Fifteen of Loghound’s 26 rules are weighted below 80. None of them is enough for a bot verdict alone; they are built to add up, so a scraper that leaves no single decisive mark is still caught by three weak ones.
Example: no sub-resources 25 + no conditional requests 30 + got a 403 40 = 95, a bot. The eleven decisive rules are on Rules decisive alone.
A Chrome User-Agent arrived without Chrome’s own client hint, or with one that contradicts it. Needs the header logged. Weighted 75, but a contradicted User-Agent always makes the verdict bot.
The platform client hint disagrees with the operating system the User-Agent claims: Windows in the User-Agent and Linux in the hint is a headless container in disguise. Always makes the verdict bot.
An HTML page was served with a 200 to a client claiming a real browser, and no beacon ever arrived, on a site where the beacon is known to be installed. Without that last condition every visit to a site without the snippet would be accused. Blockers such as uBlock Origin produce this from real people, which is why it is below 80.
Every request matched an attack pattern or a well-known admin path, the server answered none with a body, and the client fetched no stylesheet, script, font, image or favicon. A person whose browser lands on a 404 still renders the error page.
Five or more page and endpoint requests, at least half refused, with only occasional success: something trying paths until one works. Images and other assets are not counted, nor are sign-in and rate-limit refusals.
A consumer browser User-Agent arriving from hosting address space. VPNs and company networks look like this too, so it only counts when stacked.
Ten or more different User-Agents came from this one address within 24 hours, outside a mobile carrier, and it is not a crawler that passed its reverse DNS check. One machine pretending to be many browsers. The minimum of ten can be raised as scoring.ua_rotation_min_uas (never below 3).
Four or more gaps between requests, a median gap of at least one second, and a spread under ten per cent of that median. People are not metronomes.
Your site answered this client with 403 Forbidden and no attack pattern explains it. A captcha wall or an address rule can refuse a person too, so it never convicts alone.
The beacon ran, the visit ended, and not one scroll, click, key press or touch happened. Possible for someone reading on a still screen, which is why it is 40.
A User-Agent claiming a desktop operating system, arriving from mobile network address space. A laptop tethered to a phone looks exactly like this, so it only counts when stacked.
At least two assets were fetched again with no conditional header, on a site known to answer “not modified” at all. A browser cache would have asked.
HTML was fetched and not one stylesheet, script, font or image followed. A warm cache or a text-only browser can look the same.
One page, gone in ten seconds or less. Weak on purpose: plenty of people bounce. It pushes a visit that already has other signals over a threshold.
The browser’s time zone disagrees with the one the address points to. The weakest signal there is: a VPN, a traveller, a clock set by hand or a wrong address database all look like this. It backs up other evidence and can never hold a visit back on its own.