Stealth techniques can make browser automation less conspicuous to some checks, but they cannot make an automated session reliably appear human or guarantee access to a protected site. Modern bot detection can combine browser and network fingerprints, JavaScript checks, behavior, session history and reputation. The practical goal for authorized testing or monitoring is therefore consistency and reliability—not bypassing an access control.
What browser stealth can—and cannot—do
“Stealth” is an umbrella term for reducing signs that a browser is controlled by automation. That can include avoiding framework-specific artifacts and keeping ordinary browser settings aligned: version, locale, timezone, viewport, request headers, cookies and network behavior. When an authorized site is sensitive to obvious inconsistencies, this kind of housekeeping may reduce false positives or make a test more representative of a real visitor.
It is not a universal disguise. Cloudflare describes detection as involving multiple layers, including heuristics, JavaScript detections, signatures, browser signals, session characteristics and reputation data. A browser can pass a JavaScript check and still receive a bot score of 1 when other signals do not look trustworthy. There is no stable, general success percentage that can be applied across sites, detection products or sessions.
Think of stealth as a way to control variables in a permitted browser test. If a site denies automated access, changing a fingerprint is not evidence that you have permission to continue. Prefer an official API, a documented integration, a test environment or written authorization.
#1 Best Overall
Why changing the user agent is not enough
A user-agent string is only one part of a request and browser profile. Changing it may make a request header claim a different browser, but it does not automatically change the actual browser implementation, its JavaScript behavior, its network characteristics or the rest of the session. A mismatch between the claim and the observable browser can itself be a signal.
Cloudflare’s hosted Browser Run documentation is unusually explicit: “Requests from Browser Run will always be identified as a bot.” It also says the Playwright userAgent setting “does not bypass bot protection.” Those statements are specific to Browser Run and its documented behavior, but they illustrate the broader point: a user-agent override is not a bypass for a detection system that evaluates other signals.
Use a user-agent setting when a test needs to reproduce a particular supported browser configuration or investigate a compatibility issue—not as a promise that a protected site will treat automation as a person.
Which signals can reveal automation?
Detection systems can combine observations from different layers rather than relying on one telltale property. A configuration that looks plausible in isolation can still form an implausible whole.
| Signal area | What may be observed | Practical implication for authorized testing |
|---|---|---|
| Browser and JavaScript | Browser properties, JavaScript detections, signatures and characteristics associated with a browser or automation framework. | Keep the browser version and configuration aligned with the test, and do not assume that changing one exposed property changes the underlying browser. |
| HTTP and network | Request headers, network-level characteristics, traffic patterns and the relationship between the claimed browser and its requests. | Use a consistent environment and avoid making a test depend on a header override alone. |
| Session | Cookies, session characteristics and reputation information associated with prior requests. | For repeatable tests, document how a session is created and whether it is reused; avoid mixing unrelated test runs into one session. |
| Behavior | Navigation timing and interaction traces, in addition to browser properties. | Do not treat random delays or synthetic clicks as a faithful substitute for physical input or as a guarantee of acceptance. |
A 2026 multi-layer fingerprinting study reports that evaluated agents could be distinguished from humans and from one another across network, HTTP and browser layers. It also reports that some stealth mechanisms can increase detectability. A separate 2026 study describes distinguishing humans, bots and AI agents with minimal behavioral features; it notes that Playwright does not emit the raw pointer-move and wheel-delta streams produced by physical input devices. These findings are reasons to avoid simplistic “change a few properties and you are invisible” recipes, not a claim that every site uses the same signals.
Do headful mode or stealth plugins stop detection?
Headful versus headless
Running a browser with a visible window changes how the browser is launched and can help when a test requires a real display or when a developer needs to inspect a page interactively. It does not remove the other layers of detection. A visible browser can still be automated, and a site can evaluate session, network, browser and behavioral signals regardless of whether a window is on screen.
Stealth patches and plugins
A patch may alter or hide a particular automation-related property. That can reduce one observable difference, but it can also introduce inconsistencies with the browser version, APIs, headers or other properties. The 2026 fingerprinting study reports that stealth mechanisms sometimes made evaluated agents easier to distinguish. Treat any patch as a change to test and maintain, not as a durable cloak.
Before adding a patch, ask what exact compatibility problem it solves, whether the target owner permits the test, and how you will know whether the change improved fidelity without creating new errors. Avoid piling on modifications without a controlled baseline: it becomes harder to diagnose both a failed capture and a changed fingerprint.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to make authorized automation more reliable
For visual regression, accessibility checks, uptime monitoring or data collection with permission, consistency is usually more useful than trying to imitate a person. Record the inputs that make a run reproducible, make navigation conservative, and stop when the target rejects the session.
- Confirm permission and choose the supported route. Check the site’s terms, robots.txt and documented API options; for private systems, use an approved test account or staging environment. If an API is available for the task, prefer it to browser extraction.
- Pin the browser environment. Keep Playwright and its installed browser version current and consistent across runs. Playwright’s browser documentation emphasizes version maintenance; it also warns that Chrome and Edge enterprise policies can constrain browser launch and control. If a managed machine behaves differently from a developer workstation, check those policies rather than assuming the site is at fault.
- Set ordinary context details deliberately. Use the locale, timezone and viewport appropriate to the authorized test. Keep request headers and cookies consistent with the approved session. Avoid claiming a browser configuration that the running browser does not actually represent.
- Make navigation predictable, not aggressive. Use a clear page-load condition appropriate to the application, reasonable timeouts and low request rates. Repeated rapid retries can obscure the original failure and may burden the site. Record the destination, timestamp and outcome for each run.
