Find out what is
blocking you.

It identifies which anti-bot or WAF vendor sits in front of a site by fingerprinting publicly observable artefacts: response headers, Set-Cookie names, challenge-page markup and status codes. It currently recognises 18 vendors, including Cloudflare Bot Management, DataDome, Akamai Bot Manager, HUMAN (PerimeterX), Kasada, Imperva and F5 Shape.

No. Detection runs entirely in your browser, and a browser is not permitted to read another site’s response headers — that is what the CORS policy prevents. So the site lookup answers from a curated database of what has been observed in front of known hosts, and the analyser tab fingerprints a real response that you paste in. Nothing is sent to our servers either way.

Because a pasted response is your traffic, from your exit address, at this moment. That is strictly better evidence than any database row: protection varies by region, by path, by time of day and by how the request was made. Run `curl -sSI https://example.com/` and paste what comes back.

Signature matches are high-confidence: headers like `x-datadome` or cookies like `_abck` are set by one vendor and nobody else. The confidence score is the summed weight of everything that matched, so a single generic signal reads lower than four specific ones. The database lookup is weaker by nature — it records what was last observed, and stacks change without notice.

Residential, in almost every case. All three weigh IP reputation heavily and score datacenter ASNs down before anything else is evaluated. Static ISP addresses remain the right buy against rule-based WAFs such as ModSecurity, AWS WAF or Sucuri, where the filtering is on request shape rather than on who you are. Waiting rooms like Queue-it are the same exception, because holding one identity matters more than looking new.

Every HTTPS client announces a particular set of ciphers, extensions and curves in its TLS handshake. Hashed, that becomes a JA3 or JA4 fingerprint, and curl, Python requests and Go’s http client each have a distinctive one. Because the handshake happens before any HTTP is parsed, a vendor can classify you as a non-browser before it has seen a single header you set. This is why spoofing a User-Agent alone changes nothing.

Most vendors score rather than switch. The verdict combines address reputation, TLS and HTTP fingerprint, request velocity and behavioural signals into a number, and the site chooses a threshold. Cross the line and you are challenged; sit under it and you are not. That is also why a single successful request proves very little about whether a job will run at scale.

Reading response headers and page markup is the same category of work BuiltWith and Wappalyzer have done publicly for years — it is observation of what a server voluntarily sends to every visitor. What you then do with the site is governed by its terms of service, by applicable law, and by whether the data is personal. This tool identifies technology; it does not bypass anything.

If the detector reports TLS fingerprinting or a JS challenge, plan on a real browser engine — the token those systems require cannot be minted without executing their script. If it reports only rule-based filtering or rate limits, an HTTP client with a coherent header set is faster, cheaper and entirely sufficient.

Neither. The detector is free, runs client-side, and requires no account. The database covers 59 commonly-scraped hosts and the signature engine works on any response you paste.