Skip to content
All fingerprint checks
Input & behaviour

A mouse press landed inside the viewport it was delivered to

Pim· Clearcote Research 2 min readCheck id press-inside-viewport

Every trusted press lands within the viewport, allowing a pixel of rounding. N/A under pinch-zoom (severity: warn).

What a detector infers

A physical mouse press lands wherever the pointer is. If the pointer is outside the page's viewport, the press goes to the browser's own interface — the toolbar, a scrollbar — or to another window; it is never delivered to the page. The DevTools protocol has no such constraint: Input.dispatchMouseEvent sends a press at any coordinate, and Chrome delivers it to the page as trusted input even when the coordinate lies past the edge of the viewport.

Measured with Playwright: mouse.click(200, 920) in a viewport 720 pixels high produced a trusted pointerdown at clientY 920, targeted at <html>. So a press whose clientX or clientY falls outside 0 to innerWidth or innerHeight came from a client that does not know where the viewport ends. Only the failing side is measured; the passing side is how pointing devices work.

Pinch-zoom changes the relationship between client coordinates and the visible area, so a zoomed visual viewport is N/A, and a pixel of rounding is allowed at fractional device pixel ratios.

How to resolve it

Press only where the page is: scroll the target into view before clicking, and keep click coordinates within innerWidth and innerHeight. A coordinate past the edge belongs to the browser's interface, not the page.

What is behavioural bot detection?

Nearby checks in Input & behaviour

See all 13 checks in Input & behaviour
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Input & behaviour checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Input & behaviour — the family press-inside-viewport belongs to.