The same request, twice. Once with a referer, once without. One key.
List price of the calls that succeeded, at each SKU’s per-1,000-events rate. Google does not bill rejected requests, so the blocked column is free — and every SKU below has a monthly free allowance, so a demo run typically costs nothing at all. This is what the traffic would be worth at volume, not an invoice.
Nothing is requested until you press Run all.
A row only demonstrates a bypass when the baseline is blocked and the bypass loads. Any other pairing is inconclusive.
POSTs to this site’s own /api/echo endpoint twice and prints the
Referer and Origin headers it actually received. Watch what
the opt-out does and does not remove: Origin is a forbidden header name,
so a page can never suppress it — only a plain <img>, which
never sends one, avoids it. It is same-origin, so it echoes a full URL where a
cross-origin request would send only the origin; the point is the presence and absence
of each header, not its value. DevTools › Network remains the authoritative check.