Public bot-detection playgrounds

External pages built specifically to challenge bots. Useful complement to the vendor-specific tests — run your automation stack against these and compare signals.

Purpose-built test pages

• bot.sannysoft.com
  Classic automation-tells matrix: navigator.webdriver, plugins, languages, permissions, WebGL, Chrome runtime, etc. Pass/fail per probe.
• arh.antoinevastel.com/bots/areyouheadless
  Headless-Chrome heuristics by Antoine Vastel (FingerprintJS). Returns single verdict.
• deviceandbrowserinfo.com/are_you_a_bot
  Composite bot score with per-signal breakdown.
• fingerprint.com/demo
  FingerprintJS Pro live demo including botd. Returns visitor ID + bot verdict.
• creepjs (abrahamjuliot.github.io)
  Fingerprint entropy + lies detection. Already embedded under /tests/creepjs/.
• infosimples.github.io/detect-headless
  Open-source headless probes; small but explicit list.

Cloudflare-specific (beyond Turnstile)

• nowsecure.nl
  Cloudflare full "are you human" interstitial. Standard target for testing JS-challenge bypass.
• scrapingcourse.com/cloudflare-challenge
  Practice target — Cloudflare challenge with curated bypass guidance.
• scrapingcourse.com/antibot-challenge
  Generic anti-bot interstitial.
• g2.com
  Cloudflare Bot Fight Mode + JS challenge on entry. Real-world prod target — be polite.

Caveats

• Production sites = real users. One request per check. No scraping.
• External pages are not under our control — content / verdict logic can change without notice.
• Layered defenses are common (e.g., Cloudflare + DataDome). Confirm the active vendor via cookies / headers / script URL before attributing detections.