Bot Detection Test
Run the checks a bot filter runs against your browser: the automation flag, driver globals, headless markers and whether the fingerprinting APIs have been wrapped. Free, no signup, results stay on this page.
- Runs entirely in your browser
- Results are not uploaded
- No signup
See whether this browser looks automated
The check reads the signals a bot filter reads first: the webdriver flag, driver globals left on window and document, headless markers, the plugin and language surface, and whether the APIs used for fingerprinting have been wrapped.
Runs entirely in this browser. Nothing is uploaded, nothing is stored, no signup.
Now give every account its own device.
A clean browser is still one browser. Sendwin runs each profile in isolation with its own fingerprint, cookies and proxy, so the accounts you work on never look like they came from the same machine.
- Isolated profiles, each with its own fingerprint and cookies
- A proxy per profile, with the timezone bound to the proxy country
- Windows, macOS and Linux — plus cloud sessions when you need them
The free plan includes 10 minutes of cloud browsing a day.
The question a site asks before any other
Before a site scores anything subtle about your machine, it asks a much cheaper question: is a person driving this browser, or is software? The answers are lying in plain sight. An automated browser announces itself in navigator.webdriver, drivers attach bookkeeping properties to window and document, headless builds ship without the plugin entries every desktop Chromium has, and stealth patches leave the built-in functions they replaced no longer reporting themselves as native code. None of this requires a login, a mouse movement or a challenge — it is readable on the first page load.
This test runs those checks against the browser you are reading this in and names what it finds. It is the same group the full fingerprint checker runs, on its own page, because the question it answers is specific: not how identifiable you are, but whether this browser looks driven. If you are automating with Puppeteer, Playwright or Selenium and wondering what your stealth setup actually hides, this is the list to work through.
What the cheap checks actually look at
navigator.webdriver is the one the specification defines for exactly this purpose, and an unconfigured automated browser sets it to true. Beyond that, each driver leaves traces of its own: ChromeDriver's cdc_ properties, Selenium's recorder hooks, Playwright's and Puppeteer's internal handles, all readable as ordinary properties on window or document. A headless build gives itself away structurally — desktop Chromium synthesises a fixed set of built-in PDF entries in navigator.plugins, and an empty list on a desktop Chromium user agent is not a configuration anyone chose. An empty navigator.languages means the browser launched with no profile behind it, and a window reporting zero outer dimensions means there is no real window around the page at all.
Why patching these one at a time is its own signal
The obvious response is to overwrite the values a site reads. That works only as long as nobody checks how they were overwritten. A replaced built-in function no longer prints as native code, and asking is a single call — so a getImageData or getParameter that has been wrapped to return friendlier answers reports the wrapping to anyone who looks. Stack traces are the same story: rewrite them to hide injected frames and they stop matching the layout the engine actually produces. And the classic headless Chromium bug is still worth testing for, where the Notification API and the Permissions API return different states for the same stored permission — two answers to one question, from a browser insisting nothing is unusual.
A server or a VM is not a bot, and this page keeps them apart
One distinction gets flattened almost everywhere else, and it matters if you run browsers on rented hardware. Rendering without a GPU — SwiftShader, llvmpipe, the Microsoft Basic Render Driver — is what you get on a VPS, inside a virtual machine, over remote desktop, or with hardware acceleration switched off. It makes a session stand out from everyday traffic, because most visitors reach real hardware. It is not evidence that anything is driving the browser, and this test does not treat it as such: the GPU is read by the WebGL report, which reports it as an environment signal, and nothing on this page counts it as automation. A tool that tells you a work laptop with hardware acceleration off is a bot has just taught you to ignore it.
What the check runs
- 1
Read the declared flags
The check starts with what the browser volunteers: navigator.webdriver, automation and headless tokens in the user agent string, and the driver bookkeeping properties left on window and document.
- 2
Check the shape of the runtime
Then the structural signals — the plugin and MIME surface, the accepted-language list, the window's outer dimensions, and whether the Chromium runtime object is present on a browser claiming to be Chromium.
- 3
Test the built-ins for tampering
Finally the integrity checks: whether the APIs used for fingerprinting still report themselves as native code, whether stack traces match the engine, and whether the two permission APIs agree with each other.
Other free checks
Passing these checks says nothing about the rest of your fingerprint. These read the other half of what a site collects on the same page load.
Bot detection FAQ
What these checks read, why patching them one at a time backfires, and why running on a server is not the same as being a bot.
It is the set of checks a site runs to decide whether a request came from a person or from software. The cheap end reads what the browser declares about itself — the webdriver flag, automation properties, headless markers — and the expensive end watches timing and behaviour over a session. This page covers the cheap end, because that is the part that is decided before you have done anything at all, and the part you can actually inspect.
Because a well-configured setup can pass every check here, and that is the honest result. These are the signals readable from JavaScript on a single page load. They do not include what a site learns from your IP address and its reputation, from TLS and HTTP/2 handshake fingerprints below the browser, or from how a session behaves over time. Passing here means the obvious tells are gone, not that you are indistinguishable.
No, but the defaults do. Modern headless Chromium is much closer to the real thing than it used to be, and most of what is left is fixable — the webdriver flag, the plugin surface, the language list, the window dimensions. What catches people is patching those with a wrapper that forgets to hide itself, which trades a known signal for a rarer one. If the wrapper reports as native code and the values it returns are coherent with each other, the checks on this page have nothing to catch.
Not by anything on this page. A software rasterizer means the browser could not reach a GPU, which is ordinary on a VPS, in a virtual machine, over remote desktop or with hardware acceleration turned off. It does make a session distinctive, because most everyday visitors render on real hardware, so it is worth knowing about — but it is a statement about the machine, not about who is driving the browser, and we deliberately keep the two apart. The WebGL report covers it as an environment signal.
It is a standard property that reports whether the browser is under automation control, and it exists precisely so sites can ask. Automation frameworks set it, and every bot filter reads it first. Turning it off is the first thing every stealth plugin does — which is why on its own it proves very little in either direction, and why the rest of the checks on this page exist.
Yes, that is the most useful way to use it. Point your automated browser at this page, let the check run and read the rows: each finding names the property or behaviour it found and the software it belongs to, so you can fix them one at a time and re-run. It is a checklist of what is currently visible, not a certificate — the limits in the second question above still apply.
No. Every check runs in your browser, the findings exist only in the page in front of you, and reloading clears them. There is no account and nothing to delete afterwards.
Still have questions? Talk to us →
How to read a clean result
Read a clean result as “the signals readable from JavaScript on this page are clean”, and nothing wider. This page cannot see your IP reputation, the TLS and HTTP/2 fingerprints your connection produces below the browser, or how a session behaves over time — all of which real bot filters weigh, and none of which a page can measure about itself. It is a checklist of what is visible from here, not a verdict from any particular platform.
A real browser beats a patched one.
Sendwin runs each profile in a full browser with its own fingerprint, cookies and proxy — nothing wrapped after the fact, so there is no wrapper to find. Free for 30 days on Windows, macOS and Linux.
30-day free trial · $0 today · cancel anytime — your profiles stay on your machine