← back to the tool honest limits

The Blacklist

Some targets are known not to work, so the tool says so instead of showing a green light it can't honour. Enter one of these and it tells you before it adds anything.

These six are compiled into the app itself and matched by hostname before a page is ever kept — not just written here.

Target	Why refreshing fails
Atlassian Cloud Jira, Confluence	Atlassian counts a session as idle when the user takes no action, and names an automatic page refresh as a passive interaction that does not count. Their docs.
Citrix / NetScaler and anything delivered through it	Client inactivity timeouts key on real mouse and keyboard input. HTTP traffic is invisible to them. We will not simulate input.
Microsoft sign-in Entra / Azure AD endpoints	An identity endpoint is not an application session. With Continuous Access Evaluation a logout is usually a revocation, not a timeout — access tokens there already last up to 28 hours.
Google Workspace Admin	Session length there is an absolute lifetime measured from sign-in, not an inactivity timer.
Microsoft Teams and Webex	Your green dot is computed from device activity, not from any tab. Microsoft keeps you Available while you use the keyboard or mouse anywhere on the machine, and flips you to Away after about five minutes idle or on screen lock; Webex works the same way, and some setups even use the camera. No browser tab is part of that signal. Microsoft's docs.
Okta admin consoles VPN and ZTNA gateways	These end a session when the IP address they see changes. Refreshing keeps the idle clock warm but cannot survive a VPN reconnect or a wifi-to-cellular handoff. Rotating your own IP or MAC would not help either — that is precisely what ends these sessions.

Categories we can't detect by hostname, but that still won't work

PCI-scoped and administrative accounts. PCI DSS 4.0 requirement 8.2.8 mandates re-authentication after 15 idle minutes. That is a compliance control; circumventing it is a problem for your employer, not a feature.
Electronic health records and clinical workstations. HIPAA automatic logoff is typically enforced at the workstation layer, below the browser.
Anything inside a remote-desktop or VDI session. The page is a single video stream to the browser; there is nothing for us to reload.
Apps that don't slide the session on an unmodified request. Django's default (SESSION_SAVE_EVERY_REQUEST = False) computes expiry from the last modification, not the last request — refreshing more often does not help. See the directory for named examples.
Queues, waiting rooms and virtual holding pages. A reload can hand you a fresh position or drop you out entirely — these advance themselves.
Browser terminals and remote-desktop gateways. A reload tears down the live connection and orphans whatever is running.

Two more things worth knowing

A reload discards unsaved work. Form input, in-progress uploads and unsaved edits in that tab are lost. Use this on pages you're keeping logged in, not pages you're typing into.

Idle timeouts often exist for good reason. On banking, healthcare and shared-account systems they're a security or compliance control, and deliberately defeating one may breach the site's terms of service. Check the terms for anything sensitive, and don't leave a session held open on a device other people can reach.

The full directory (131 apps) → How it works → FAQ →