Which bot vendor is in front
DataDome, HUMAN, Kasada, Cloudflare or Akamai Bot Management and more: identified from response signatures, cookies and challenge behavior.
Bot DetectionFREE
Bot Detection.
Bot Detection.
Which anti-bot guards that site?
Identify the bot-management vendor protecting any site — DataDome, HUMAN, Kasada, Cloudflare Bot Management, Imperva and more — detected from response headers, cookies and challenge behaviour. Passive and non-intrusive.
AT A GLANCE
Livein free nowFreeno signup requiredPassivefingerprinting onlyBOT MGMTedges & CDN WAFs coveredShareableevidence-backed reportsLiveand free to run
Part of the CDN World toolkit · FREE TO RUN
Visitorexample.com
Human 97%Good bot 2%Bad bot 1%
Signals checked- Response signature analysis
- Cookie & header fingerprints
- Challenge-response reading
- Honest-limits reporting
Bot management is one layer of defense. A free assessment reviews your whole security and delivery posture.
The report
What you’ll get.
THE OUTPUTInside the report
Detected security edgeIncluded
The product or service in front, with confidence scoring.
Observed behaviorsIncluded
Challenges, cookies and header rewrites seen during detection.
Performance notesIncluded
What the detected stack typically means for latency and caching.
Shareable reportIncluded
Evidence included, ready for a security review thread.
Freeto use, forever
No signuprequired to run it
Shareableevidence-backed reports
Live nowand free to run
What it answers
Bot Detection in four questions.
Its posture toward normal traffic
How the edge treats ordinary requests: challenges, cookies, header rewrites, and what that costs in latency.
The evidence
Every fingerprint that fired, so a security team can verify the identification independently.
The performance implication
Security layers are delivery layers; the report notes what the detected stack typically adds to response times.
Under the hood
How it works.
A transparent look at exactly what the tool checks, and how it reaches its answer.
DETECTIONHow it works
- 01Core
Response signature analysis
· headers & error pagesWAF products leave consistent fingerprints in headers, cookies and block-page markup; we match them against a maintained library.
- 02Core
Cookie & header fingerprints
· vendor markersBot-management vendors drop tell-tale cookies and headers — datadome, _px3, _abck, __cf_bm, x-kpsdk — matched against a maintained signature set.
- 03Principle
Challenge-response reading
· passive onlyA plain, harmless request reveals block or challenge pages (including Kasada’s bare 429) that identify active bot protection. No attack or exploit traffic is ever sent.
- 04Supporting
Honest-limits reporting
· what passive can’t seeDetection reads response headers and cookies only; protection that runs solely in JavaScript or on login/checkout paths is reported as such rather than missed silently.
Use cases
Who it’s for.
Security due diligence
Know what actually protects a property you’re acquiring, auditing or integrating with.
Vendor verification
Confirm the WAF you pay for is the WAF that answers, misrouted zones are more common than anyone admits.
Consolidation planning
Mapping WAFs across an estate is step one of collapsing three security vendors into one.
Market research
See which security edges your market actually deploys, not which ones sponsor conferences.
Status & availability
Free, and live now.
STATUSWhere the build stands
FREEFreeto use, no signup
Liveand free to run
200+assessments/yr behind the data
Liveand free to run
- Built on assessment data
The toolkit automates the detection and benchmark data behind the assessments we already run, the tools are how we prove the data is good.
- Free, no signup, shareable
Every tool ships free with shareable reports; the business model is the advisory behind it, not your email address.
- Available now
The tool is live and free to run, refined as we expand coverage.
LIVE NOWRun a lookup →
Want a human read on the result? A free assessment runs the same analysis, human-graded, usually within 24 hours, and gives you a benchmark against pooled volume pricing.
Live now · free to run, no signup
Keep reading
Bot Detection in context.
The research this tool automates.
More free CDN World tools
All part of the same toolkit — passive, non-intrusive, no signup.
CDN Finder FreeSee which CDN (or stack) serves any site→DNS Finder FreeIdentify the DNS provider and audit records→HTTP Header Analyzer FreeGrade security headers and inspect caching→TLS & Cache Checker FreeInspect TLS config and cache behavior→WAF Detector FreeDetect the web application firewall in use→
Want the full picture?
Get a free infrastructure assessment ↗A free assessment reviews your whole delivery and security posture, human-graded.
FAQBot Detection questions,
Bot Detection questions,
answered straight.
Is Bot Detection live?
It’s live and free to run as part of the CDN World toolkit — as is everything on the tools page.
Is this a security scanner?
No, and deliberately so. It sends only ordinary, benign requests and identifies the protection layer from passive fingerprints. It never sends attack payloads, probes for vulnerabilities, or does anything a production site would register as hostile.
Which products can it identify?
The launch library targets the dedicated bot-management vendors we meet most in assessments — DataDome, HUMAN (PerimeterX), Kasada, Cloudflare Bot Management, Akamai Bot Manager, Imperva and more — and it will grow the way our CDN signature library did.
Can bot protection hide from it?
Some vendors only reveal themselves on protected paths or via JavaScript challenges our passive check can’t see, so the report says so honestly — a low-confidence result with the evidence shown beats a confident guess.
Why does a CDN advisory build a bot tool?
Because on modern stacks bot management rides on the same edge as delivery — often one buying decision — and you can’t advise on cost or performance without seeing what’s filtering traffic in front of the origin.
I need this answered today.
A security-focused assessment covers bot-management and WAF identification and posture, human-graded.