Anti-Detection

What is Headless Browser?

A headless browser is a real browser engine running without a visible window. It loads pages and runs their JavaScript the way a visible browser does, rendering to an off-screen buffer and taking instructions from a script rather than a person. Puppeteer, Playwright and Selenium all drive browsers in this mode.

Chrome starts headless with the --headless=new flag, and adding --remote-debugging-port=9222 lets an external process attach; Firefox uses -headless. The controlling script speaks the Chrome DevTools Protocol or WebDriver BiDi over a WebSocket, issuing commands to navigate, click, evaluate JavaScript and capture screenshots or PDFs. Chrome's newer headless mode runs the same binary as the visible browser instead of the separate implementation that shipped for years, which erased a batch of behavioural differences that detection scripts used to test for.

What it does well is anything requiring a page to finish executing. Server-rendered HTML answers only a fraction of scraping targets now, since prices, reviews and listings often arrive from XHR calls that a plain HTTP client would have to reverse-engineer first. Headless browsers also generate PDFs and preview images, run end-to-end test suites in CI, and complete login flows. The cost is resources. Each instance holds hundreds of megabytes of memory, so achievable concurrency is far below what a request library gives you.

Detectors look for the seams. navigator.webdriver reads true when a browser runs under automation control, a GPU-less container reports SwiftShader as its WebGL renderer, and the plugin and mimeType arrays come back empty. Permission and notification states return combinations that a genuine profile does not produce. The old headless build even carried HeadlessChrome in its user agent. Beyond those flags, timing gives you away, because a script that clicks the same number of milliseconds after DOMContentLoaded on every page is not a person.

There are two directions out of the obvious tells. Run the browser headful inside a virtual display such as Xvfb, which removes the whole class of headless-specific checks at the cost of more overhead, or stay headless and apply a patching layer that repairs the known giveaways. Neither touches the network layer. The TLS fingerprint and HTTP/2 header ordering come from the browser itself, which is the argument for driving a real Chrome rather than emulating one, and the exit IP still has to stand on its own.

Where you meet it

You reach for one when requests plus an HTML parser returns an empty shell and the data only appears after JavaScript runs. The trade is throughput - a few megabytes per worker becomes a whole browser per worker, and a hundred concurrent sessions turns into a fleet question. Watch for the job that works on your laptop and fails in Docker, because a container with no GPU and no display changes the fingerprint even though the code is identical.

Common questions

How do websites detect a headless browser?

By checking values that differ under automation: navigator.webdriver, a software WebGL renderer like SwiftShader, empty plugin arrays, odd screen or window dimensions, inconsistent permission states, and artifacts of the DevTools protocol. Behaviour adds more, since fixed intervals between actions and a total absence of mouse movement cluster easily across many sessions.

Is headless mode faster than running a visible browser?

Somewhat. Skipping compositing and painting to a screen saves real work, but parsing, JavaScript execution and network waits dominate the total, so expect a modest gain rather than a transformation. The larger speed decision is whether you need a browser at all, since an HTTP client is orders of magnitude cheaper per page.

Do I need proxies with a headless browser?

If you are sending more than a handful of requests to one site, yes. Rate limits, reputation scoring and blocks are applied per IP address, and a headless browser making a thousand visits from a single datacenter address is caught by volume alone, long before any fingerprint analysis is needed.

Related terms

Puppeteer
Puppeteer is a Node.js library that drives Chrome and Chromium through the Chrome DevTools Protocol. From JavaScript it launches a browser, opens pages, clicks and types, intercepts network traffic and renders screenshots or PDFs. Teams run it to scrape pages that only assemble their content after JavaScript executes, and to automate logged-in workflows.
Playwright
Playwright is Microsoft's browser automation library. A single API drives Chromium, Firefox and WebKit, with official bindings for JavaScript, Python, .NET and Java. It has auto-waiting, isolated browser contexts, per-context proxy settings and a trace viewer that replays a failed run step by step, which makes it the usual pick for new automation projects.
Selenium
Selenium is a browser automation framework that drives real browsers through the W3C WebDriver protocol. It has official bindings for Java, Python, C#, Ruby and JavaScript, and Selenium Grid spreads runs across many machines. Long-standing use makes it the default in enterprise QA, though newer libraries handle waiting and proxy credentials with far less code.
Antidetect Browser
An antidetect browser is a browser built to run many separate identities on one machine. Each profile keeps its own cookies, storage and cache, its own proxy, and its own fingerprint - user agent, screen metrics, timezone, canvas and WebGL values - so sites see distinct devices instead of one browser switching between accounts.
User Agent
A user agent is the string a browser sends in the User-Agent request header to identify itself: browser, version, rendering engine and platform. Servers use it to select content and to sort traffic. Anyone can set it to anything, so detection systems treat it as a claim to be checked against every other signal.
Stealth Mode
Stealth mode is the collection of patches and habits that keep an automated browser from announcing that it is automated. It removes the flags automation frameworks leave behind and repairs the values a controlled browser reports differently, while pacing actions at something closer to human speed. It hides the tooling and does nothing for anonymity.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.