Automation signals

How websites read it

navigator.webdriver                    // true under WebDriver
'__selenium_unwrapped' in window       // framework globals
document.$cdc_asdjflasutopfhvcZLmcfl_  // ChromeDriver marker

Most checks are property lookups. The DevTools probe is subtler: serialising an Error to the console reads its stack getter only while a debugger is attached — which also fires when a developer simply opens DevTools, so it counts for little.

Why it identifies you

These are not identity signals; they are honesty signals. A browser that admits to being automated is treated as a bot regardless of how consistent its fingerprint is, so they are checked first and weighted heavily.

How risk-control systems use it

navigator.webdriver = true or any framework global is a hard stop on most platforms. Headless indicators and a missing window.chrome on a Chrome UA come next. Overridden navigator getters — the standard way stealth plugins hide the flag — are detected by checking that each getter is still native code.

Common mistakes

Launching with a WebDriver session instead of attaching to a running profile; "stealth" patches that replace native getters with JavaScript ones; headless mode for anything that faces a login page.