location.origin is the serialisation of its own protocol, host and port
Check id location-origin-coherence
What an ordinary browser yields
For an http/https page, location.origin is exactly protocol + "//" + host. Other schemes are not applicable and report N/A.
What a detector infers
An origin is not stored next to a URL, it is serialised from it: for an http or https document, origin is exactly the scheme, followed by two slashes, followed by the host and any non-default port. The browser computes one from the other, so the two cannot drift apart on their own, and reconstructing origin from location.protocol and location.host is a complete test of whether they still agree. It is a cheap check and it catches a narrow but real thing — an origin rewritten by itself, without the scheme and host that produced it being rewritten to match. The check declines rather than fails on schemes where this serialisation does not apply: file:, blob:, data: and sandboxed documents legitimately produce opaque or scheme-specific origins, often the literal string "null", which is correct behaviour rather than a contradiction. Severity is warn, because the surface is narrow.
How to resolve it
location.origin is derived from the URL rather than stored beside it, so it cannot disagree with location.protocol and location.host in a real browser. If they disagree, one of them was written by hand — change the actual URL the document was loaded from instead.
Read in the wild by
Kasada
Reads the URL apart into its pieces rather than taking the origin whole.
window_location_host, window_location_origin, window_location_port, window_location_protocol
Kasada ips.js teardown — the full 427-probe listEvery attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Navigator identity
- navigator.hardwareConcurrency is plausible
hardware-concurrencyThis is an info-severity observation, not a scored failure — it reports navigator.hardwareConcurrency and only notes whether the value is an… - the machine delivers no more parallelism than it claims cores
hardware-concurrency-vs-parallelismThe plain hardwareConcurrency row can only ask whether the number looks sane, because no second API reports a core count. - the Keyboard API's presence matches the claimed engine and form factor
keyboard-api-vs-platformThe Keyboard API — navigator.keyboard, with getLayoutMap and lock — ships in desktop Chromium and nowhere else: not in Gecko, not in WebKit… - browser-brand and context hints agree with a fresh realm
brand-hints-vs-realmSome of the cheapest signals to fake are the ones that say which browser this is: navigator.brave exists only in Brave, window.duckduckgo… - navigator.vendor is the constant the measured engine compiles in
navigator-vendor-vs-enginenavigator.vendor is not a preference or a setting — it is a string constant compiled into the engine. - navigator.oscpu names the same OS family as the user-agent
ua-oscpu-os-family-coherencenavigator.oscpu is a property only Gecko still exposes — Chromium removed it and WebKit never had it — so this check is silent on every… - a worker resolves the same IANA timezone as the main thread
worker-main-timezone-coherenceA browser has one host timezone, and the specification ties both the main-thread global and every worker global to it, so a real browser… - the keyboard layout maps the OEM keys the way one real Windows layout would
keyboard-layout-single-originA keyboard layout is not a set of independent key mappings — it is one artifact the operating system hands over whole.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Navigator identity checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Navigator identity — the family location-origin-coherence belongs to.