Bot detection for sign-ups and free offers
Updated
Bots create fake accounts, claim free trials and credits in bulk and test stolen cards. Detect them by checking the browser itself on the server: automation flags such as navigator.webdriver, headless and software-rendered browsers, patched browser functions, inconsistencies between headers and the page, datacenter or Tor addresses and impossible timing. Send suspicious requests to a human check instead of letting them through.
What is a bot?
A bot is a program that uses a website or app automatically instead of a person. Some bots are welcome: search engine crawlers such as Googlebot, uptime monitors and link previews in chat apps. Others are not: scripts that create fake accounts, claim free trials and coupons in bulk, try stolen passwords or test stolen cards.
Modern bad bots usually drive a real browser, such as Chrome controlled by Puppeteer or Playwright, so they can run JavaScript and look like a visitor. That is why a bot check looks at the browser and the network together rather than at the User-Agent alone.
Signals that give a bot away
- Automation flags: navigator.webdriver set, or the characteristics of a headless browser.
- Tampering: built-in browser functions that have been patched to hide automation.
- Inconsistency: the User-Agent header names a different browser or operating system than the page reports, or a Web Worker reports different values than the page.
- Rendering: graphics drawn in software (SwiftShader, llvmpipe), typical of servers and virtual machines.
- Network: datacenter, hosting and Tor addresses, or a browser time zone that does not match the IP address.
- Timing: a page that completes its checks faster than a real browser can, or far too slowly.
Why the check belongs on the server
A bot controls everything in its own browser, including any JavaScript that decides whether it is a bot. Collect the signals in the browser, but score them on the server, compare them with the request headers and the IP address, and give your backend a decision it can verify.
Bot detection versus CAPTCHA
A CAPTCHA on every sign-up costs conversions. Score the request first and show a human check only when the score is low or the device is new. Cloudflare Turnstile is mostly invisible to people; a proof-of-work puzzle works where you cannot show a widget at all.
Bot detection with FingerPrint Checker
Every FingerPrint Checker identify returns a trust score from 0 to 100 with the deductions that lowered it, such as webdriver, headless, native_tampered, software_renderer, datacenter_asn or tor_exit. Eligibility decisions use that score with two thresholds you can set per project: below the first (80 by default) the answer is a human check by Turnstile or proof-of-work instead of an allow, and below the second (50 by default) a device that has been seen before is denied. Try it on your own browser with the free browser fingerprint test.
Frequently asked questions
What is a bot?
A bot is software that visits a website or uses an app automatically. Good bots, such as search engine crawlers, identify themselves and follow the rules; bad bots pretend to be people to create fake accounts, abuse free offers or take over accounts.
Can bots fake a browser fingerprint?
They can send any values they like, which is why the fingerprint is matched and scored on the server and checked against request headers and the IP address. Inconsistent or replayed values lower the trust score.
Do I still need a CAPTCHA?
Only for requests that score low or come from a new device. Most real users never see one.
Try FingerPrint Checker free
Every new account gets 2,000 free checks. No card required to start.
Create a free account