After a long time without side projects, I finally shipped a new one: botstop.io.

The idea is dead simple. You open the page, you do nothing for about three seconds and you get a verdict: human, suspicious or automated. That's it. No CAPTCHA, no clicking on fire hydrants.

While you wait, the page passively collects browser signals: input events, headless browser tells, a worker cross check, WebGL and canvas environment data and a small anti-replay challenge that runs inside an obfuscated JavaScript VM. The same detection engine gates signups and logins at ipapi.is, so botstop.io is basically a public playground for it.

A few things I care about in the design:

• Sitting still is not held against you. The page literally asks you to do nothing, so the absence of mouse and keyboard input is not a bot signal here. Only positive evidence counts: navigator.webdriver, automation globals, synthetic events, worker spoofing mismatches and so on.
• Every check gets a shareable link, so you can send your result to other people.
• The individual signals are never shown publicly, only the verdict and a score. If the site showed exactly which probes fired, it would be a free calibration tool for bot authors.

If you write scrapers or browser automation, point them at botstop.io and see what happens. Vanilla headless Chrome scores around 90 and gets flagged as automated. If you manage to look human with a bot, I would honestly love to hear how you did it in the comments.

If you want the theory behind all of this, I wrote about it in On the Architecture of Bot Detection Services and Behavioral Analysis for Bot Detection.