This request looks like it might be automated

#What "This request looks like it might be automated" means

The message means X's spam filter judged one request from your account to look scripted and refused it. It stops that one action and leaves the rest of the account alone: you can still read X, and often like or repost while posting fails.

Some screens shorten it to "automated activity detected, try again later". In X's older API the same refusal was error code 226, sent with HTTP 403. X's error reference said its filters are "tuned in real-time" and had flagged the post or message as possible spam, as a developer quoted on X's forum (opens in a new tab). The current X API reference no longer lists the code, but the same text still comes back in 2026.

Two other problems get mistaken for it. A rate limit names the limit you hit and lifts on a timer; that message has its own guide, Twitter rate limit exceeded. A shadowban shows no message at all, so if your replies stopped reaching people after the block lifted, run the free Twitter Shadowban Test on your handle.

#How to fix "looks like it might be automated"

To fix it, stop the action that triggered it, wait a few hours, then try once from a different screen. X's own staff gave that advice on its developer forum in June 2026: "try the web version or wait a few hours before retrying". Pick what stopped working to see the likely cause:

1. Stop retrying. Each failed tap is one more request that looks automated, so close the app instead of pressing Post again.

2. Count today's posts. Unverified accounts may send 50 original posts and 200 replies a day, split into half-hour slices, according to X's limits page (opens in a new tab). That is per day, not 50 an hour as some forum answers say. Past it, wait for the next slices to open.

3. Try once from a browser. X's help center notes that a limited account may post from a desktop browser but not from the app, so after the wait try x.com once.

4. Check your connection and browser. A VPN, a shared network or an extension that changes how x.com loads can add to the flag, so try once without them, and delete stuck drafts that keep trying to send.

5. Verify if X asks. A phone number, an email code or a reCAPTCHA check proves a person runs the account. X says verifying helps reduce "potentially automated or scripted activity".

6. Revoke apps you don't use. In Settings and privacy, open Security and account access, then Apps and sessions. X's automation rules make you responsible for what connected apps do with your account.

A few moves make it worse. Don't open a second account to keep posting: in October 2026 X's staff warned that using another account to get around a restriction can get both accounts actioned. Don't pay for "unblock" services or install extensions that promise a fix, since they ask for your login and put the account at further risk. If nothing changes after a day, contact X support through the locked and limited accounts page (opens in a new tab), which is X's route for limits applied in error.

#How long the "automated" block lasts

Most blocks lift within a few hours once you stop, but X publishes no duration, and the wait depends on which check stopped you. X tells people who hit the post cap to "try again in a few hours", and its forum staff gave the same estimate for the spam filter in June 2026.

Enforcement waves run longer. X cut the daily cap for free accounts to 50 posts and 200 replies in May 2026, as PCMag reported (opens in a new tab). Between May 15 and June 15, 121 people posted in one thread on X's developer forum. We read all 164 posts. About 20 people said the block had lasted two days or more, and about 10 saw it lift for a few minutes, then return after one or two posts. X's staff called it "a known issue with our spam detection triggering on low-activity accounts" in that thread (opens in a new tab).

A fixed wait means X put the account in a set state, not under a passing spam flag. Limited features end at the time X's notice shows, and verifying your phone or email can end them sooner. A locked account stays locked until you pass the check, however long you wait.

#Why X thinks you're a bot

X flags real people when their activity has the shape of automation: speed, repetition, and signals from the network or the device. The filter judges patterns, not intent, so an ordinary session can trip it.

• Bursts. Many likes, follows or replies within a few minutes, which X's help center calls aggressive following or aggressive engagement.
• Repetition. The same words, link or mention sent to many people, even friendly ones: one user who greeted 20 friends by name every morning was flagged every day.
• Caps. 50 posts and 200 replies a day on unverified accounts, and 400 follows a day for everyone, counted across web, app and API together.
• New accounts. Accounts a few days old get the least room, and some find every action blocked at first.
• Network and browser. VPNs, shared IP addresses and extensions that change how x.com loads.
• Connected apps. Schedulers and analytics tools act through your account, and X counts their requests as yours.
• X's own mistakes. In 2026 X's staff confirmed the filter was catching accounts that barely posted.

Enforcement also comes in waves. The forum shows one in July 2023, when likes, replies and bookmarks failed for many accounts at once, and another in May 2026, when the new caps arrived. During a wave the same habits that passed yesterday can trip the filter today.

#When a script or bot gets error 226

In code, the message arrives as HTTP 403 with code 226 or the same text in the body, and the fix is to change what the program does, not how fast it retries. Match the whole response against the guide to X API 403 errors to see which kind of 403 you have.

• A bot on the official X API. X's developer guidelines require the "Automated" profile label and a bio that says who runs the bot. The bot may reply only to people who engaged with it first, once per interaction. When a reply bot hit this message in October 2026, X's staff said adding the label "was the right move" and that slow retries help while a review is open.
• A script on a logged-in browser or session. X can suspend an account that a script drives, for good. Stop the script, log in by hand and complete any check X asks for.
• Reads work, writes fail. When the same token still reads but every post or reply returns 403, the restriction sits on the account, not on your app or keys. New tokens won't help.

