Is This True? Browser Automation Detection Is More Than a User-Agent
A Reddit thread asks if a popular browser automation claim is true. We break down the layers of modern detection and what actually works in production.
The claim
Every few months, a Reddit thread asks a version of the same question: _If I set a real user-agent in Puppeteer or Playwright, is my automation invisible?_ The answer is no.
The screenshot usually looks convincing. A browser loads. A login page renders. A bot makes a request. But a single successful page load does not mean the session is clean.
What actually happens in the browser
Modern detection is not a single check. It is a layered fingerprint.
When you launch a headless browser and change only the user-agent, several signals still leak:
`navigator.webdriver` stays `true`
`window.chrome` may be missing or incomplete
`navigator.plugins` is often empty
`navigator.languages` may not match the IP or header
`document.hidden` can be true in headless
mouse and keyboard events have synthetic timing
A real user-agent is table stakes. It does not align the rest of the browser.
The CDP leak people forget
Chrome DevTools Protocol is how Puppeteer and Playwright control Chrome. The protocol leaves traces. Some sites check for CDP by evaluating runtime objects or watching for known console messages.
The most common check is simple:
const leaks = await page.evaluate(() => ({
webdriver: navigator.webdriver,
languages: navigator.languages,
plugins: navigator.plugins.length,
chrome: !!window.chrome,
hidden: document.hidden,
}));
console.log(leaks);If `webdriver` is `true` or `plugins` is `0`, the user-agent alone will not save the session.
Why the Reddit screenshots feel true
Many tests run against sites that do not aggressively fingerprint. The site loads, the bot clicks a button, and the developer posts a screenshot. That is not proof.
Protected endpoints, payment flows, and login systems often trigger deeper checks after the first paint. Detection also changes at scale. One session may pass. Ten thousand sessions from the same fingerprint will not.
What actually works
If you run browser automation in production, you need to treat the browser as an environment, not a flag.
Sapior runs managed browser sessions that align the JavaScript fingerprint, patch CDP leaks, and normalize network behavior. Instead of patching one header, you ship a clean runtime.
The workflow is:
1. Define the automation task
2. Launch a Sapior browser session
3. Let the runtime handle fingerprints and infrastructure
4. Read the result through the API
No fluff, no stale browser patches, no `user-agent` whack-a-mole.
The direct answer
**Is this true? No.** Setting a user-agent does not make a headless browser undetectable. It is one small piece of a much larger fingerprint.
If you are evaluating browser automation, test for property leaks, CDP traces, and network consistency. Then decide whether you want to maintain that yourself or use a platform built for it.