Detecting bots on Twitter: how to tell if an X account is a bot

No public tool can prove that an X (formerly Twitter) account is a bot, and the checker most people remember is frozen on data from before 31 May 2023. The closest thing to proof is the "Automated by" label, which an operator sets on a declared bot: when it is there, the account is automated; when it is missing, you have learnt nothing. X's own enforcement marks, such as the "unusual activity" warning on a locked profile, are a second clue. Everything else is probability, and it gets stronger when several behavioural signals agree: the same reply from many accounts, clockwork timing, a timeline of nothing but replies, a join date that does not fit the activity. Numbers in the handle, a missing photo and stiff writing tell you very little.

What actually proves an account is a bot

X shows the public three marks that come from X itself rather than from your own judgement: the automated label, the unusual-activity warning on locked profiles, and visibility labels on posts. Each is useful when present, and none is a complete test, because the first is optional and the other two are not specific to bots.

• The "Automated by" label. It sits under the profile name and handle and names the human-run account responsible. The bot's operator sets it, so it only appears on bots that choose to declare themselves (more on that below).
• The "unusual activity" warning. X's locked and limited accounts page (checked 19 September 2026) says: "If your account appears to have exhibited automated behavior that violates the X Rules, we may lock it and request that you pass a captcha challenge to confirm you are not a robot." It adds: "If your account is in this state, people who visit your profile may see a message letting them know the account has displayed unusual activity and asking them to confirm they still want to view it." The same page says a locked account "may be compromised", so the warning means X has flagged the account, not necessarily that a script runs it.
• Limited-visibility labels on posts. X's enforcement options page (checked 19 September 2026) says: "Starting in April 2023, posts identified as violating our Rules will begin to receive labels informing both post authors and viewers that we limited the post's visibility." A label like that tells you X judged that post against a rule. It does not tell you which rule, and most rules have nothing to do with automation. Restricted reach in general is covered in the shadowban guide.

What the "Automated by" label means

The "Automated by" label is a self-declaration by the operator of an API bot. X's automated account labels page (checked 18 October 2026) defines the accounts it covers: "Automated accounts (often referred to as "bots") perform programmed actions through the X API." It continues: "Our Automation rules require these accounts to display labels and remain connected to a human-run account." And: "When an account displays the "automated" account label you know the account is not human-run." A label you can see is the one piece of near-certain evidence on the platform.

The label is still described as an experiment. That older page talks about accounts accepting an invitation to a "test group". X's newer profile labels page (checked 18 October 2026) says the label is "currently in testing" and words its promise differently: "When an account displays the "automated" account label you know the account is generating automated content not produced by a human." Its example is a local weather account labelled "automated by @sweetsuzzie".

Why a missing label proves nothing

• It is opt-in. X's 2022 developer announcement (checked 18 October 2026) introduced "a label for automated accounts to self-identify as bots", set by the operator in settings under Your account, Your account information, Automation, Managing account. An operator who wants to pass as human simply never sets it.
• It only describes API bots. X's definition is accounts acting "through the X API". Accounts scripted through the website fall outside it, and the automation rules (checked 19 September 2026) list that method under "Don't": "Use non-API-based forms of automation, such as scripting the X website. The use of these techniques may result in the permanent suspension of your account." The accounts with the most to hide have the least reason to declare anything.
• It does not behave reliably even for honest operators. On X's developer forum, users report a label that appeared and then disappeared and labels they could not turn off (both checked 18 October 2026). These are user reports, not an X statement, but they are enough to stop you treating the label as a register.

Signals that actually mean something

The signals worth your time describe behaviour across time and across accounts, not how one profile looks. That matches how X frames the problem: Twitter's 2020 "Bot or not" post (checked 18 October 2026) says "our policies in this area focus on behavior, not content", and lists malicious automation, multiple or overlapping accounts, fake engagement, bulk or aggressive posting, following and engaging, and hashtag cramming as the problems.

Roughly in order of how much they tell you:

1. The same reply from many accounts. Identical or lightly reworded text under one post, from accounts that otherwise have nothing in common, posted within minutes of each other. One account cannot produce this pattern; it takes a group, and that is the coordination X's rules target.
2. Clockwork timing. Posts spaced at regular intervals at every hour of the day, with no gap where a person would sleep. Timing regularity was one of the indicators proposed in a 2012 paper by Chu and colleagues, summarised on Wikipedia's Bots on X page (checked 18 October 2026).
3. A timeline that is only replies. Open the Replies tab. A long run of replies to large accounts, no original posts and no reply that continues a conversation is what a reply bot leaves behind.
4. A join date that does not fit. A recent account posting at full volume from its first days, or an old account silent for years that suddenly replies on one topic all day. The second pattern can also be a sold or recovered account, so treat it as a question rather than an answer.
5. Replies that ignore the post. Generic praise, a link or a pitch that would fit under any post. X's automation rules say "sending automated replies to posts based on keyword searches alone is not permitted", and keyword matching is exactly what produces replies that miss the point.
6. Repetition in its own posts. The same sentence, link or block of hashtags again and again. Bulk posting and hashtag cramming are both on X's 2020 list.

One signal is a hunch. Several that agree, ideally including one of the first two, is a fair basis for blocking. None of it is proof, because X does not publish how its own detection works.

