Every night, and after every change we ship, an automated test suite drives the live platform the way a real person would: signing in, opening pages, checking that what we claim works actually works. One day last month it suddenly could not. Every automated browser was refused at the front door, from two different networks, with no setting changed by anyone.
The culprit turned out to be our hosting platform's own automatic bot defence. From its point of view, dozens of headless browsers hammering the same site all day looks exactly like an attack, because usually it is one. It armed itself, and it was right to.
The part worth sharing is what it did not block. Real browsers were unaffected. Search crawlers were unaffected. Nobody using the platform saw anything at all. The defence identified precisely the traffic that behaves like automation and nothing else, which is what you would hope for and rarely get to verify.
We now carry a narrow, revocable exemption for our own test traffic, created deliberately and on the record, and we left the defences on. A platform that verifies itself this aggressively was always going to trip an alarm eventually. Better to be the platform that trips alarms than the one that never tests.