- Preserve a clean baseline. Start with the ordinary supported browser configuration. Add one change at a time only if you can explain its purpose and compare its effect. Keep debug logs and a screenshot or trace when permitted so that page failures can be separated from detection responses.
- Stop at a challenge or denial. Do not turn a CAPTCHA, bot check or access-denied response into an instruction to conceal automation. Ask the site owner for an allowlist, test endpoint or API, or stop the run.
A minimal Playwright screenshot for a permitted test
This Node.js example captures a page using Playwright without trying to disguise automation. It is useful as a baseline for an authorized visual check. Install Playwright in a project with npm install playwright, install its Chromium browser with npx playwright install chromium, save the following as screenshot.js, and run node screenshot.js. Replace the example address only with a URL you are permitted to test.
const { chromium } = require('playwright');
(async () => {
const browser = await chromium.launch({ headless: true });
try {
const page = await browser.newPage({
viewport: { width: 1440, height: 900 },
locale: 'en-US',
timezoneId: 'UTC'
});
const response = await page.goto('https://example.com', {
waitUntil: 'domcontentloaded',
timeout: 30000
});
console.log('HTTP status:', response ? response.status() : 'no response');
await page.screenshot({ path: 'shot.png', fullPage: true });
} finally {
await browser.close();
}
})();The output status is a useful diagnostic, not proof that the site permits automation or that every page component has finished rendering. If the site is a single-page application or loads content later, use an application-specific readiness condition in an authorized test rather than adding an arbitrary long sleep. Keep timeouts bounded and record when the page never becomes ready.
What hosted browser automation changes
Hosted execution can simplify browser provisioning and let a service control a browser programmatically. Cloudflare describes Browser Run as headless browser control for screenshots, PDFs and automated browser tasks using Playwright, Puppeteer or CDP. That capability does not imply stealth: Cloudflare also documents that Browser Run requests are always identified as bots. Infrastructure choice and bot identity are separate questions.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhen comparing a browser service or building an internal one, evaluate browser/version coverage, control surface (such as Playwright, Puppeteer or CDP), debugging visibility, network and session consistency, detection exposure, challenge handling, permission boundaries, cost and concurrency. Ask how errors are reported and whether you can distinguish a timeout from an access denial. Do not assume a hosted browser can solve a challenge or is appropriate for a target merely because it can render the page.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cost, performance and failure handling
For a self-hosted browser, cost includes the compute and maintenance needed to install and update browsers, run concurrent jobs, retain diagnostics and recover from failures. For a hosted service, check the service’s documented billing rules, concurrency limits and treatment of unsuccessful jobs; those details vary. A high retry rate can raise costs and load without improving the chance that the target authorizes access.
For reliability, control concurrency, use explicit timeouts, capture useful error context and avoid assuming that a screenshot file means the page was correct. A successful HTTP response may still lead to an application error or a challenge page. Conversely, a timeout can result from a slow page or a network issue rather than bot detection. Make your monitoring report the observed outcome instead of interpreting every failure as the same problem.
Common symptoms and fixes
- Access denied after changing the user agent: the service may use signals beyond the header. Restore a consistent browser configuration and use the site’s documented API or seek authorization.
- A CAPTCHA or bot challenge appears: stop the automated run and contact the owner for a permitted test path; do not treat a different browser mode as guaranteed access.
- Works on a workstation but not in managed Chrome or Edge: enterprise policies can limit launch and control. Check the organization’s browser policy and use an approved browser configuration.
- Screenshot is blank or incomplete: distinguish navigation failure from delayed application rendering. Inspect the response and logs, then wait for an application-specific readiness signal in an allowed environment.
- Behavior differs after a browser update: verify the Playwright and browser versions used in each environment and update or pin them consistently for the test.
- Retries produce more failures or uncertain results: lower concurrency, use bounded retries only for transient errors, and report denials and challenges as terminal outcomes rather than retrying around them.
Or skip the browser setup
If the job is simply to obtain a website screenshot or PDF—not to control an interactive browser—ScreenshotNeo provides a screenshot API and MCP server. One GET request with a URL can return a PNG, JPEG, WebP or PDF. Its clean-shot steps accept cookie or consent banners and remove 60+ known consent platforms, newsletter popups and chat widgets before capture; each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and each response says which outcome occurred in X-Page-Verdict and X-Billed headers. An MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. It is not a way to bypass a site’s access controls.
Recommended Free Tools
For a URL you are permitted to capture, the cURL request is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for parameters and response details. Pricing is monthly: Free includes 1,000 shots with no card; Starter is $5 for 3,000; Growth is $15 for 15,000; Pro is $39 for 60,000; Scale is $99 for 250,000; Business is $249 for 1,000,000. Yearly billing gives two months free, and every feature is on every plan. Sign up for 1,000 free screenshots a month with no card.
Frequently Asked Questions
Does a successful screenshot prove the site authorized my automation?
No. A rendered page or successful HTTP response describes what the browser received; it does not establish permission. Confirm access rights separately with the site owner or its published terms.
Should a CAPTCHA be solved automatically in a monitoring workflow?
Treat a CAPTCHA or bot challenge as a stop condition for an authorized monitor. Ask the site owner for an approved testing route rather than designing retries to get around the challenge.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIs a hosted browser inherently less detectable than a local one?
No. A hosted browser can provide a useful execution environment, but its traffic may have a declared bot identity. Check the specific service documentation and target policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
