Method

How we check games

Before a game is listed on ArcadeIndex, our verifier opens it in a sandboxed test browser and looks up its web addresses with Google Web Risk for malware and phishing. Games that play here must load and draw a picture inside our frame; the rest link to the developer's site. Listed games are re-checked every 3 to 6 days.

A game that fails is not listed, and a listed game that starts failing is hidden. Below is each step, the numbers so far, and what the checks cannot catch.

Step 1: Screening before we open the game

Games come from a small set of sources we have reviewed and from developers who submit a game. Before our browser opens a game we check its address against our blocklist and look it up with Google Web Risk for malware, phishing and unwanted software. For games we find ourselves, we also read the site's robots.txt and stay away when it asks crawlers to. Submitted games also go through phishing rules and a rate limit. Our crawler page says how the crawler and verifier identify themselves.

Step 2: Opening it in a test browser

The verifier loads the game in a fresh Chromium browser context at 1280 by 720 pixels, with all permissions and downloads denied and requests to private network addresses blocked. It takes pictures of the screen 5 and 12 seconds after the page loads, then clicks the middle of the game, presses Space and Enter, and takes another at 15 seconds. When the game shows a real loading screen it waits longer, up to 90 seconds in all.

A game passes when the picture is not blank: at least 2% of it differs from the main colour, at 12 seconds or after our input. We record whether it moves or reacts to the input, and a game that does neither scores lower. It fails when the page does not load, returns an error, takes more than 3 redirects, is a parked domain, stays blank, or throws more than 5 errors and shows nothing.

Two kinds of game are listed without this picture test. Games on the portals we only link to (crazygames.com, poki.com, gamejolt.com, newgrounds.com, playgama.com) are checked for liveness and safety: the page must answer without an error and pass the malware checks, but we never frame them or judge their picture. Games that ask for WebGPU, which our test browser does not have, can stay blank for us; if they show no other fault they are listed with a link to the developer's site.

Step 3: Malware and phishing checks

Every address in the game's redirect chain, and any frame it loads, is looked up with Google Web Risk. While the game runs we look for known crypto-miner scripts, attempts to download files, and password fields in forms that send to another site. Any of these fails the check, so the game is never listed. A game that copies text to the clipboard is flagged for a person to review.

Step 4: Checking it can play here

A second run loads the game inside exactly the sandboxed frame and security policy our game pages use, from a separate address. If it plays there, it plays on ArcadeIndex, marked Checked playable. If the site forbids framing, the game breaks out of the frame, or it needs pop-ups, it is listed as Plays on dev site with a link to the developer's page. Portal games and games that need WebGPU skip this run and are always listed as Plays on dev site. A game is only framed from HTTPS addresses that are not ours, and our pages allow frames only from the exact addresses the check saw.

Content ratings

Every game gets a content rating (Everyone, Everyone 10+, Teen or Mature) from its description and tags. A word list sets a minimum: for example, blood raises a game to at least Teen, and gore to Mature. When we are not confident, the rating is raised one level. Mature ratings, real-money gambling, user chat and disagreements between the two methods go to a person. The game page shows the rating with its reason, and Mature games never appear in lists or on the home page. The content policy has the full rules.

People in the loop

Some games wait for a person before they are listed: ratings that need review, pages that may not be games, titles that are only an id, thin source text, possible blocklist matches and security signals. Every game page has a Report button, and a person reviews each report. A report of malware, phishing or a broken game also starts an immediate re-check, and 3 reports of malware or phishing from different people within 24 hours hide the game until a moderator decides.

Re-checks

The 1,000 most played games are checked again every 3 days, every other listed game every 6 days. A failed check is repeated an hour later; if that fails too, the game is hidden as unavailable until a check passes, and after 30 days unavailable it is removed. Separately, a browser that looks like a regular player visits each game at random, about every 14 days, and any difference from the last check goes to a person. AI agents using our MCP server or API are only offered a game as playable while its last check, within 8 days, found it playable.

What our checks cannot catch

• We test in desktop Chromium only. A game can work for us and fail in Safari or Firefox, for example when it relies on third-party cookies.
• Games on portals we only link to, and games that need WebGPU, are listed without our picture test: we confirm they answer and pass the malware checks, not that they draw anything.
• A check plays only the opening seconds: one click and two key presses. We cannot tell whether a game is fun, whether later levels work, or what happens after a few minutes of play.
• A game that shows a still picture passes. We record that it did not move, and it scores lower.
• Google Web Risk knows only addresses that have been reported, and we detect only known miner scripts. A brand new malicious address can look clean the first time.
• A game can change between checks, which are up to 6 days apart. Spot checks and reports narrow that gap.
• Ratings are read from a game's text, not from playing it. We do not review the ads or links a game shows inside its own frame.
• Some failures are ours: a busy test machine can make a working game miss the time limit. Such runs are retried and do not count against the game, but some still slip through.

More about the site on About ArcadeIndex. Found a problem? See Contact.