How sites actually spot a headless browser

The four passive tells

The most direct signal is navigator.webdriver. The W3C WebDriver specification requires any browser under automation to expose this property as true. In a real desktop browser it returns false or is undefined. One line of JavaScript reads it, and the answer is nearly always decisive for vanilla automation.

The second tell is the plugin list. A real desktop Chrome reports plugins. Headless Chrome reports none: navigator.plugins returns an empty list with length zero, which no real desktop installation reports. It is a small detail, and it is one of the most reliable, because there is no legitimate reason for a desktop browser to have no plugins at all.

The third is the user agent. A default headless Chrome user agent literally contains the string HeadlessChrome. Operators patch it, of course, but the patch is only the first layer, and the layers underneath still leak. The fourth is WebGL: headless configurations often render through SwiftShader, a software renderer, so the UNMASKED_RENDERER_WEBGL string names Google SwiftShader instead of a real GPU model. A canvas drawn in SwiftShader also hashes differently from the same canvas drawn on hardware, which makes it a reliable automation detector on its own.

Why patching one signal never works

Stealth plugins exist, and they patch dozens of JavaScript-visible leaks: they override navigator.webdriver, fake the plugin list, spoof the user agent, and smooth the canvas hash. Against a casual detector they work. Against a serious one they do not, because the patch itself leaves traces.

A badly patched navigator.webdriver is often more suspicious than an unpatched true. If the property descriptor looks non-standard, or the getter function can be serialised, or Object.getOwnPropertyDescriptor returns something different from what a real browser exposes, a careful detector notices the patch. The same applies to the other signals: each one patched correctly is possible, but patching all of them consistently, with no contradiction between them, is the hard part.

And the JavaScript layer is only one of three. Below it sit the network signals: TLS fingerprints that do not match the claimed Chrome version, HTTP/2 frame ordering that differs from a real browser, and IP reputation. A request that claims to be Chrome on Windows but renders WebGL through SwiftShader, has an empty plugin list, and arrives from a datacenter IP is not a person with an unusual setup. It is a contradiction, and modern anti-bot systems score consistency, not any one flag.

Behaviour is the layer automation cannot fake cheaply

Even with a perfect fingerprint, a bot has to behave like a person, and behaviour is where the cost goes up. Real users move the mouse in curves with variable speed, scroll unevenly, pause to read, and mistype. Bots move in straight lines, click instantly, scroll at constant speeds, and fill forms at machine pace. Mouse heuristics, timing, and dwell time are the signals that survive when the fingerprint is patched.

That is why the serious bot operators do not rely on a single trick. They run real browsers on residential IPs, add randomised delays, and simulate human input patterns. The cost per request goes up by an order of magnitude, and the operation stops being a cheap script and becomes a distributed system that needs maintaining. Detection does not have to be perfect. It has to make the attack more expensive than the data is worth.

For the defender, the practical lesson is to score, not to block on one signal. A single navigator.webdriver check blocks the lazy bots and annoys nobody real. A layered score, browser signals plus network signals plus behaviour, with a challenge for the grey zone instead of a hard block, catches the serious automation without punishing the person on an unusual setup.

Keep reading: Why do bots love your search bar more than your homepage?, Credential stuffing: why a 0.1 percent success rate is a disaster, and Why bots read your robots.txt before they attack cover the nearby cases in this series.