@esoteric_programmer sec-fetch-mode is another HTTP header that Chrome & Firefox send, whenever they're requesting something over HTTPS.

If the header is not present while the user-agent suggests it's Chrome or Firefox, the likelyhood of it being a bot is extremely high.

The only exception I know of is the scenario in which someone puts a page into Reader Mode under Firefox and reloads it while in reader mode - that ends up with Firefox not sending the sec-fetch-mode header for some odd reason. Restoring a saved session with tabs in Reader Mode suffers from the same problem, that restore is essentially a reload.

This... doesn't happen often. I know of one case where it caused problems, and we quickly found a workaround: leave reader mode, reload, get back into reader mode. I've been keeping an eye on my logs since, and in the past month or so, I couldn't find any case where the browser was Firefox, and without a sec-fetch-mode header, and wasn't a bot (I have other indicators that let me decide this, but those require my particular setup).

In short: the risk of this affecting humans is not zero, but very tiny, and there's a workaround. One can serve them a page in that case describing the workaround.