Keyboard Layout Leak

Detection approach

Empty keyboard layout map on desktop environment. Headless setups or virtualized servers (like Linux/Docker runners) report size 0, whereas physical desktop systems expose mapped layouts.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Users with high security blocks or using custom OS partitions with disabled layout queries.