How do websites detect headless Chrome?

Through navigator.webdriver, missing or stubbed plugin and mimeType lists, an empty languages array, permission states that contradict each other, unusual WebGL renderer strings such as SwiftShader, and automation-specific object properties injected by drivers.

Can Puppeteer stealth plugins beat detection?

They remove the obvious flags, but consistency checks still catch them: a spoofed user agent that disagrees with client hints, a mobile UA on a desktop GPU, or perfectly linear mouse movement are all strong signals.

What behavioural signals identify bots?

Mouse-path curvature and jitter, acceleration changes, key dwell and flight times, scroll rhythm, time-to-first-interaction, and pasting rather than typing an email address.

Is this test useful for anti-bot developers?

Yes. Every signal is shown with its weight and contribution, so you can see exactly which checks fire against your automation stack or your own detection rules.

Bot detection test: is your automation detectable?

Modern anti-bot stacks combine environment flags, cross-signal consistency checks and behavioural biometrics. This guide walks through each layer and shows what the live analyzer reports for your session.

Updated 18 August 2026

Run the free live test

Layer 1 — environment flags

navigator.webdriver set to true by unpatched drivers.
Empty or stubbed plugins and mimeTypes collections.
Missing chrome runtime object, or a runtime that exists on a non-Chrome UA.
Notification permission reported as denied while the prompt state should be default.
Software renderers such as SwiftShader or Mesa llvmpipe in the WebGL string.

Layer 2 — cross-signal consistency

Individual flags are easy to patch, so detection moved to contradictions. A user agent claiming iPhone while client hints report Windows, a mobile platform with a desktop GPU and no touch points, a time zone that disagrees with the IP's country, or a language list that does not match the locale — each mismatch is worth far more than any single flag. The analyzer computes a cross-signal inconsistency score from exactly these pairings.

Layer 3 — behavioural biometrics

Mouse dynamics — path curvature, jitter, acceleration changes and pauses; scripted movement is unnaturally straight and evenly timed.
Keyboard dynamics — dwell time per key and flight time between keys; humans vary, drivers do not.
Interaction timing — instant form completion, no scrolling, no focus changes, pasted fields.
Session shape — time on page versus number of events.

Layer 4 — identity and reputation

Even a perfect browser fails at the account layer: reused device fingerprints, repeated signups from one machine, hosting-range IPs and rapid retries all raise risk. The registration and staged-signup demos on this site show how those signals accumulate into an allow, CAPTCHA, verify or block decision.

Frequently asked questions

How do websites detect headless Chrome?: Through navigator.webdriver, missing or stubbed plugin and mimeType lists, an empty languages array, permission states that contradict each other, unusual WebGL renderer strings such as SwiftShader, and automation-specific object properties injected by drivers.
Can Puppeteer stealth plugins beat detection?: They remove the obvious flags, but consistency checks still catch them: a spoofed user agent that disagrees with client hints, a mobile UA on a desktop GPU, or perfectly linear mouse movement are all strong signals.
What behavioural signals identify bots?: Mouse-path curvature and jitter, acceleration changes, key dwell and flight times, scroll rhythm, time-to-first-interaction, and pasting rather than typing an email address.
Is this test useful for anti-bot developers?: Yes. Every signal is shown with its weight and contribution, so you can see exactly which checks fire against your automation stack or your own detection rules.

Back to the analyzer