A quick manual check

1. Open the profile. Look under the name for an "Automated by" label, and note whether X showed an unusual-activity warning before the profile loaded.
2. Note the join date and compare it with how much the account posts.
3. Open the Replies tab and scroll a few screens. Look for repeated sentences, repeated links, and replies that ignore what they answer.
4. Copy a distinctive phrase from one of its replies and search X for it in quotation marks. Finding the same text from other accounts is the strongest signal on this list.
5. Look at the timestamps across a screen of posts. Regular spacing through the night counts; one busy evening does not.
6. Run a reverse image search on the profile photo. A stock or stolen photo points to a fake persona, which is a separate problem from automation (see below).

Weak signals: numbers in the handle, no photo, stiff writing

Profile cosmetics are the weakest evidence you have, and they are what most checklists lead with. Numbers in the handle, no photo, few followers and stiff writing describe ordinary people as often as bots, so on their own they should not change your mind about an account.

Bot, fake persona or coordinated campaign

In everyday speech "bot" covers three things that X's rules treat separately: automation, fake personas and coordinated inauthentic activity. An account can be any one without the others. A fake persona typed by a person is not automated, and a declared weather bot is not fake, which is why automation checks alone miss much of what people mean by a bot.

• Automation. The authenticity policy (checked 19 September 2026) names "Unauthorized automation: Automated or scripted accounts that do not comply with our Developer Policy." The Developer Policy (checked 18 October 2026) adds: "The use of the X API and developer products to create spam, or engage in any form of platform manipulation, is prohibited."
• Fake personas. Manufactured identities used to deceive. The policy says: "This may include using stock, stolen or AI-generated profile photos, copied or stolen profile bios, and/or misleading profile information for the purpose of deceiving others."
• Coordination. "We prohibit coordinated inauthentic activity that artificially influences conversations or disrupts X." This is the group pattern behind identical replies, whether a script or a room of people produces them.

For deciding whether to block or report, the category matters less than the behaviour. For making sense of a sudden wave of replies on one topic, coordination is often the more useful question than automation.

Which Twitter bot checkers still work in 2026

Most bot checkers named in older articles stopped working when Twitter ended free API access for third-party developers in 2023. As of 18 October 2026, Botometer only returns frozen scores from data collected before 31 May 2023, Bot Sentinel's homepage, as last indexed, shows a relaunch page whose date has passed, and the free checker described below publishes no accuracy figure.

Botometer announced the cause in May 2023: "Twitter is in the process of suspending free API access for third-party developers. This means that Botometer will stop working in the coming days."

Did Elon Musk get rid of the bots on X?

Not completely, and nobody outside X can measure how far the cleanup has gone. Musk promised to "defeat the spam bots or die trying" before he bought Twitter in 2022. Since then X has announced large removals, while a peer-reviewed study reported more bot accounts after the takeover, not fewer. The dated record, from press reports:

What share of X accounts are bots?

There is no reliable public figure. As TechJuice recounts, Twitter long said fake accounts were under 5% of monetisable daily active users, and Musk's team claimed about 33% during the deal. Both are claims from parties to a dispute, and the higher percentages circulating in other articles have no clear source.

Why big accounts attract so many bot replies

A reply under a large account's post sits in front of that account's audience, which is why reply spam clusters there. The rules close the obvious routes: keyword-triggered automated replies are not permitted, and "the deployment or operation of any AI reply bot requires prior written and explicit approval from X." The October 2025 removal and the January 2026 InfoFi cut were both aimed at reply spam, as reported. Which replies the rules allow is set out in the reply bots guide.

Why your follower count dropped suddenly

A sudden drop in followers during a crackdown often means X has locked accounts that followed you, not that people decided to leave. X's enforcement options page (checked 19 September 2026) says: "Note that when an account has been locked pending completion of a challenge (such as being required to provide a phone number), it is removed from follower counts, Reposts, and Likes."

The wording ties the removal to the lock, so an account that later clears its challenge may count again. If you want names rather than a total, the options and their limits are in how to see who unfollowed you on X.

What to do about a bot, and how not to look like one

Once you have decided an account is probably a bot, the useful actions are mute, block and report, all from the menu on the post or the profile. Which one depends on whether it is just noise or is aimed at you.

1. Mute it if it is only noise in your replies. You stop seeing it, and it is not told.
2. Block it if it targets you, your posts or your DMs.
3. Report it as spam if it posts repetitive, coordinated or deceptive content. A report puts the account in front of X's enforcement, the only process that can lock or suspend it.
4. Do not open links in bot replies or DMs, and do not answer a DM from an account you suspect.

If you run several accounts, the same signals apply to you

X does not publish its detection rules, but its policies are written about behaviour, so the signals above are a fair list of what to avoid: identical or near-identical replies across your own accounts, posting on a fixed clock, reply-only timelines, a new account at full volume in its first days, and several accounts behind one exit IP. Automated likes are prohibited outright: "You may not like posts or hide replies in an automated manner." The patterns that get accounts caught are covered in why X accounts get suspended, and if one of yours already shows the unusual-activity warning, read what to do about a lock before you touch it again.

For context on where this blog stands: flottra runs X accounts from a real browser per account on the customer's own Windows computer, does not use the X API, and holds new accounts to a warming ramp by age, starting at 3 actions a day, likes only, for 3 days. It is not a bot checker, does not check other accounts, and does not promise that any account will avoid a lock or suspension.