Headless Browser Detection

Analyzes interaction patterns and timing precision to distinguish scripted logic from human unpredictability. Bots execute tasks with superhuman consistency.

• Mouse Movement Entropy: Tracks mousemove events for natural jitter, acceleration curves, and non-linear paths. Scripted movements are often perfectly linear or use simple Bezier curves lacking human micro-tremors.
• Keystroke Dynamics: Measures the timing between keydown and keyup events. Automated typing injects characters with near-identical millisecond intervals, whereas humans exhibit variable dwell times.
• requestAnimationFrame Cadence: Monitors the frame callback rate. In backgrounded or headless tabs, the callback may drop to 0 FPS or run at an unnaturally fixed interval, betraying the lack of a real display refresh cycle.

Inspects the underlying browser runtime and network stack for artifacts of the controlling framework. These checks target the puppeteer-core and CDP layer.

• Chrome DevTools Protocol (CDP) Detection: Checks for the presence of a Runtime.evaluate debugger binding or a WebSocket connection to a local debugging port (e.g., 127.0.0.1:9222), which is the primary control channel for Puppeteer.
• User-Agent & Header Consistency: Cross-validates the User-Agent string against the actual JavaScript API behavior. A browser claiming to be Chrome 120 but missing the userAgentData API or having a mismatched Sec-CH-UA header is flagged.
• outerWidth vs innerWidth: In a true graphical environment, window.outerWidth is larger than window.innerWidth to account for window chrome. Headless modes often report identical values, indicating the absence of a window frame.

Queries the presence and behavior of hardware sensors that are absent or stubbed in virtualized, headless environments. Real user devices have physical sensor stacks.

• Battery Status API: Checks navigator.getBattery(). Headless browsers typically report charging: true, chargingTime: 0, and level: 1 indefinitely, a state impossible for a real unplugged laptop.
• Device Motion & Orientation: Listens for devicemotion and deviceorientation events. A complete absence of sensor noise or a fixed zero-value vector indicates a desktop or headless environment lacking accelerometers.
• Permission Prompt Simulation: Tests how the browser handles permission requests for sensors. Headless modes may auto-deny or auto-grant without the user gesture requirements enforced by standard browsers.

Identifies attempts by advanced bots to falsify their digital fingerprints. This is a counter-countermeasure technique that detects inconsistencies in the lie.

• JS Engine vs. HTTP Header Parity: Executes a JavaScript function to detect the actual browser engine and compares it to the User-Agent header. A script spoofing Firefox will fail if the navigator.userAgent says Firefox but window.ActiveXObject is present.
• Prototype Chain Integrity: Checks if native functions like toString() or getOwnPropertyDescriptor have been overridden on prototype objects (e.g., Navigator.prototype). Spoofing plugins often break the native function's toString output, revealing [object Function] instead of the expected function toString() { [native code] }.
• AudioContext Fingerprinting: Analyzes the output of an OscillatorNode processed through a DynamicsCompressorNode. The subtle hardware-specific floating-point rounding errors in the audio stack create a stable hash that is extremely difficult to spoof without introducing detectable artifacts.

A stateless identification method that aggregates unique device and browser attributes to distinguish headless environments from genuine user-driven browsers.

• Canvas Fingerprinting: Renders hidden images to detect subtle GPU and driver variations absent in headless mode
• WebGL Fingerprinting: Probes the WebGL API for vendor-specific rendering strings that headless browsers often spoof incorrectly
• Font Enumeration: Checks installed system fonts—headless environments typically lack standard OS font libraries
• AudioContext Fingerprinting: Analyzes audio processing stack differences that reveal emulated hardware

Modern detection engines combine multiple signals to generate a confidence score rather than relying on a single binary check.

A client-side interrogation technique that injects a script requiring the requesting client to execute JavaScript and solve a computational puzzle before granting access.

• Proof-of-Work: Forces the client to expend CPU cycles solving a cryptographic hash, imposing cost on large-scale headless scraping
• Environment Probing: Checks for navigator.webdriver, window.chrome, and other properties that Puppeteer and Selenium expose
• Timing Analysis: Measures execution speed of known functions—headless browsers often execute JavaScript faster than human-driven ones
• DOM Shadow Detection: Verifies that injected elements render correctly; headless browsers may skip layout and paint cycles

Effective challenges rotate their logic to prevent scraper developers from caching solutions.

A passive identification technique that analyzes the specific parameters of a client's Transport Layer Security handshake before any HTTP request is processed.

• JA4 Fingerprinting: Generates a concise hash of the Client Hello packet, including cipher suites, extensions, and elliptic curves
• Cipher Suite Ordering: Headless libraries like Playwright often present a different cipher preference than standard browsers
• Extension Analysis: Detects missing or anomalous TLS extensions that real browsers consistently include
• HTTP/2 Settings: Examines frame-level parameters that vary between browser engines and headless implementations

Because TLS fingerprinting occurs at the network layer, it blocks bots before they reach application logic, reducing server load.

The analysis of human interaction patterns to differentiate organic user behavior from scripted automation, even when the browser environment appears legitimate.

• Mouse Movement Trajectories: Headless scripts move in straight lines or perfect curves; humans exhibit micro-jitter and non-linear paths
• Keystroke Dynamics: Measures typing rhythm and key press duration—automation tools type instantaneously with zero variance
• Scroll Behavior: Analyzes scroll speed, pauses, and acceleration patterns that differ between humans and programmatic scrolling
• Touch Pressure: On mobile, detects whether touch events originate from a physical finger or are injected via Chrome DevTools Protocol

Behavioral analysis is particularly effective against stealth-mode headless browsers that pass static fingerprint checks.

A defensive deception mechanism that embeds elements invisible to human users but detectable by automated scrapers that programmatically interact with the DOM.

• Hidden Links: CSS-hidden anchor tags that human users never see or click, but headless crawlers parse and follow
• Invisible Form Fields: Input fields positioned off-screen or behind other elements that bots auto-fill, revealing their automated nature
• Decoy Data: Fake product prices or inventory numbers injected into the DOM that only scrapers extract and use
• Honeytoken Endpoints: API routes that exist solely to detect unauthorized enumeration attempts

When a client interacts with a honeypot, the system can silently flag the session without alerting the scraper operator, enabling long-term threat intelligence collection.

The technical process of identifying traffic routed through intermediary servers by correlating IP metadata, latency patterns, and connection characteristics.

• Data Center IP Detection: Flags traffic from cloud providers like AWS, GCP, and Azure—rarely used by genuine residential users
• Residential Proxy Detection: Identifies IPs from known proxy networks that route traffic through compromised consumer devices
• TCP/IP Stack Fingerprinting: Analyzes TTL values, initial window size, and TCP options that reveal the true originating OS behind a proxy
• Latency Analysis: Measures round-trip time anomalies introduced by proxy chaining and geographic mismatches

Proxy detection is critical because headless browsers almost always operate behind proxies to distribute requests across many IPs and avoid rate limiting.