Search
On every results page observed.
- The settings the browser declares about itself.
- The signs of a browser driven by a program.
- The way the page is actually drawn on screen.
Act 0
Identity check
This site checks for itself that you are human.
Before you come in, move. This page runs on you the measurement Google runs on every browser that asks for its results: it looks at the shape of your gestures, not how long they last.
A perfectly straight path at constant speed fills the gauge very slowly. A human gesture fills it fast.
Everything stays in your browser. None of these measurements is transmitted: not to RESONEO, not to Google, not to anyone. No network request leaves this act.
%
Move here
Local log transmitted: 0 bytes
Episode II
THE EMPIRE
SCRAPES BACK
Since the summer of 2026, access to Google results has no longer been open to every browser on the same terms. A check runs in the background on every results page.
Between August 20 and 22, four new families of tests appeared in it: the settings declared by the browser, text rendering, pointer precision and the graphics card.
RESONEO pointed browsers at one and the same query and recorded what came back: the results, the waiting screen, or a refusal. Here is what we saw.
Act I
The blockade
Not every browser gets the results.
Google does not serve its results to every browser on the same terms. To find out who gets through, we pointed several browsers at the same query and recorded what came back: the results, the waiting screen Google sometimes inserts before them, or a refusal.
Pick a craft and try the crossing.
The launch setting, the one everybody blames.
No crossing attempted yet.
- Launch setting
- —
- Badge exposed to the page
- —
- Outcome
- —
In the controlled trials, with Chrome, machine and network held constant, refusal follows the native value of navigator.webdriver. Results appear when it is false, even with the --enable-automation setting. When it is true, the browser is refused, even without that setting. Switching the setting off does not remove the badge.
Chrome 153, same binary, same IPv4 and IPv6, two trials per combination, two randomly ordered blocks, a fresh profile for every navigation. This supports a causal role for the badge in this environment; it does not reveal the server score and does not establish a universal rule.
Act II
The clearance cylinder
Session state changes the path.
A browser keeps traces of its visits: cookies, small files a site drops and the browser hands back on every later visit. We took two copies of the same browser, wiped in one of them only the cookie Google uses to recognise you, and left everything else identical.
You are following the copy that keeps its session. You are following the copy that lost its cookie.
On every flip, both paths are replayed side by side.
The copy that keeps its session
The cookie Google uses to recognise it is still there.
- The query goes out.
- The results come up.
Results obtained, no detour.
The copy that lost its cookie
Same browser, same machine, same network: only that cookie is missing.
- The query goes out.
- The waiting screen comes in between: the check is back.
- The results come up.
Results obtained, after a detour.
Both copies end up getting the results. A returning check is not a refusal: it is a detour, taken by the copy without a session and skipped by the other.
Two profiles copied from the same browser, in the same second, behind the same address. What this act shows is the difference in path, not a duration measurement: we did not time the waiting screen.
Act III
The two star charts
Two rankings for one and the same query.
Same query, same network address, two minutes apart: two result lists without a single page in common. Both browsers are copies of the same profile; only the session cookie tells them apart.
Bring the two surveys together: they line up rank against rank. A rank lights up when both surveys cite the same page there.
- 1search-watch.gg 1bot-detection.gg
- 2serp-observatory.gg 2browser-fingerprint.gg
- 3bot-or-human.gg 3search-journal.gg
- 4browser-lab.gg 4proxy-benchmark.gg
- 5rank-tracking.gg 5serp-measure.gg
- 6collection-notes.gg 6tech-notebook.gg
- 7visibility-agency.gg 7automation-review.gg
- 8scraping-forum.gg 8analytics-desk.gg
- 9field-notes.gg 9plain-web-guide.gg
- 10engine-workshop.gg 10results-archive.gg
Demonstration data: numbered positions, invented site names. Neither the query nor the sites actually recorded are published.
Shared ranks of 10
We conclude neither way. Neither deliberate result poisoning nor its absence. There is no contemporaneous independent human reference to compare these two surveys against: we show the gap, we do not explain it.
Act IV
The engine room
Four programs, three flows, and what they read.
A results page does not run a single check but several, each on its own account: search, the waiting screen, advertising, and an embedded YouTube video when there is one. Up to four coexisted on a single observed page. They do not read the same things: one follows clicks and touch events, another inspects browser properties and watches for automation indicators.
Open a core to see what it watches.
The waiting screen
Only when Google inserts its waiting screen before the results.
- What you do during the wait: clicks and touch contacts.
- The time spent on that screen before moving on.
- This is the check that decides whether the results follow.
Advertising
On the same page, but on the advertising side’s account.
- It has its own settings, different from the search one’s.
- It is interested in what happens around the ads.
- It runs even when you look at no ad at all.
The video
Arrives with the embedded YouTube player, when the page contains one.
- It belongs to YouTube and shares nothing with the other three.
- It watches the video playback, not the results page.
- Its mere presence brings the total to four simultaneous checks.
The four cores run at the same time, each on its own account.
The check
Now it is your turn to be read
The four families of tests that appeared at Google between August 20 and 22, 2026, run on your own browser, here, now.
Everything is read inside your browser and nothing is transmitted. Not to RESONEO, not to Google, not to anyone. No network request leaves this act. Nothing is stored, nothing identifies you: the values vanish when you close the tab.
The values below are read by your browser: they stay empty while JavaScript is turned off.
-
1The settings your browser declares
- Declared language
- —
- Time zone
- —
- Window size
- —
- Declared system
- —
- Declares itself driven by a program
- —
-
2The way your browser draws text
The check comes through here
- Width taken by that sentence
- —
- Line height
- —
- Placement down to a hundredth of a point
- —
-
3How precise your pointer is
- Pointer type
- —
- Can hover without clicking
- —
- Fingers recognised at once
- —
- Screen fineness
- —
-
4
Your graphics cardCard name- —
This family of tests was withdrawn from Google’s checks on October 5, 2026. That is why it is struck through here.
Network requests during the sweep pending
Act V
The freezing
Behaviour becomes a token.
At the end of the check, everything read and observed leaves inside a single encrypted block of data: the token. Captured tokens run from 1,400 to 1,544 characters. Since July 2026, a share of responses also adds a module that retains an interaction history in the browser and reads it back on the next visit: today’s behaviour is still there tomorrow.
Trace source: pending.
- The gesture is replayed
- It is compressed
- It is sealed
Educational reconstruction. This token is not Google’s: it is built here, in your browser, by a deliberately simple encoding whose plain content is shown right beside it. No real algorithm is reproduced, and nothing is sent anywhere.
The sequence is drawn by your browser: it stays empty while JavaScript is turned off.
Trace on hold
Reconstructed token —
— waiting for the seal —
What this block contains, in plain words
- Points of your gesture
- —
- Duration of the gesture
- —
- Area swept
- —
- Average speed
- —
Act VI
Mission report
What we take away.
What the study establishes: access to results depends on what the browser declares about itself, session state changes the path, and several programs read the page at the same time. What it does not establish: the server’s decision rules, its risk scores and the real effectiveness of the detection stay out of reach of this analysis.
Here is your crossing record. It is built inside your browser, from what you did across the seven acts, and it is sent nowhere.
SearchGuard — Episode II
Mission report
Entry check
—
Running the blockade
—
Engine room
—
—
The record is filled in by your browser: it stays empty while JavaScript is turned off.