Three short checks that run in this tab and see this browser only: whether a content blocker
hides ad slots, whether it stops ad requests, and whether this browser's DNS is a filtering
resolver. Signals, not a certificate: a positive row names what was observed; no row can say
whether ad code was stopped elsewhere or whether this device was ever reached. Results are drawn
into this page and never uploaded.
0of 3 protections seen
01
Ad hiding 20 baits, 2 controls
How this row is tested
Twenty invisible elements named the way ad slots are named (adsbox, ad-banner, adsbygoogle, #ad, …) and two with neutral names. A filter list's generic cosmetic rules hide the baits and leave the controls alone; the script reads them back after two frames.
Why it matters. Cosmetic filtering is the cheapest sign a content blocker is on in this browser. Some blockers hide nothing here and still block requests, so a zero is "not seen", never "unprotected". More
Not run02
Ad requests 3 test images, 2 controls
How this row is tested
Images on paths that match EasyList's request rules (/ad_images/, /adsbanner-, /ad_skyscraper.gif) on this server, each between two control images with identical bytes. No cookies, no referrer, never displayed. The test is a load difference, not a verdict: a timeout is unknown, a failure this page's own policy caused is reported as such, and a failed test image is tried once more before it counts.
Why it matters. Hiding a slot is not the same as stopping the request; the request is what carries the payload. A blocker that fails this test but passes the first is hiding ads it still fetched. More
Close this gap
In Firefox: install uBlock Origin from Mozilla's add-ons site and leave the default lists on.
In Chrome: install uBlock Origin Lite from the Chrome Web Store, the build written for Chrome's newer extension interface, and leave the default lists on.
In Edge: install uBlock Origin Lite (Edge installs from the Chrome Web Store) and leave the default lists on.
In Safari: content blockers come from the App Store (AdGuard, 1Blocker, Wipr use Apple's content-blocker interface); after installing one, turn it on under Safari › Settings › Extensions.
This is Brave: its shields block requests without hiding by class names, so check Shields is up for this site (the lion icon) rather than installing anything.
This is an app's in-app view, which carries no blocker at all. Open this page in Safari, Chrome or Firefox and close the gap there.
Install uBlock Origin, or uBlock Origin Lite where the browser requires it; the guide names the right build per browser.
About two minutes. Then reload this page and re-run: this row should turn to Load difference, and the hiding row should climb.
Filtering DNS for this browser AdGuard, NextDNS self-checks
How this row is tested
A fresh random name under -dnscheck.adguard-dns.com resolves only through AdGuard's resolvers and names the server group; test.nextdns.io answers only through NextDNS and names the profile. Cloudflare, Quad9 and a Pi-hole have no such endpoint; the network check, which runs from this server, will cover them.
Why it matters. A browser blocker protects one browser; a filtering resolver covers every app that uses the system DNS. This row sees the resolver this browser uses, which a VPN, iCloud Private Relay or the browser's own DNS-over-HTTPS can make different from the device's. More
Close this gap
On this Mac: install AdGuard DNS's configuration profile or make a free NextDNS profile, then System Settings › Privacy & Security › Profiles › Install. NextDNS names its profile to the re-run, so the fix proves itself.
On this iPhone or iPad: install the resolver's configuration profile (AdGuard DNS or NextDNS), then Settings › General › VPN & Device Management › Install.
On this PC: Settings › Network & internet › your adapter › DNS server assignment › Edit, and enter a filtering resolver's addresses (AdGuard DNS or NextDNS), with DNS over HTTPS on where offered.
On this phone: Settings › Network & internet › Private DNS, and enter the filtering resolver's hostname (AdGuard DNS's dns.adguard-dns.com, or your NextDNS profile's name). It covers every app, including Chrome.
On this computer: point systemd-resolved or NetworkManager at a filtering resolver; the guide has the exact lines and the command that proves each.
Set this device's DNS to a filtering resolver (AdGuard DNS, NextDNS); the guide has the steps, one platform at a time.
