Runs Turnstile, reCAPTCHA v3, IP intelligence and browser automation detection on one page and folds them into a 0-100 environment risk index, showing how your browser and network look to mainstream bot protection.
Verdict
Four checks, weighted; lower is better.
Environment risk index
--/ 100
waiting
Unfinished checks are left out and the weights are renormalised over completed ones.
0 · clean2050100 · high risk
Not finished yet: IP intelligence · automation detection
Cloudflare challengeweight 30%
not configured
IP intelligenceweight 35%
loading
Google behaviour scoreweight 25%
not configured
Automation traitsweight 10%
detecting
Checks
01, 02, 04 and 05 run automatically; 03 needs one click.
01
Turnstile non-interactive
Verifies silently in the background, never asks for a click.
The Turnstile widget for this mode is not configured
Not configured
02
Turnstile managed
Cloudflare decides whether to ask you for a click.
The Turnstile widget for this mode is not configured
Not configured
03
reCAPTCHA v3 behaviour score
Returns a 0.0-1.0 trust score, run on demand.
reCAPTCHA v3 is not configured
Not configured
04
Browser automation detection
Checks in-page for webdriver and headless browsers.
Runs automatically on page load
Waiting
05
IP intelligence cross-check
Multi-source cross-check of purity and proxy flags.
This page looks at four things together: whether both Cloudflare Turnstile modes pass without interaction, the Google reCAPTCHA v3 trust score, what CleanIP's multi-source intelligence says about your IP, and in-page browser automation detection. They combine into a 0-100 environment risk index, lower is better. When all four look good, your fingerprint is natural and your network is clean, so sign-ups, logins and cross-border business are unlikely to trip bot protection.
How the risk index is computed
Four weighted parts: Cloudflare trust level 30% (from the two Turnstile cards: silent pass 0, click required 40, failure 100), IP purity 35% (CleanIP purity inverted into risk, at least 70 when a proxy / VPN / Tor / residential proxy is flagged), reCAPTCHA trust 25% (one minus the score) and browser automation 10% (100 when detected).
Unfinished parts are left out and the weights are renormalised over the completed ones; the card says what is still missing. Lower is better: up to 20 is clean, above 50 means clear risk signals and frequent CAPTCHAs or blocks on strict sites.
Proxy and network flags
IP flags come from CleanIP's multi-source engine (multiple intelligence sources cross-checked), which covers more than any single vendor list. A positive is rarely wrong; a negative does not prove the IP is clean.
Open proxy / residential proxy / VPN / Tor: any hit sets the IP part to at least 70.
Datacenter / hosting IP: not malicious, but many platforms are stricter with hosting egress, so the IP part is at least 35.
Browser automation: FingerprintJS's open-source BotD checks in-page for webdriver, headless browsers and common automation frameworks.
How the two Turnstile modes differ
Both the non-interactive and managed widgets are tested. Results fall into three tiers:
Passed silently (best): verification completes with no action, meaning Cloudflare highly trusts this fingerprint and network.
Click required (good): managed mode asks for one "I am human" click; the environment is broadly normal with a few suspicious signals.
Still failing after the click (poor): the server rejects the token even after the challenge; the fingerprint is abnormal or the network reputation is low, so CAPTCHAs and blocks will be frequent.
reCAPTCHA score bands
reCAPTCHA v3 shows no challenge; it returns a 0.0 - 1.0 score that Google computes from browser fingerprint, device data, network reputation and behaviour history. Higher means more human:
0.9 - 1.0: excellent, a very clean browser environment.
0.7 - 0.9: good, fine for most scenarios.
0.5 - 0.7: fair, some risk signals.
0.3 - 0.5: poor, likely to trigger CAPTCHAs.
0.0 - 0.3: very poor, easily flagged as abnormal traffic.
What the result tells you
Cloudflare and Google run the two most widely deployed bot-protection systems on the web. Testing both tells you whether your fingerprint looks natural, whether your network is clean, how likely you are to trip site defences, whether the setup suits account registration and long-term use, and whether it fits demanding scenarios such as cross-border e-commerce, social media operations, AI services and streaming.
Whether Cloudflare passes you silently and what reCAPTCHA scores you are the two most direct indicators. The better both look, the more stable and genuine the environment, and the less often security policies will interrupt you.
Common questions
Why do the two Turnstile cards disagree?
Non-interactive mode never asks for a click - it either passes or fails. Managed mode degrades to a click when trust is insufficient. Managed passing while non-interactive fails means Cloudflare's trust in this fingerprint sits right at the threshold.
Why does the risk score change on every refresh?
The Bot Score is computed per request and reacts to headers, TLS fingerprint and request cadence. It jitters more when Cloudflare has few samples for the IP range; refresh a few times and take the typical value rather than a single reading.
Why not use Cloudflare's Bot Score directly?
The Bot Score is only returned on Cloudflare Enterprise plans with the Bot Management add-on, which costs far more than a site this size can justify. Turnstile, however, runs on the same detection signals: a silent pass maps to a high score, a click to a medium one, a failure to a low one. This page uses the two Turnstile modes in place of the score and fills in the proxy lists from CleanIP's own intelligence.
Does the test use up quota or leave a record?
Turnstile is free and unlimited. Each reCAPTCHA v3 run consumes one assessment from the site's quota, so it is rate-limited per IP. Tokens are never stored - they are discarded right after server verification.
IP flags come from CleanIP's multi-source cross-check; country and edge come from Cloudflare's /cdn-cgi/trace, read through our static asset domain static.cleanipcdn.com.