Detectors, Explained

Not “how to beat” any of these - how they actually work, read from the tool’s own source rather than guessed at from its output. Understanding what a detector is really checking, row by row or module by module, generalises further than any single workaround does: most of what these tools check is not automation at all, it is whether a browser is telling the truth about what it claims to be.

Named detectors and trust scores

• What BotD actually detects, and what it does not - what BotD’s twenty detectors check, read from source: mostly engine truth, not automation.
• How CreepJS decides you are lying - CreepJS asks whether a browser tells the truth; how it detects a lie, from source.
• What bot.sannysoft.com actually checks, row by row - which rows still mean something in 2026, which are relics, and the canvas check nobody reads.
• What BrowserLeaks actually tests, surface by surface - canvas hash, WebGL, WebRTC, fonts, ClientRects; why a unique panel is not a fail.
• BrowserLeaks canvas and WebGL hash, explained - the signature is a hash of a pixel readback, not your GPU.
• Why a FingerprintJS visitor ID changes - a visitor ID is a hash of 41 components; why it changes or stays.
• reCAPTCHA v3 score: why a fresh browser scores badly - a fresh automated browser scores low even with a clean fingerprint. The reason is history.
• Browser trust scores explained: what the number means - CreepJS trust, FingerprintJS confidence and reCAPTCHA v3 score measure different things; one green is not the rest.

What a fingerprint is and how accurate it is

• What is a browser fingerprint? - the join of dozens of low-entropy attributes that identify a browser with no cookie.
• What data does a website collect about your browser? - the JS-accessible surface a page reads, plus the passive TLS/HTTP2 fingerprint the server sees.
• How accurate is browser fingerprinting? - a uniqueness-versus-stability trade-off; confidence drops when signals contradict each other.
• getClientRects fingerprinting: subpixel geometry as ID - subpixel float geometry hashes into a cross-platform fingerprint and betrays a faked OS.
• speechSynthesis voices as a cross-platform fingerprint - getVoices() leaks the real OS; a Windows agent with a Linux voice list contradicts itself.

How detection decides bot from human

• How do websites detect bots? - the four independent layers sites use, and which two a real-browser build neutralises.
• Do websites know you are using a script? - automation-layer tells like navigator.webdriver, CDP or BiDi artifacts, synthetic events and unnatural timing.
• Can a website detect typing by keystroke timing? - yes: detectors histogram per-key dwell and flight times; uniform gaps are the tell.
• What are mouse-dynamics behavioural biometrics? - scoring the distribution of pointer velocity, curvature and pause across many events, not one field.
• Notification.permission as a bot-detection signal - detectors cross-check permissions.query against Notification.permission; a real browser reports one coherent state.
• Can a website detect Clipboard API access? - a page sees navigator.clipboard, but the async API is a gesture gate, not a value fingerprint.
• Can a website detect a virtual machine? - how a page infers a VM from software GPU renderers, odd core counts and missing audio.

The network layer: IP, proxy and VPN

• Can websites detect a datacenter or proxy IP? - yes, directly at the network layer; no fingerprint hides the IP the connection arrives on.
• Does a VPN stop browser fingerprinting? - a VPN changes the IP, not the fingerprint; canvas, WebGL, fonts and timezone survive the tunnel.

---

Table of contents

• What bot.sannysoft.com actually checks, row by row
• How CreepJS decides you are lying
• What BotD actually detects, and what it does not
• Why a FingerprintJS visitor ID changes
• reCAPTCHA v3 score: why a fresh browser scores badly
• BrowserLeaks canvas and WebGL hash, explained
• What BrowserLeaks actually tests, surface by surface
• Browser trust scores explained: what the number means
• How do websites detect bots?
• What is a browser fingerprint?
• What data does a website collect about your browser?
• Does a VPN stop browser fingerprinting?
• Do websites know you are using a script?
• How accurate is browser fingerprinting?
• Can a website detect a virtual machine?
• Can websites detect a datacenter or proxy IP?
• getClientRects fingerprinting: subpixel geometry as ID
• Notification.permission as a bot-detection signal
• speechSynthesis voices as a cross-platform fingerprint
• Can a website detect typing by keystroke timing?
• Can a website detect Clipboard API access?
• What are mouse-dynamics behavioural biometrics?