Anti-Detection

What is User Agent?

A user agent is the string a browser sends in the User-Agent request header to identify itself: browser, version, rendering engine and platform. Servers use it to select content and to sort traffic. Anyone can set it to anything, so detection systems treat it as a claim to be checked against every other signal.

Chrome on Windows sends something close to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36. Most of that is historical fiction, since the Mozilla prefix and the Safari token survive only because sites once sniffed for them. The parts carrying information are the platform block and the browser version. Chromium now freezes the minor version digits at 0.0.0 and reports a coarser platform, part of a deliberate reduction in how much the header alone identifies.

The detail moved into Client Hints. Chromium sends Sec-CH-UA, Sec-CH-UA-Mobile and Sec-CH-UA-Platform on ordinary requests, and releases the high-entropy hints - full version list, architecture, platform version, device model - only when a server asks for them with an Accept-CH response header, or when page script calls navigator.userAgentData.getHighEntropyValues(). Safari and Firefox do not implement Client Hints. A request whose User-Agent claims Chrome while carrying no Sec-CH-UA header is contradicting itself before anything else is examined.

Mismatch is what gets you blocked, rather than the string itself. navigator.platform, screen dimensions, the installed font list and the WebGL renderer all have to agree with the platform you claim. A macOS user agent arriving with the TLS fingerprint of Python's requests library is a contradiction that costs one comparison to find. Rotating the header between requests inside a single session is worse than leaving it alone, because real browsers do not change version mid-visit and a session cookie that changes browsers is a strong flag.

Default library user agents are the fastest way to be identified. python-requests, curl and Scrapy each announce themselves in their out-of-the-box string, and many sites drop those requests at the edge with no further analysis. Copy a full, current string from a real browser on the platform you intend to claim. Hold it for the life of the session, and make the rest of the profile agree with it. A mobile user agent paired with a 4G exit IP is coherent; the same string arriving from a hosting range is not.

Where you meet it

You meet this in a scraper's headers dictionary and in the fingerprint panel of an antidetect browser. The practical questions are which platform to claim and how long to keep it. Stale strings age badly, since a Chrome version from two years ago is rare enough now to stand out by itself. When a scrape that worked yesterday starts returning 403 on the first request, an outdated or default user agent is the cheapest thing to rule out.

Common questions

How often should I rotate user agents?

Per identity or session, never per request. A browser keeps one user agent for a whole visit, so changing it between requests that share a cookie is a giveaway. Rotate when you start a new session on a new IP, and refresh your pool of strings every few months so the versions stay current.

Can a website tell that I changed my user agent?

Often, yes. The header is cross-checked against navigator.userAgentData, navigator.platform, screen size, available fonts, WebGL renderer, and the TLS and HTTP/2 fingerprints of the connection itself. Any of those disagreeing with the claimed browser or operating system marks the request without the site needing to prove which value was faked.

What user agent should a scraper send?

Either a current string copied from a real browser that matches the rest of your setup, or an honest bot identifier with a contact URL if the site permits crawling. The middle ground is what fails - a library default, an invented string, or a browser version that no longer exists in the wild.

Related terms

Browser Fingerprint
A browser fingerprint is an identifier derived from the properties your browser exposes - user agent, screen and window dimensions, timezone, language, installed fonts, canvas and WebGL rendering output, audio stack behaviour, hardware concurrency. Combined, these values are often unique enough to recognise the same browser across sessions and sites without any cookie.
Bot Detection
Bot detection is the practice of separating automated traffic from human traffic. Systems score each request against network signals, transport-layer fingerprints, browser characteristics and behaviour over time, then allow, challenge or block it. Vendors including Cloudflare, DataDome, Akamai and HUMAN sell this as a service running in front of the origin server.
Antidetect Browser
An antidetect browser is a browser built to run many separate identities on one machine. Each profile keeps its own cookies, storage and cache, its own proxy, and its own fingerprint - user agent, screen metrics, timezone, canvas and WebGL values - so sites see distinct devices instead of one browser switching between accounts.
Headless Browser
A headless browser is a real browser engine running without a visible window. It loads pages and runs their JavaScript the way a visible browser does, rendering to an off-screen buffer and taking instructions from a script rather than a person. Puppeteer, Playwright and Selenium all drive browsers in this mode.
Stealth Mode
Stealth mode is the collection of patches and habits that keep an automated browser from announcing that it is automated. It removes the flags automation frameworks leave behind and repairs the values a controlled browser reports differently, while pacing actions at something closer to human speed. It hides the tooling and does nothing for anonymity.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.