amazon.com’s bot-check page scored 82 on Inspectrosite

After google.com, wikipedia.org, and hawaii.gov, I pointed Inspectrosite at amazon.com — the address people type. It came back with 82 out of 100, grade B. That number is real, but it isn’t a score of Amazon’s shopping homepage.

Quick disclosure: Inspectrosite is Byteslip’s own free browser tool. The badge above is just a picture of the score from our scan, not proof of anything (anyone can type a number into a badge link). The real record is the scan itself, and you can run it again here.

A redirect, then a bot-check page

We started at https://amazon.com/. Unlike hawaii.gov, which answered with a meta-refresh hop and stayed at the same URL, Amazon sent a normal HTTP redirect to https://www.amazon.com/. Inspectrosite follows those, the same way it did for google.com → www.google.com.

What came back was not the store. Amazon’s edge — CloudFront plus AWS WAF — returned HTTP 202 and a ~2 KB JavaScript challenge page. The response header x-amzn-waf-action: challenge is how we know. That’s ordinary bot protection. Inspectrosite’s fetch goes through Byteslip’s proxy, which doesn’t run that challenge the way a shopper’s browser would, so the scanner scored the challenge page itself.

That page is a small, well-formed HTML document: doctype, lang="en", charset utf-8, a normal viewport meta, an empty <title></title>, a <div id="challenge-container">, an external challenge.js from an *.token.awswaf.com host, and inline JS that calls AwsWafIntegration and reloads. The only heading lives in <noscript>: an <h1> that says “JavaScript is disabled,” plus a short note about verifying you’re not a robot.

It ran 53 checks: 28 passed, 11 warned, 3 failed, and 11 were info only. The HTML came back in 725 ms (including our proxy), the document was 2.0 KB (2007 bytes), and the inventory was 3 scripts (1 external, 2 inline), 0 images, 0 stylesheets, 0 links, 0 forms, and ~0 visible words. Detected tech (info only): Server: CloudFront.

The three fails, in plain language

All three match a nearly empty challenge document whose job is to run a script and reload — not to be a homepage.

1. Missing <title>

   The <title> tag is there, but it’s empty. The browser tab and search results have nothing to show for this page.

2. Missing meta description

   No meta[name=description]. For a challenge interstitial that never meant to be shared or indexed as content, that isn’t surprising — but the check still fails it.

3. 0/4 landmarks (header, nav, main, footer)

   No <header>, <nav>, <main>, or <footer>. A page made of a challenge container and a noscript block doesn’t have that structure.

Eleven warnings, grouped

• Head and social tags: no canonical URL, no favicon link, no theme-color meta, 0/3 Open Graph tags (title, description, image), and no Twitter/X card tag.
• Scripts and text: 1 render-blocking script in <head> (the challenge.js file), and very little visible text (~0 words).
• Security headers on this response: the challenge response didn’t send HSTS, X-Content-Type-Options: nosniff, clickjacking protection, or a referrer policy. That is about this WAF challenge reply — not a claim about Amazon’s real storefront headers.

What looked solid about that small HTML file

82 is a check average, not a grade of Amazon

Inspectrosite’s score is an average of the checks that count: a pass is worth 100, a warning 60, a fail 0, and info checks are left out. So 82 tells you how this one challenge page did on our checklist. It isn’t a grade for Amazon as a company, and it says nothing about shopping on Amazon.com.

Side by side with the earlier notes: google.com scored 75 on the real search homepage; wikipedia.org scored 89 on the real portal; hawaii.gov scored 67 / portal 91 because the short URL was a meta-refresh hop. Amazon’s 82 belongs with that last kind of story: the scanner scored what it was served, which was not the page a shopper sees. Unlike hawaii.gov, there is no second public “real homepage” URL we can scan the same way here — one score, 82, on the challenge page.

Scores change

This is one scan, taken at 2:41 AM Hawaii time (HST) on November 6, 2026. Amazon can change what it serves the proxy, and Inspectrosite gets updates too. A re-scan may still get the challenge, or someday the storefront. Re-scan amazon.com, or try your own site.