What your requests reveal about you
Changing your IP address changes one field. A request carries a dozen more, and a site can check whether they agree with each other. This reads the request your client just made and shows which parts of it disagree.
Reading your request
Why changing your IP may not help
If you are blocked, change address and are blocked again, the address may not have been the deciding signal. A request also carries a user-agent, an Accept header, client hints, fetch metadata and a language, and a site can compare them with each other. When they disagree, the request stands out whichever address it came from.
The clearest example is a browser user-agent added to an HTTP library. A plain python-requests/2.31.0 is a common user-agent and many sites accept it. A request that claims to be Chrome 128 and then sends no client hints contradicts itself, and contradictions are what bot management looks for.
The signals this page checks
- Client hints that are not there
- Every Chrome since version 89 sends
sec-ch-ua,sec-ch-ua-mobileandsec-ch-ua-platformon secure requests. A user-agent claiming a recent Chrome without them was not sent by that browser. - Missing Sec-Fetch metadata
- Browsers describe why a request is happening: whether it is a navigation, what kind of resource is expected, and whether it came from the same site. Libraries do not send any of that unless you add it.
- An Accept header of
*/* - A browser loading a page asks for HTML, images and their quality values, specifically.
*/*is what a library sends when nobody set one. - An Accept-Encoding of
gzip, deflate - Current browsers offer Brotli, and increasingly zstd. That exact two-item list is the default of Python's requests library, and it is a common signal. This is the one signal on this list we do not report back to you, because the CDN in front of this site rewrites the header before we see it: a curl request sending no Accept-Encoding at all reaches us as
gzip, br. Any verdict we drew from that would be a verdict about the CDN. Check it in your own traffic instead, where the value is yours. - Language that disagrees with location
- Pointing a proxy at Germany and leaving
en-USin your headers is a mismatch a consistency check will notice. On its own it is a weak signal: plenty of real people browse in a language that does not match where they are.
What this page cannot see
This analysis reads HTTP. It does not read your TLS handshake, and the TLS handshake is a common reason a request is refused.
Before any header is sent, your client tells the server which TLS versions it supports, which cipher suites it offers and in what order, which extensions it includes, and how those extensions are arranged. That combination is stable per library and per version, and it can be hashed into a short fingerprint. Chrome produces one pattern. Python's ssl module produces a different one, and no amount of header editing changes it, because the handshake happens first.
This is one reason rotating IP addresses can fail to help: a site can identify the client from the first connection of a new address, before any header arrives. A clean report here means your headers agree with each other. It does not tell you what your TLS handshake says.
To find out whether the address is the variable for a specific URL, the block replay test requests it from a datacenter address and residential addresses at the same time.
Common questions
Should I copy a real browser's headers into my scraper?
Copying headers without matching the rest of the client is what produces the contradictions described above, and a contradiction is a stronger signal than a library's own user-agent. If you need to look like a browser, use a browser. If you do not, keep your library's user-agent and keep your request rate modest.
Why do you exclude the CDN headers?
Because you did not send them. Including them would attribute to you headers a network added on the way in.
Do you store any of this?
No. The endpoint reads the request it is already handling, answers, and keeps nothing. It accepts no parameters, so there is nothing to look up but you.
More free tools
Request one URL from a datacenter IP and residential IPs at once, and see which of them gets blocked.
Five questions and a straight answer, including when the answer is that you do not need proxies at all.
Your public IP address, the country it resolves to, reverse DNS and the headers your browser sends.
Derive how many proxies a job needs from volume, deadline, per-IP rate limit, concurrency and retries.
Check a path against a pasted robots.txt and see the exact rule that allowed or disallowed it.
Paste a curl command and read it back as Python, Node.js, Go or PHP, with the flags translated properly.
Turn a proxy host, port and credentials into working curl, Python, Node.js and Scrapy snippets.
Network address, broadcast, usable range and host counts for any CIDR prefix length.
Decode any user-agent string into browser, engine, OS and device, including bots and HTTP libraries.
Need proxies behind your code?
Node4 sells datacenter, rotating and residential proxies over HTTP(S), with SOCKS5 on paid plans. Datacenter and rotating exits are in the US, Italy and Spain; residential exits cover 170+ countries. Start with free proxies, no card required.