Sites protected the way stores, ticketing services and airlines protect theirs. An empty profile with no cookies, and a repeat visit 2 minutes later.
DataDome — real websitesFoot Locker, Vinted, Leboncoin, Tripadvisor, Hermès and the test page of DataDome’s former head of research opened without a captcha
Cloudflare, PerimeterX, Kasada, Akamai — real websitesIndeed, StockX, Zillow, Walmart, StubHub, Hyatt, Canada Goose, Nike and Delta opened with no captcha or block, and again on a repeat visit 2 minutes later
Cloudflare Turnstilethe invisible check passed on its own, the checkbox one with a single click
Google reCAPTCHA v3score 0.9 of 1.0 — Google treats the browser as a human
Fingerprint check sites
Full reports, uncropped.
CreepJSfull report: 0% headless and stealth, no tampering found; WebGL, audio and fonts match a Mac