// blog

what runs on the top 100

we profiled the web's 100 most-visited sites for the scripts that read the browser's fingerprinting surface. some of that reading is bot detection; much is analytics and ads doing the same thing, and the fingerprint alone does not separate them.

what the scripts read

each trapped api files into a fingerprint family, counted once per site. bot detection reads these, and so do analytics and ads, so a tall bar is a popular signal, not proof of detection.

which sites read the most

distinct scripts trapping a fingerprinting api. a high count mixes detection with analytics and ads, so read it as how much a page reads, not how much it detects.

the automation-relevant reads

the subset the harness flags as tells: the reads that separate a real browser from an automated one. a tell inside an analytics script is still just an api read.

where the reading concentrates

many social and search targets read light because a login walls the real app the profile never reached, so their number is a floor.

what a profile cannot see

this is the javascript-fingerprinting layer, read without interacting with the page. of the 100, 71 surfaced, 11 came back walled (a block or consent page before any script ran), and 18 did not finish. a walled or missing surface is a limit of the measurement, not a verdict about the site. behavioral, network, and challenge layers need a run that provokes them.

snapshot taken 2026-09-14. the families are the taxonomy in the developer reference, and how we measure is on the methodology page.