Bot / Automation Signals
See the automation signals your browser reports — and why none of them proves anything.
How this test works
Half a dozen properties are checked that automated browsers commonly report differently from ordinary ones: the WebDriver flag, headless markers in the user agent, an empty plugin or language list, and leftover globals from automation frameworks and ChromeDriver. Each is reported individually with what it actually means. What is deliberately not produced is a verdict, because these signals cannot support one — they are values the browser volunteers about itself, so any framework that cares can change them, and several fire on legitimate configurations that have nothing to do with automation. Detection that works looks at behaviour over time and at network reputation, neither of which is available to a single page load.
What the results mean
- navigator.webdriver
- Set by WebDriver-controlled sessions. The most direct signal and the easiest to override.
- Automation globals
- Leftovers from older frameworks. Their absence means little; modern tooling cleans up.
- CDP artefacts
- ChromeDriver leaves recognisable properties unless deliberately patched.
- Verdict offered
- None. Self-reported properties cannot support one.
Common problems and fixes
- I am a real person and it flagged something
- Likely and expected. An empty plugin list is normal on mobile, and accessibility tools and remote desktops trip several of these.
- I am automating and nothing was flagged
- Also expected. Every one of these is overridable, which is why nobody serious relies on them alone.
- How do sites actually detect bots?
- Behaviour over time, network reputation, and challenge responses. A single page load cannot see any of that.
Frequently asked questions
Can a website tell I am using automation?
Only if the automation does not hide itself. All of these signals are self-reported and can be changed, which is why real detection looks at behaviour and network reputation instead.
Why does it not just say bot or human?
Because the signals cannot support that claim. A page that declares you a bot from these properties is guessing, and it will be wrong in both directions.
Is navigator.webdriver reliable?
As a positive, it is a strong hint — it is set by WebDriver-controlled sessions. As a negative it means nothing, because it is trivially overridden.