Headless Browser Detection: What Sites See and How to Configure Sensibly
Updated:
Headless browsers get detected because they leave traces a normal user's browser does not: navigator.webdriver set to true, a User-Agent containing HeadlessChrome in the old mode, a default window size, a software graphics renderer, a timezone that does not match the IP, and machine-perfect timing. A proxy only changes the IP address; it does not hide any of these. The sensible approach is to make the browser consistent with the proxy, keep sessions stable and run at a moderate pace, rather than trying to spoof everything. This guide lists the common signs, how to check your own setup, and configuration for Playwright, Puppeteer and Selenium.
What a headless browser is and why sites care
A headless browser runs without a visible window and is controlled by code through tools such as Playwright, Puppeteer or Selenium. It has plenty of legitimate uses: UI testing, screenshots, PDF generation, monitoring public prices. It is also a favourite of spam bots and aggressive scrapers, so many sites run anti-bot systems to recognise it.
Anti-bot systems rarely rely on one signal. They combine many small ones into a risk score and then allow, challenge or block. A single sign is seldom enough to block you, but several contradictory signs almost certainly get noticed.
Common headless signs
| Sign | What the site sees | Note |
|---|---|---|
navigator.webdriver | True when the browser is under automation | Part of the WebDriver standard; automation tools usually set it |
| User-Agent | Contains HeadlessChrome in the old headless mode | Chrome's new headless mode uses a near-normal UA |
| Viewport and screen | The tool's default window size, screen not matching window | Few real users have exactly the default size |
| WebGL and fonts | Software renderer, an unusually small font set | Common on Linux servers without a GPU |
| Language and timezone | Empty languages or UTC while the IP is in Vietnam | A conflict between IP and environment |
| Behaviour | No mouse movement, no scrolling, instant clicks, even rhythm | Behaviour often matters more than technical traits |
| Session | Every run is a blank browser without cookies | Real users come back with history |
Check what your browser looks like
- In the automated browser, open what is my IP to confirm the IP and country the site sees belong to your proxy.
- Run
page.evaluate('navigator.webdriver'),navigator.languagesandIntl.DateTimeFormat().resolvedOptions().timeZone, print the results and compare them with the IP's country. - Screenshot the target page with your current setup to see whether you are redirected to a challenge.
- Check for WebRTC leaks with the WebRTC leak test, especially in headed mode.
- Compare with the same page in a normal browser on the same proxy. If the normal browser gets through and the automated one does not, the issue is the browser, not the IP.
Sensible Playwright and Puppeteer settings
Aim for consistency: everything the browser reports about itself should agree, and agree with the IP. You do not need to spoof dozens of properties; heavy spoofing often adds contradictions.
- Use Chrome's new headless mode, or run headed (
headless=False) on a virtual display when needed, rather than the old headless mode. - Set a common viewport such as
viewport={'width': 1366, 'height': 768}instead of the default. - Set
locale='vi-VN'andtimezone_id='Asia/Ho_Chi_Minh'with a Vietnam proxy, and a US locale and timezone with a US proxy. - Keep the User-Agent true to the browser you run. Claiming another version or OS while the engine stays the same is an easy contradiction to spot.
- Use a persistent profile directory (
launch_persistent_contextin Playwright,userDataDirin Puppeteer) to keep cookies between runs. - Pin one proxy per session or account; see the Playwright proxy setup and Puppeteer proxy setup.
- Add natural waits between actions and wait for pages to finish loading rather than clicking instantly.
A word on stealth plugins
Community plugins patch a range of properties so automated browsers look like ordinary ones. They can help with legitimate testing, but they are not magic: anti-bot systems change constantly, and outdated patches can become a fingerprint themselves. More importantly, using them to defeat a site's protection in order to do something the site forbids is still a terms violation, however well it works technically.
If you are blocked repeatedly despite a sensible setup and a slow pace, treat that as the site's answer. Look for an official API, narrow the data you need, or contact the site owner. Proxies and CAPTCHA discusses these limits further.
Where the proxy fits
The proxy decides the IP, country and network type a site sees. A clean dedicated IP removes bad signals inherited from other users and lets you match timezone and language to a real location. It cannot fix navigator.webdriver, viewport or behaviour. The two have to work together.
For public-data scraping, private IPv4 is usually enough. For valuable accounts run through a browser, static ISP proxies in Vietnam or the United States look closer to a home connection. For how sites judge IPs, read how websites detect proxies; for the browser side, read browser fingerprinting explained.
Frequently asked questions
Does running with headless=False stop detection?
Not necessarily. Headed mode removes some signs, but navigator.webdriver, behaviour and IP-timezone conflicts remain. The whole setup needs to be consistent.
Will changing proxy stop my headless browser being blocked?
Only when the IP is the main cause, such as a shared IP with a bad history. If the site recognises automation traits in the browser, a new IP will not help.
What timezone and language should I use with a Vietnam proxy?
Set locale vi-VN and timezone Asia/Ho_Chi_Minh in the browser context so the environment matches the IP's location.
How is an antidetect browser different from a headless browser?
An antidetect browser manages many profiles with separate fingerprints, usually operated by hand for accounts. A headless browser is driven by code for automation. Both need a proxy that matches their settings.
Is there a setup that is never detected?
No. Anti-bot systems keep changing and no configuration or proxy type guarantees it. Run slowly, consistently and within what the site allows.
Dedicated proxies that match your browser setup
Private IPv4 in 7 countries and static ISP in Vietnam and the US. HTTP/HTTPS with username and password, ready for Playwright, Puppeteer and Selenium.
See pricing