Anti-bot platforms aggregate dozens of signals — TLS fingerprint, IP reputation, mouse-movement patterns, request timing, cookie state, JavaScript execution results, and more — into a single numeric score. A score near 0 indicates confident human; a score near 100 indicates confident bot. The site operator configures a threshold above which requests are challenged or blocked.
Bot scores are computed in real time and evolve throughout a session. A visitor who passes the initial page load may receive a rising score after navigating in an implausible pattern, triggering a mid-session CAPTCHA. Some platforms expose the score in response headers or cookies for debugging, while others keep it entirely opaque.
Scraper teams monitor bot-score signals by checking for challenge-page responses, HTTP 429 or 403 codes, invisible honeypot fields being populated, or anomalous redirect chains — all indirect evidence that the score crossed the operator's threshold.