The reasons to look twice
Every event carries flags, a risk score and a bot verdict, worked out on the server. They never reach the browser, so a bot can't tune itself against them.
Bots and automation
Scripts, headless browsers and agents, whoever drives them.
- Automation
Leftovers of webdriver, ChromeDriver, Selenium, Playwright, Phantom or Nightmare.
automation - Headless
A headless browser's user agent.
headless - AI agent
An AI agent drives the browser, from its user agent or a Web Bot Auth signature.
ai-agent - Replayed
The same request was sent before, within 7 days.
replayed - Socket proof failed
The browser sent back a challenge the API never wrote to its WebSocket, as a replayed or forged identification does.
socket-proof-failed - TLS mismatch
The connection's TLS handshake isn't one the browser it claims to be makes.
tls-mismatch - Developer tools
DevTools is open on the page.
developer-tools
Network
Where the connection really comes from.
- VPN
The IP is a known VPN exit.
vpn - Private Relay
iCloud Private Relay, which many Safari users have on.
private-relay - Proxy
The IP is on the open proxy lists.
proxy - Residential proxy
A home or office IP whose time zone doesn't fit the browser's.
residential-proxy - Tor
The IP is a Tor exit node.
tor - Datacenter
The IP belongs to a hosting provider, not a home or mobile network, and isn't a known VPN exit.
datacenter - Abusive IP
The IP has a history of abuse.
abusive-ip - Time zone mismatch
The browser's time zone has a different UTC offset than the connection's.
timezone-mismatch
Device integrity
Browsers that lie about themselves, and hardware that isn't what it seems.
- Tampering
Natives replaced by script, or signals that contradict each other.
tampering - Virtual machine
A virtual machine's display adapter or hardware profile.
virtual-machine - Software renderer
WebGL draws on the CPU: headless browsers, VMs and device farms.
software-renderer - Rare device
Hardware hardly any other visitor of the service has.
rare-device
Privacy
Choices many real users make, so they weigh little.
- Incognito
A private window.
incognito - Privacy browser
Brave, DuckDuckGo, Tor Browser or Mullvad Browser.
privacy-browser - Privacy settings
Canvas reads randomised or replaced by a browser or extension.
privacy-settings
One number to start from
The risk score adds up the weights of an event's flags. A project can set its own weights.
- 0–4 Low risk
Most real users land here.
- 5–14 Some risk
Worth a second look in sensitive flows.
- 15+ High risk
Several strong signals at once.
A bot verdict on every event
bad- Automation drives the browser, an AI agent's included.
good- A known crawler from its own network, or an AI agent that announces itself.
not_detected- Neither, which is most of your traffic.
Velocity shows how busy a visitor was in the 5 minutes, hour and day before: many users or countries in a short window point at account farming.
Read the signals reference →{
"requestId": "1792578564800.yU4Ety",
"visitorId": "q1yLOPpzvOstEQCFQQxE",
"riskScore": 3,
"bot": "not_detected",
"detected": ["vpn", "timezone-mismatch"],
"confidence": 0.98,
"externalId": "user-2077",
"velocity": { "24h": { "events": 3, "distinctExternalId": 1, "distinctCountry": 1 } }
}See your own signals
Every signal is in every plan, from the first identification.