The detection side, listed by its own public documentation: challenge platforms, bot-management products and managed rule sets, each at the most technical public address the sweep could reach. Reading what the defending side documents is the most reliable way to understand what is actually being configured against you, and it is a very different source from anybody's analysis of it.
The detection side, listed by its own public documentation. Where a vendor's marketing host refuses automated clients, the docs host is listed instead and the refusal is recorded.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://developers.cloudflare.com/turnstile/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://developers.cloudflare.com/bots/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://blog.cloudflare.com/turnstile-ga/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://docs.datadome.co/docs/welcome-to-datadome-platform
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://docs.humansecurity.com/home
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.akamai.com/products/bot-manager
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.kasada.io/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://developer.arkoselabs.com/docs/what-is-titan
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.imperva.com/products/advanced-bot-protection-management/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://developers.google.com/recaptcha
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://docs.hcaptcha.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.f5.com/products/distributed-cloud-services/bot-defense
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Documentation describes the integration, not the detector
Almost everything published here describes the customer-facing surface: how to deploy the sensor, how to handle a verdict, what the error codes mean, which knobs the site owner can turn. Very little of it describes the model producing the verdict, and where a vendor does publish something closer to that — a documented score range, a named signal, a rule group enumerated rule by rule — it is worth considerably more than the rest of the page it sits on.
That asymmetry is useful rather than frustrating. A product whose configuration surface you understand is a product whose behaviour on a given site you can partly predict, because two deployments of the same product frequently behave differently by design.
Why several of these entries point at a docs host rather than a product site
A recurring problem in this section is that vendors selling anti-automation products often refuse automated clients on their own marketing hosts, which means the address a register can actually check is not the address the vendor would prefer you cite. Where that happened, this catalogue lists the documentation host and records the substitution as a flag on the entry rather than quietly listing an address it could not read.
The same policy produced omissions. Several vendors keep their technical documentation behind single sign-on or a portal login; those attempts and their outcomes are recorded on the field log rather than listed as entries, because this register does not list what it has not checked.
State marks used in this section
ACTIVE — Shipping. Safe to build on today.
13 here
Questions about anti-bot vendor documentation
Answered from the fields printed above, and from nothing this register has not checked.
How do I find out what anti-bot system a site uses?
Not from this register — that is a different question with a different answer, and this catalogue does not attempt it. What this section gives you is each vendor's own public documentation, which is where the deployment model, the response headers and the configurable surface are described.
Do these vendors publish how their detection works?
Almost never. The closest anything here comes is a documented score concept and one managed rule set enumerated rule by rule with named signals. Everything else describes the integration. Treat third-party analysis of internals as analysis, not as documentation.
Why list the detection side in an anti-detect registry at all?
Because the two halves are one subject, and a catalogue that only listed evasion tooling would be describing half a problem. The vendor's own words about what its product does are a primary source; nothing in this section is an endorsement of anything.
Donut Browser is filed in section 01 of this same catalogue, under the
same rubric, with the same fields printed against it and no exemption:
an open-source anti-detect browser under AGPL-3.0 whose Wayfern Chromium
fork applies fingerprint overrides at engine level over CDP rather than
by patching page JavaScript, with a local REST API and MCP server on your
own machine, self-hostable sync, zero telemetry, and a pre-launch gate
that refuses to start a profile when the proxy's exit geography
contradicts the profile's fingerprint. It is judged here the same way
everything in this section is judged.