Re-run after: this row should name the resolver that answered, for every app on this device, not just this browser.
Already behind a Pi-hole, or on a VPN with its own filter? This row cannot see those from a browser, so "none seen" may be wrong in your favour; the network check is their eye. Full steps: filter DNS for every app.
Not run04
Other apps on this device
Not measured by a browser. Is this device affected? reads what the device runs from a script's report and says which CVEs apply to those versions. The manual guide says how to read the system resolver, the hosts file and the firewall by hand on Windows, macOS, Linux, iPhone and iPad and Android, and one plain script per computer reads them in one go, uploading nothing.
Not a page's to test05
Every device on your network
No web page can test this. This server can, because it sits on the LAN: the network check resolves canary names through the resolver the router hands out, daily, once the owner turns it on. The guide's router and network sections say what to set on the router and how to prove each setting from any device.
Not run from this server
What this browser gives away read in the same run; nothing uploaded
06
Privacy signals GPC, DNT
How this row is tested
Reads navigator.globalPrivacyControl and navigator.doNotTrack: whether this browser tells sites not to sell or share, in a form the law in several US states obliges them to honour.
Why it matters. Global Privacy Control is the one browser signal with legal weight; a browser that sends it opts you out of sale and sharing on every site that must listen. More
Not run07
WebRTC addresses no STUN
How this row is tested
Opens a peer connection with no servers at all and reads the candidates it offers. Nothing is sent anywhere; the question is what the browser would hand a site that asked.
Why it matters. WebRTC can reveal the LAN address and, with a VPN on, the real public one. Current browsers hide the LAN address behind an mDNS name; an old or oddly configured one does not. More
Not run08
Fingerprint surface canvas, fonts, screen
How this row is tested
Draws a canvas twice and hashes it, measures a dozen common fonts, and reads the screen, time zone, languages, cores and touch points: the surface a tracker reads to recognise a browser without a cookie.
Why it matters. A stable, wide surface is an identifier that no cookie setting clears. Brave randomises the canvas; Firefox and the Tor Browser blur the rest; this row says which case this browser is. More
Not run09
Referrer as received
How this row is tested
Asks this server (and the second origin, when one is configured) what Referer it received from this page, and compares it with this page's policy.
Why it matters. The referrer tells the next site where you came from, sometimes down to the page. The modern default sends the origin only across sites; a page can ask for more or less, and this row shows what actually arrived. More
Not run11
This browser's version against the vendor's releases
How this row is tested
Reads this browser's version from what it says of itself (Chromium browsers give the full version through client hints; Firefox and Safari their major and minor) and asks this server what the vendor feeds say is the newest release with security fixes.
Why it matters. Every browser release fixes flaws, and the ones it fixes are published the day it ships. A browser two releases behind is running code with known, documented holes; relaunching is usually all it takes. More
Not run10
Transport IPv4/6, HTTP, TLS
How this row is tested
What the server saw of this connection: the address family, the HTTP version, and the TLS version when this server ended TLS itself.
Why it matters. Whether a connection arrives over IPv6, and over which HTTP and TLS versions, says what the path between this browser and the site is capable of; it is also what every site you visit can see. More
Not run
Waiting for the script.
What this page learned about you
The server's side of the check: what this request carried, drawn here and kept nowhere.
Address
216.73.217.62 — a public address: the one your network shows the internet (IPv4)
Transport
HTTPS, HTTP/1.1, TLS ended at the edge in front of this server
Privacy signals
no Global Privacy Control · no Do Not Track
Referrer
none sent: this browser told the page nothing about where you came from
Every header the browser volunteered (3)
User-Agent
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])
Accept
*/*
Accept-Encoding
gzip, br
After changing a blocker's settings, reload first. In-app browsers (Instagram, Facebook, TikTok) have no blockers and cannot install a DNS profile; open this page in Safari, Chrome or Firefox instead.