What your requests reveal about you

The mistake almost everyone makes

Someone gets blocked, buys proxies, rotates their IP address, and gets blocked again. They conclude the proxies are bad. Usually the proxies were fine. The request was still announcing itself as a script in six other ways, and the address was never the thing being judged.

The worst version of this is a browser user-agent bolted onto an HTTP library. It feels like a disguise and it is the opposite of one. An honest python-requests/2.31.0 is common, boring, and mostly ignored. A request that claims to be Chrome 128 and then fails to send a single client hint is a contradiction, and contradictions are exactly what bot management is built to find.

What gives a scripted request away

Client hints that are not there

Every Chrome since version 89 sends sec-ch-ua, sec-ch-ua-mobile and sec-ch-ua-platform on secure requests. A user-agent claiming a recent Chrome without them cannot be that browser.

Missing Sec-Fetch metadata

Browsers describe why a request is happening: whether it is a navigation, what kind of resource is expected, and whether it came from the same site. Libraries have nothing to say about any of that, so they say nothing.

An Accept header of */*

A browser loading a page asks for HTML, images and their quality values, specifically. */* is what a library sends when nobody set one.

An Accept-Encoding of gzip, deflate

Current browsers offer Brotli, and increasingly zstd. That exact two-item list is the default of Python's requests library, and it is one of the most reliable tells there is. This is the one signal on this list we do not report back to you, because the CDN in front of this site rewrites the header before we see it: a curl request sending no Accept-Encoding at all reaches us as gzip, br. Any verdict we drew from that would be a verdict about the CDN. Check it in your own traffic instead, where the value is genuinely yours.

Language that disagrees with location

Pointing a proxy at Germany and leaving en-US in your headers is a mismatch a consistency check will notice. It is worth saying that this one is weak on its own: plenty of real people browse in a language that does not match where they are.

What this page cannot see, and why it still matters

This analysis reads HTTP. It does not read your TLS handshake, and your TLS handshake is very probably the thing getting you blocked.

Before any header is sent, your client tells the server which TLS versions it supports, which cipher suites it offers and in what order, which extensions it includes, and how those extensions are arranged. That combination is stable per library and per version, and it can be hashed into a short fingerprint. Chrome produces one pattern. Python's ssl module produces a completely different one, and no amount of header editing changes it, because the handshake happens first.

This is why rotating IP addresses can fail to help at all. A network can see, on the very first packet of the very first connection from a brand-new residential address, that the client is not a browser. The address was never the question.

We would rather tell you that than let a clean report here imply a guarantee we did not measure. If you want to know whether the address is the variable for a specific URL, the block replay test answers that directly by trying both kinds.

Common questions