Audio Suspend Bypass

Detection approach

AudioContext state leak: AudioContext.state is active immediately on creation without user interaction. Genuine browsers auto-suspend AudioContext until user interaction to conserve energy and prevent autoplay, whereas headless browsers lack this power management layer.

How this helps detect bots

Collect this signal alongside session context, request metadata, and other independent indicators. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

None. Modern browsers enforce autoplay policy and suspend audio contexts natively.