Headless Browser Detection

Evaluates the presence and behavior of browser-specific JavaScript objects that are often absent or altered in headless modes. Automation frameworks like Puppeteer and Playwright modify or omit standard properties.

• navigator.webdriver: Checks if the property is set to true, a direct indicator of automation control.
• navigator.plugins: Headless browsers often report an empty array or zero plugins, unlike standard browsers.
• navigator.languages: Verifies the language array is populated correctly, as headless modes may leave it undefined.

Exploits the absence of a graphical compositor by testing visual output. Headless browsers skip actual pixel rendering, leading to detectable anomalies.

• Canvas Fingerprinting: Renders a hidden graphic and hashes the output. Headless modes using software renderers produce identical or null hashes.
• WebGL Vendor: Queries the WEBGL_debug_renderer_info extension. Headless instances often return generic strings like "Google SwiftShader" or "Mesa".
• Feature Detection: Checks for missing CSS features like @media queries for hover: none, which headless scrapers often fail to emulate correctly.

Cross-references the User-Agent HTTP header against the actual JavaScript environment to detect mismatches. A headless browser claiming to be Chrome on Windows must exhibit the corresponding engine behaviors.

• Window Dimensions: Verifies that window.outerWidth and window.outerHeight are non-zero, as headless modes often report 0x0.
• Feature Policy: Tests for the absence of permission prompts (notifications, geolocation) that require a user interface.
• Error Stack Traces: Analyzes the format of stack traces; native browsers include line/column numbers, while some headless drivers inject distinct artifacts.

Measures execution speed and event handling to distinguish human-paced interactions from scripted, headless execution.

• Request Animation Frame: Monitors requestAnimationFrame callbacks. In headless mode, these fire at maximum CPU speed rather than syncing to a display refresh rate.
• Interaction Event Trust: Inspects the isTrusted property on mouse and keyboard events. Programmatically dispatched events in headless scripts are always untrusted.
• Execution Timing: Measures the time delta for complex cryptographic or rendering tasks. Abnormally fast completion indicates the absence of rendering overhead.

Identifies headless traffic at the network layer before JavaScript execution, using TLS fingerprinting and header analysis.

• JA3/JA4 Fingerprints: Hashes the TLS Client Hello parameters. Headless automation libraries often have distinct, identifiable TLS signatures.
• HTTP/2 Frame Analysis: Examines the order and priority of HTTP/2 frames; headless clients deviate from standard browser multiplexing patterns.
• Header Ordering: Validates the strict ordering of HTTP headers (e.g., Sec-Ch-Ua before User-Agent). Automation tools frequently permute this order.

A modular plugin framework designed to evade headless detection by patching known automation leaks. Understanding its countermeasures is critical for building robust detection logic.

• Runtime Patching: The puppeteer-extra-plugin-stealth library overrides navigator.webdriver and fakes plugin arrays to mimic real browsers.
• Evasion Cat-and-Mouse: Detection engineers must target deeper, unpatched artifacts like chrome.runtime connectivity or specific WebGL shader precision values.
• CDP Detection: Monitors for the Chrome DevTools Protocol connection, which is required for Puppeteer control but can be obscured via pipe transport.

The practice of identifying browser automation frameworks by checking for JavaScript properties injected by automation drivers. Key detection vectors include:

• navigator.webdriver: Set to true by Selenium and Puppeteer
• document.$cdc_ and document.$chrome_: Chrome DevTools Protocol artifacts
• window.callPhantom: Legacy PhantomJS indicator

Modern evasion tools attempt to patch these properties, requiring detection to evolve toward deeper rendering artifact analysis and API inconsistency probing.

A browser fingerprinting technique that exploits the HTML5 Canvas API to render a hidden graphic and capture subtle variations in the device's graphics hardware and driver stack. When combined with headless detection:

• Headless browsers often produce identical or null canvas hashes
• GPU-accelerated rendering differences reveal virtualization
• Font rasterization inconsistencies expose emulated environments

The technique serves dual purpose: generating a unique device identifier while simultaneously probing for the absence of genuine GPU rendering pipelines.

The technique of identifying a falsified User-Agent HTTP header by cross-referencing the claimed browser identity against actual client capabilities. Detection methods include:

• JavaScript API consistency checks: Does the claimed Chrome version support the expected APIs?
• CSS feature detection: Probing for rendering capabilities inconsistent with the declared browser
• HTTP/2 fingerprinting: Analyzing frame size and prioritization patterns

Headless browsers frequently spoof User-Agent strings while failing to replicate the full behavioral fingerprint of the claimed browser version.

A method of identifying a client application by analyzing the specific parameters and cipher suites advertised in the Transport Layer Security handshake. This creates a signature independent of IP address:

• JA3/JA4 fingerprints: Hash of TLS Client Hello parameters
• Cipher suite ordering: Unique to each TLS library implementation
• Extension ordering: Reveals the underlying HTTP client library

Headless browsers using Puppeteer or Playwright often produce distinct TLS fingerprints that differ from genuine browser TLS stacks, enabling detection at the network layer before JavaScript execution.

The process of combining behavioral and device attributes collected during a single user session to build a unique, time-bound identifier. This defends against session hijacking and replay attacks by:

• Binding the session to the original fingerprint: Any device change invalidates trust
• Monitoring behavioral consistency: Keystroke and mouse dynamics remain stable
• Detecting headless replay: Scripted sessions lack the entropy of genuine interaction

When a session fingerprint suddenly shifts from a genuine browser to a headless client, it signals a session takeover or credential-stuffing attack in progress.