Explainer
How ATS Systems Detect and Flag Automated Job Applications
Published . Last updated
Short answer: nobody at the company reads your application and decides a robot sent it. The decision happens earlier, at the edge, in milliseconds, and it is mostly arithmetic. Five layers score the request before an applicant tracking system is involved at all: the address it came from, the TLS handshake that opened the connection, the automation flag the browser exposes, the shape of the browser itself, and how fast that address is submitting. Cloudflare turns those signals into one number from 1 to 99, and a site can block or challenge anything in the 1 to 29 band without a human ever looking.
The cheapest of those five is the first one. Every major cloud publishes the exact address ranges it owns, so a request from a rented server identifies itself for free. That is the layer ApplyLoop removes: it runs on your own Mac and submits from your home broadband, at 30 to 60 applications a day across 7 job sources. The rest of this page is the other four layers, including the one we do not claim to solve.
10,545
IPv4 ranges AWS publishes as its own, on 1 October 2026
1 to 99
The band a Cloudflare bot score falls in, where 1 to 29 reads as automated
5
Layers that score you before a recruiter sees your name
30 to 60
Applications ApplyLoop submits a day, from your own Mac
Files counted and vendor pages read on 1 October 2026.
The five layers, in the order you hit them
What each layer can observe, and what it sees depending on where the software applying for you actually runs.
| Layer | What it checks | Cloud apply bot | ApplyLoop on your Mac |
|---|---|---|---|
| 1Where the request comes from | The IP address, matched against published data center ranges | A rented server inside a range the provider lists in a public file | Your home broadband line, which appears on no such list |
| 2How the connection is made | The TLS handshake, fingerprinted before a single byte of the form loads | The fingerprint of an automation stack, identical across every user of that tool | The handshake of the Google Chrome already installed on your Mac |
| 3Whether the browser admits it is automated | navigator.webdriver, a flag the HTML standard requires browsers to expose | True, unless the vendor patches it, which is itself detectable | The same problem. We do not claim to solve this layer |
| 4What the browser looks like | Screen size, GPU, fonts, plugins, timezone, language | A bundled headless build with a thin, repeating, often contradictory profile | Your real Chrome on your real display, because it is literally your browser |
| 5How the human behaves | Typing cadence, time on page, submissions per hour from one address | Hundreds of submissions an hour, fields filled instantly, no dwell time | 30 to 60 a day, paced, spread across hours |
Past the edge, the hiring system checks the address again
The five layers above sit in front of the form. When this page was first written, that was the only part anyone outside could document. It no longer is. Greenhouse now offers a Fraud Detection feature on its Plus and Pro tiers: a third party service analyzes the phone number, email address, location and IP address of each candidate, and the example Greenhouse gives for a high risk signal is “the IP address being linked to a data center”. Ashby released fraud checks on device, IP, email and phone to all of its customers in September 2025.
This check is different in kind from the edge. The fraud report does not block anything by itself. It puts a warning next to a name and leaves the call to a recruiter, and Greenhouse says in the same article that the signals are not a definitive assessment. The one automatic part is separate: an employer on Greenhouse can keep its own blocklist that rejects applications from the addresses it has listed. So an application sent from a rented server can clear all five layers, arrive, and still carry the mark that layer 1 was looking for. The full account, including what it means for a VPN, is in can employers see your IP address.
Why a flagged application feels like nothing at all
A rejected application sends an email. A blocked request does not. When bot management challenges or drops the submission, the form never reaches the applicant tracking system, so there is no record to reject, nobody to notify, and no difference you can observe between an application that was screened out by a recruiter and one that never arrived. This is the honest reason it is hard to prove any of this from the outside, and it is why the only trustworthy evidence is the confirmation page itself.
ApplyLoop treats that as a product requirement rather than a detail. A submit click is not a submission. Every application is verified against the confirmation the site actually returned, and the screenshot arrives on your phone through Telegram. When something fails, you get a named error instead of a silent gap in your week.
What we do not claim
Layer 3 is real and we have not defeated it. The HTML standard requires a browser to report when it is being driven by automation, and any tool that fills a form for you is driving a browser. Patching that flag away is itself a detectable act, so we would rather be straight about the limit than sell a stealth story.
What ApplyLoop does instead is refuse to be suspicious on the layers that are cheap to check. It drives the Google Chrome already installed on your Mac rather than shipping a headless build, so layers 2 and 4 see a genuine consumer browser on a genuine display instead of an emulated one. It applies from your address, so layer 1 finds nothing. It paces the work across the day, so layer 5 finds nothing. That is four of five, earned rather than faked.
