Whoer Results Explained

What goes into the score

The live Whoer site renders results with JavaScript. The archived copy from October 1, 2026 contains the full list of findings in its markup, each with a 10 percent deduction and an explanation. We grouped them by what they actually test:

Which findings real websites care about

Divide the list by what an ordinary website can observe.

Visible to any site. The IP and its labels, any blacklist entry, the browser’s time zone and language, the user agent, and WebRTC behavior can all be read by a site’s server or by a script in the page. These are worth fixing.

Visible only to sites that test for it. A DNS check needs the site to run its own name servers and send your browser to a unique hostname, which is how DNS leak tests work. Most websites never do this, though some fraud tools can. A DNS country mismatch is mostly a privacy issue: the resolver you use learns which sites you visit.

Largely obsolete. Flash, Java applets and ActiveX are not available in current mainstream browsers, so those deductions rarely apply. A Do Not Track style setting has no bearing on how a site classifies you.

Two more points about the score itself. Proxy detected and data center IP take points off whenever the address is labeled, even when everything else is consistent. And the page that produces the score promotes Whoer’s own VPN and multi-account browser, so its advice to prefer VPNs over proxies comes from an interested party. Neither makes the individual findings wrong; it is a reason to read the findings rather than the percentage.

Fixing DNS findings

A DNS mismatch means your device asks a resolver in one country while your traffic exits in another. With a SOCKS5 proxy, let the proxy resolve names. In curl, the socks5h:// scheme asks the proxy to resolve the hostname, while socks5:// resolves it locally first:

curl -x socks5h://USER:PASS@HOST:PORT https://www.coronium.io/api/catalog

Browsers and antidetect profiles have an equivalent option, usually described as sending DNS through the SOCKS proxy. With an HTTP proxy, the proxy resolves the names of the sites you request over it, but other software on the device may still use your local resolver.

Check the result with our DNS leak test, which lists the resolvers your device used and compares their country with your IP’s.

Fixing time zone, language and proxy findings

System time different. Whoer compares the clock your browser reports with the time zone of your IP. Set the browser profile’s time zone to the exit location; changing the whole operating system clock is rarely needed. What is my IP shows the time zone for your current address.

Languages different. Set the profile’s preferred language to one used in the exit country, or at least put it first in the list.

WebRTC and IP addresses different. The browser is revealing another address. RFC 8828 defines how browsers may limit what WebRTC exposes, down to forcing it through the proxy. Confirm with our WebRTC leak test.

Proxy, data center and blacklist. These belong to the address. A different exit is the only fix. With mobile proxies from Coronium, each line is a physical device with its own SIM, rented to one customer, so the address is a carrier one rather than a data center range. If an address shows up on a blacklist, change the IP from the dashboard, the API, a rotation link or the timer, then check again; carrier addresses are shared over time and can carry someone else’s history.

How we checked

On October 30, 2026 the live Whoer homepage answered automated requests with a browser check, so we read the most recent Internet Archive copy, captured on October 1, 2026. That copy includes the complete list of findings with their explanations and deductions, rendered before any test runs, plus the levels of insecurity Whoer uses (low, medium and high). We did not run Whoer against our own lines for this article, and the list can change when Whoer updates its page. If your result shows a finding that is not in the table above, read Whoer’s explanation for it and apply the same test: could an ordinary website see this, and would it contradict the rest of your session?

Frequently asked questions