Request profile

Does the request introduce itself the way a real browser does?

What this check is

Every request a browser makes introduces itself before any page loads: a User-Agent, a set of headers, client hints about the platform, a protocol. This check reads that introduction on the server, then compares it with what the browser itself reports once the page runs. A real browser's story agrees with itself. A scripted client usually gets at least one line of the story wrong.

What Tells reads

The User-Agent and the full header set of the request that fetched the page
Client hints (platform, mobile flag, high-entropy values) as sent on the wire
The browser's own navigator values, collected in the page, for the comparison
The browser's timezone, set against the timezone of the IP address

How to read your result

Fail: No User-Agent at all, an automation or HTTP-library User-Agent, or a request User-Agent that differs from the one the browser reports about itself.
Warning: The story mostly agrees but a detail is off: language, platform or mobile hints that do not match the browser, or a browser timezone that differs from the IP's timezone.
Pass: Request and browser describe the same browser on the same platform.
Not available: The server readings did not arrive, so there was nothing to compare.

Why it matters

This is the oldest gate in bot detection, and it runs before a single line of JavaScript. Whole classes of automation (raw HTTP clients, misconfigured headless setups, spoofers who patch the page but not the wire) are turned away here. Sites also lean on it because it is cheap: the answer is already in the request.

Where this matters most

Across the platforms Blowhorn works with, rated in the platform guide (H = matters a lot, M = contributes, L = no public evidence; tags mark vendor-stated, reported, or inferred evidence):

LinkedIn (H): a per-session device fingerprint rides on its API calls, so header and UA drift contradicts the session identity [Reported]
X (H): request consistency is basic hygiene for its web risk stack, and scripting the site is expressly punishable [Vendor]
Reddit (H): missing browser headers (Sec-CH-UA, Sec-Fetch) are a top reported block trigger [Reported]
GitHub (M): the API requires a valid User-Agent and throttles anonymous-looking clients [Vendor]

Everywhere else in the set this one rates Low.

In your report

Find it in the checks table on the tool page, with the detail in the Server / IP section. The same findings appear in the report JSON under verdict.reasons, and the agent guide explains how to read them programmatically.