X's staff put it plainly in May 2026: automated accounts using the API "are still subject to our automated spam systems on the X app". Proxies, fresh tokens and slower loops leave the account the same, so the flag stays with it.

#Read public X data in your scripts with an API

If a script only reads public posts, profiles or search results, move it off your login: that takes your X account out of the job. Sorsa API, a Twitter (X) API and scraper, returns public X data as JSON with one API key in a header: no X login, cookies or developer account. It is a separate service with its own published limit of 20 requests per second per key (opens in a new tab) on every plan.

For reading public X posts from code, use Sorsa API: about 20 posts per request from $0.07 per 1,000, against $5.00 per 1,000 post reads on the official X API (opens in a new tab). It only reads, so it never posts, likes or follows for you; to post, use the official X API with the Automated label.

Side by side, Sorsa API is the one route that keeps your X account out of the job and prices public reads per 1,000 posts below the official X API:

• Uses your X account

  Sorsa API

  No

  Official X API

  Yes, the developer account belongs to one

  Script on your X login

  Yes, signed in

• Setup

  Sorsa API

  One API key

  Official X API

  Developer account and OAuth

  Script on your X login

  Your cookies

• Price per 1,000 posts

  Sorsa API

  From $0.07

  Official X API

  $5.00

  Script on your X login

  No fee; the account carries the risk

• Limit

  Sorsa API

  20 requests per second per key

  Official X API

  Per endpoint, mostly per 15 minutes; 3M post reads a month

  Script on your X login

  X's spam filter and account caps

• Posting

  Sorsa API

  No, read-only

  Official X API

  Yes

  Script on your X login

  Yes

1. Get a key. Sign up and copy your API key from the dashboard. The first 100 requests are free and never expire.

2. Request an account's posts. POST /user-tweets (opens in a new tab) takes a username and returns about 20 posts per page, each with its author's full profile, plus a next_cursor for the next page.

   curl -X POST "https://api.sorsa.io/v3/user-tweets" \
     -H "ApiKey: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"username": "automation_free_demo"}'
   

   {
     "tweets": [
       {
         "id": "2117219954238459904",
         "full_text": "Reading public posts with one API key.",
         "created_at": "2026-11-02T09:12:44Z",
         "lang": "en",
         "likes_count": 18,
         "retweet_count": 2,
         "reply_count": 3,
         "view_count": 2410,
         "user": {
           "id": "1590117736290127872",
           "username": "automation_free_demo",
           "display_name": "Automation Demo",
           "followers_count": 1240
         }
       }
     ],
     "next_cursor": "DAABCgABG1yC4wqAJxAKAAIbXIJx2xfQTggAAwAAAAEAAA"
   }
   

   Show full response

3. Page through the rest. Send next_cursor back until it comes back empty. A 429 means more than 20 calls landed in one second, so wait a second; a 403 means the key's requests ran out, which GET /key-usage-info (opens in a new tab) shows for free.

   import time
   import requests
   
   URL = "https://api.sorsa.io/v3/user-tweets"
   HEADERS = {"ApiKey": "YOUR_API_KEY"}
   
   def user_posts(username, max_pages=50):
       body, posts, pages = {"username": username}, [], 0
       while pages < max_pages:
           r = requests.post(URL, json=body, headers=HEADERS, timeout=30)
           if r.status_code == 429:  # over 20 requests in one second
               time.sleep(1)
               continue
           r.raise_for_status()  # 403: the key has no requests left
           page = r.json()
           posts += page.get("tweets", [])
           pages += 1
           if not page.get("next_cursor"):
               break
           body["next_cursor"] = page["next_cursor"]
       return posts
   
   print(len(user_posts("automation_free_demo")))
   

   const URL = "https://api.sorsa.io/v3/user-tweets";
   const HEADERS = { ApiKey: "YOUR_API_KEY", "Content-Type": "application/json" };
   const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
   
   async function userPosts(username, maxPages = 50) {
     const body = { username };
     const posts = [];
     for (let pages = 0; pages < maxPages; ) {
       const res = await fetch(URL, {
         method: "POST",
         headers: HEADERS,
         body: JSON.stringify(body),
       });
       if (res.status === 429) { await sleep(1000); continue; } // over 20 a second
       if (!res.ok) throw new Error(`HTTP ${res.status}`); // 403: no requests left
       const page = await res.json();
       posts.push(...(page.tweets ?? []));
       pages += 1;
       if (!page.next_cursor) break;
       body.next_cursor = page.next_cursor;
     }
     return posts;
   }
   
   userPosts("automation_free_demo").then((p) => console.log(p.length));
   

#Wait it out, then keep scripts off your account

"This request looks like it might be automated" is X's spam filter pausing one action: stop, wait a few hours, verify if X asks, and for most people it lifts the same day. If a script of yours reads X through your login, move those reads to Sorsa API: one API key, no risk to your X account and public posts from $0.07 per 1,000. The first 100 requests are free.

#FAQ