Scoring the browser
behind a signup
Nolgard scores the browser and the request that sent it, and keeps every signal that added to the score so you can see why a verdict came out the way it did.
Decision trace
Example · block mode · bot threshold 70Bot
- Input signalsA Chrome user agent, a known Python requests TLS cipher list and no Accept-Language header.
- Reason ids
tls_tool_stack · 70no_accept_language · 20 - Verdict
bot· score 90 - Decision
block· your backend enforces it
How it works
Collect evidence
Client checks compare browser surfaces and interaction signals. Each challenge selects six of seven seeded probes.
Check the request
Server signals add transport evidence, including TLS cipher-list mismatches. SHA-256 proof-of-work scales from 10 to 18 bits with risk.
Apply the policy
Weighted reasons sum to a score capped at 100. Your configured thresholds and site mode choose the decision.
API
Verify the browser token on your backend. Example response fields; reasons are owner-only diagnostics.
POST https://nolgard.com/v1/verify
Content-Type: application/json
{
"secret": "SITE_SECRET",
"token": "BROWSER_TOKEN",
"action": "signup"
}
// Example response fields
{
"success": true,
"verdict": "bot",
"score": 90,
"decision": "block",
"ref": "ev_123"
}Limits
- Stealth browsers such as Camoufox and humanized Patchright can pass as human. A human verdict is not proof of a unique person.
- In our tests, Playwright MCP-driven agents did not fill the honeypot. That is why account linking, grants and spend caps exist.
- Honeypot decoys are opt-in and off by default. A suspiciously filled decoy adds weight 70, but honeypot evidence alone never hard-blocks automatically: enforcement is at most challenge. Independent signals or explicit customer rules can still block.
- Missing optional probes stay neutral. TLS checks use Cloudflare's cipher-list SHA-1, which is not a universal browser identity. Automated and human traffic can share the same TLS stack.
- Proof-of-work adds computation. It does not prove a human is there, because a real browser can solve it while an agent drives it.
- Default thresholds are 40 for suspicious and 70 for bot; site settings can change them. Observe mode reports proposed decisions without blocking. Start there and review false positives.
- Claimed agents need separate identity checks. Web Bot Auth and published IP ranges verify supported identities; a user-agent name alone does not.
Rules: test on history before enforcing a policy based on these reasons.