Sign in

You cannot spoofthe speed of light.

Heretic checks what a browser claims against physical measurements of its connection and hardware. Your server receives every contradiction.

Start building Run the full check

A different face.
The same machine.

An anti-detect browser rewrites what a page can read. Heretic measures the layers it cannot reach.

  1. 01 Surface Chrome 131 · Windows 11

    America/New_York · HTTP/2

  2. 02 TLS Chrome

    Consistent with the claim

  3. 03 QUIC 0

    Browser reported HTTP/3. No QUIC packet reached the sensor.

    reach.client-claims-h3-without-quic
  4. 04 TCP Linux

    The kernel that opened the connection is Linux. The browser claims macOS 15.

    stack.os-contradiction
  5. 05 Light 2.1 ms

    Asia/Tokyo is at least 6,767 km away. Light needs 45.1 ms for the round trip. It took 2.1 ms.

    geo.rtt-below-vacuum
VerdictContradicted3 composite findings · 3 families

A score is a guess.
A contradiction is proof.

Most bot detection returns a probability and leaves the threshold to you. Heretic returns what broke: a physical limit, or a claim that contradicts itself.

Risk score
71.0/ 100
Block above
?
Reason
Model output
Heretic
Contradicted
Claim
Asia/Tokyo
Reason
Light needs 45.1 ms. It took 2.1 ms.
Finding
geo.rtt-below-vacuum

The measurement is ours.
The decision is yours.

Heretic sends the finding to your server. Your rules decide what happens next.

From Heretic Contradicted geo.rtt-below-vacuum
  • CheckoutBlock
  • Sign-upPhone challenge
  • NewsletterAllow and log

Your rules, for example.

Suspicious session?
Step up to a real phone.

When a check comes back contradicted, the widget can challenge the visitor on their phone. From a desktop, they scan a QR code.

  1. 01 Hold it level Lay the phone flat until the mark centers, then hold.
  2. 02 Hold steady Keep the phone steady.
  3. 03 Turn sideways Hold the phone upright and turn it sideways.
  4. 04 Confirm Confirm with your fingerprint, face, or screen lock.
  5. 05 Verified Your server verifies the token before accepting the action.

One script tag.
One server call.

No DNS change. Your traffic never passes through Heretic.

  1. 01 Your page

    Add one script tag.

    <script src="probe.heretic.tech/client.js">
  2. 02 Heretic sensor

    Measures the connection and the device.

    TCP · TLS · QUIC · timing
  3. 03 Your server

    Reads the verdict and applies your rules.

    GET /v1/verdict/{id}
Integration guide Challenge widget

Before you build

How does Heretic handle VPN users?

The probe reports concealment indicators alongside the verdict. Your policy decides how to treat them. If you request a phone challenge, detected concealment holds it until the visitor disables the VPN, proxy, or relay and retries.

What happens if collection is blocked?

An opened session that does not complete required measurement returns refused. If collection is blocked before a session opens, no result exists. Your server must require a completed check before accepting the protected action.

Do I need to change my DNS or route traffic through Heretic?

No. The collector connects separately to the Heretic sensor. Your application traffic continues to your server. Verify ownership of your site with a DNS TXT record or a file.

What is retained?

Ordinary results are available for seven days. Optional zero retention permits one authorized read within ten seconds and keeps no stored history. Finalized assessments retain their original verdict, findings, and versions.

Run the
measurement.

Developer Sandbox. No card required.

Start building Pricing

Questions about an integration