesChecking…
An empty language list, common in headless and scripted browsers.
id: langs-empty - Headless token in the User-AgentChecking…
The literal HeadlessChrome token that headless Chrome puts in its User-Agent unless someone overrides it.
id: headless-ua - Software rendererChecking…
A desktop Chrome that draws WebGL through a software rasteriser, which is what headless and GPU-less containers report.
id: headless-gpu - Media device enumerationChecking…
No microphone, camera or speaker at all. A desktop a person uses has at least an audio output.
id: headless-devices - Browser UI heightChecking…
A window with no browser UI. Fullscreen and kiosk mode do this too, so it is only a warning.
id: headless-viewport - Cloudflare verified botChecking…
The edge already classifies this connection as a known, verified bot such as a search crawler.
id: cf-bot
What this test can and cannot see
These are passive checks: they read what the browser exposes without asking you to do anything. A stock Playwright, Puppeteer or Selenium session trips several of them. A stealth setup that patches the flags and never switches on the DevTools Runtime domain may trip none, and a clean result here does not prove a person is present.
That gap is why the main scan also has a human challenge: a few seconds of pointer movement, judged on how the input was produced rather than on what the browser claims. It runs only on the main scan page, and only there can a score become final.
Real anti-bot vendors add more on top: network reputation, TLS fingerprints, behaviour over a whole session. For how they stack up, read detection strength is the vendor stack. For why automation tells sit on their own axis, read automation tells are orthogonal, and for eleven stealth setups measured with these rules, the stealth stack scores.
- Full browser fingerprint testall three axes and the human challenge
- WebRTC leak testpublic IP via STUN vs your connection IP
- Headless browser detection testwhat still separates headless Chrome