Skip to content
All fingerprint checks
Input & behaviour

A move only reports a button down after that button was pressed

Pim· Clearcote Research 2 min readCheck id buttons-without-press

Moves that report a held button follow a press of that button in the document. Information only, because drags entering from outside the page do the same (severity: info).

What a detector infers

MouseEvent.buttons on a move reports which buttons are held, and a button can only be held after it has been pressed. For a page that has watched the pointer since it loaded, a move reporting a button down with no matching press in the document is unusual.

A DevTools-protocol client produces it directly: Input.dispatchMouseEvent accepts a buttons bitfield on mouseMoved and Chrome passes it through, so a client that sets it on moves produces held-button moves with no press before them. Measured: a raw mouseMoved carrying buttons 1, with no press, delivered a pointermove reporting buttons 1. It is the mirror of pointer-buttons-during-drag, which fails a drag whose moves report nothing held.

This one is information only, because there are ordinary ways to arrive with a button already down: a drag that started outside the page — in another window or on the browser's own interface — and enters the document held, or a remote-desktop client relaying button state. Only the failing side has been measured.

How to resolve it

Set buttons on a move only between the matching press and release. A held-button move with no press before it describes a drag that never started.

What is behavioural bot detection?

Nearby checks in Input & behaviour

See all 13 checks in Input & behaviour
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Input & behaviour checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Input & behaviour — the family buttons-without-press belongs to.