Sources
- Cloudflare, Bot scores
Requests are scored 1 to 99. Scores of 1 to 29 read as automated or likely automated, and rules can block or challenge on that score alone, with no human review.
- WHATWG HTML Standard, navigator.webdriver
The web standard itself requires a browser to report when it is under automation control. The flag exists by design, which is why layer 3 is honest work rather than a solved problem.
- FoxIO, JA4+ TLS fingerprinting
An open standard for fingerprinting a client from its TLS handshake. This is how layer 2 identifies an automation stack before any page content is exchanged.
- Amazon Web Services, public IP ranges
One file listing every range AWS owns: 10,545 IPv4 and 6,911 IPv6 prefixes when we counted on 1 October 2026. On 21 August 2026 the same file held 10,668 and 6,160, so the IPv4 count went down while the IPv6 count went up. The file is regenerated constantly, which is why a lookup against it stays accurate.
- Google Cloud, public IP ranges
The same thing from Google: 1,012 IPv4 and 95 IPv6 prefixes on 1 October 2026.
- Greenhouse Support, Fraud Detection
Updated 20 August 2026, read 1 October 2026. Plus and Pro tiers, with reports that run automatically on Pro. A third party service analyzes phone number, email address, location and IP address, and a data center address is the example given for a high risk signal. The article says fraud signals are not a definitive assessment of a candidate.
- Greenhouse Support, Fraud Detection and Spam Blocklist: Security and Privacy FAQ
Updated 13 January 2026, read 1 October 2026. States that the Fraud Detection feature makes no automated rejection decision, and describes the separate blocklist, managed by the employer, that can reject applications from listed IP addresses at intake.
- Ashby, Introducing Fraudulent Candidate Detection and Management
16 September 2025, read 1 October 2026. Released to all Ashby customers, switched on per job by the employer. Applicants are run through fraud checks as they apply, using signals related to device, IP, email and phone, and the recruiter makes the determination.
- OWASP, Automated Threats to Web Applications
The industry catalogue of automated abuse patterns that bot management products are built to stop. Job application automation is not on the list, but it arrives looking like everything that is.
Questions people ask
How do ATS systems detect bots?+
Mostly before the applicant tracking system is involved at all. Bot management sits in front of the form and scores the request on signals it can read without cooperation: the IP address, the TLS handshake, the automation flags the browser exposes, the shape of the browser itself, and the pace of submissions from that address. Cloudflare scores every request from 1 to 99, and a site can block or challenge on scores in the 1 to 29 automated band without a human ever looking.
Will my application get rejected if I use an AI job application tool?+
It will rarely be rejected in a way you can see, which is the actual problem. A low bot score can be blocked or challenged at the edge, so the submission never becomes an application and you get no bounce, no rejection email, and no way to tell the difference between being screened out and never arriving. That is why ApplyLoop verifies and screenshots every confirmation page instead of assuming a submit click worked.
Does the automation flag give ApplyLoop away?+
It can, and we would rather say so than pretend otherwise. Any tool that drives a browser has to contend with navigator.webdriver, which the HTML standard requires browsers to expose while under automation, and patching it is itself a detectable act. Our position is that the flag is one signal among several and the cheapest, most reliable one is the address. We did not find a trick that beats bot detection. We moved the software to the machine that was never suspicious to begin with.
Does applying from home actually help?+
It removes the single most reliable input to the score. Amazon Web Services publishes every address range it owns as one downloadable file, 10,545 IPv4 prefixes on 1 October 2026, and Google Cloud publishes 1,012 more. Recognizing a data center request is a file lookup anyone can run for free. Residential addresses are not on those lists, because there is no list to be on.
Does the applicant tracking system itself check where an application came from?+
Two widely used ones say so in their own documentation. Greenhouse offers a Fraud Detection feature on its Plus and Pro tiers in which a third party service analyzes the phone number, email address, location and IP address of a candidate, and its example of a high risk signal is "the IP address being linked to a data center". Ashby released fraud checks on device, IP, email and phone to all of its customers in September 2025. Neither rejects anyone automatically on that report: the signal is shown to a recruiter, who decides. Not every employer turns the feature on, and nobody outside can tell which ones have.
Is applying faster better?+
No. Volume from one address is itself a signal, and it is the one signal a cloud applier cannot hide by buying better infrastructure. ApplyLoop paces at 30 to 60 applications a day across 7 job sources rather than burning through hundreds in an hour, because the second pattern is what the fifth layer is looking for.
Related reading: cloud job application bots compared with a local Mac, which puts the same mechanism side by side against the tools that rent a server to apply for you.
Apply from the one address nobody flags
ApplyLoop installs on your Mac, learns your profile, and starts applying tonight. Every submission arrives with a screenshot.
Get Started