Bot protection checker

Our server fetches the address once, follows up to five redirects and reads the first response: the cookies it sets, its headers and the scripts in the page. Each vendor leaves its own marks there, such as Akamai's _abck cookie, Imperva's visid_incap cookie or Kasada's SDK path. Every mark this page uses was confirmed on real sites where a full browser had seen the same vendor.

Our request is what a plain script sends: no browser, no JavaScript and a user agent that says it is a checker. Most of these vendors are built to stop exactly that, so a 403 or a challenge here is normal. An agent driving a real browser is judged on much more than one request, from its TLS fingerprint to how it moves the pointer.

Cloudflare, DataDome, Akamai Bot Manager, Kasada, HUMAN (formerly PerimeterX), Imperva and AWS WAF. Several can sit in front of one site; hermes.com, for example, runs on Cloudflare and was turned away by DataDome when we checked.

Yes. Some sites load their vendor's script only after the page runs JavaScript: Kasada on twitch.tv and DataDome on pokemoncenter.com were invisible in the first response although a browser saw them. F5's bot defense is not on the list at all, because no mark of it held up on a real site. A login or checkout page often shows more than the home page, so try that address too.

No. Cloudflare serves a large part of the web, and many sites use it only as a network in front. Its bot scoring shows up as the __cf_bm cookie or its challenge script, and its challenge answers with a cf-mitigated header. The page lists which of those it saw.

Knowing the vendor tells you what will look at your agent, not whether it passes. Run the full check in the browser your agent uses to see how detectable it is, and the AI agent check to see how its clicks and typing look.