Browser fingerprinting evasion techniques

Fingerprint surface overview

Anti-bot systems (Cloudflare, Akamai Bot Manager, PerimeterX/HUMAN, DataDome, Kasada) combine multiple independent signals into a composite score. No single evasion fixes detection — a coherent fingerprint requires every layer to agree with every other layer. A residential IP with a datacenter TLS signature, or a spoofed navigator.platform that contradicts the User-Agent, is often a stronger signal than any single raw fingerprint value.

Navigator object anomalies

The most trivial and most commonly checked signal. Headless Chrome and CDP-driven browsers leave detectable traces on navigator unless explicitly patched.

// naive server-side or client-side check
if (navigator.webdriver === true) {
  flag('automation');
}
if (navigator.plugins.length === 0) {
  flag('headless');
}
if (!window.chrome) {
  flag('non-standard chrome');
}

Evasion requires patching the property before any page script executes, via Page.addScriptToEvaluateOnNewDocument (CDP) or Playwright's addInitScript. Deleting the property outright is detectable — a real Chrome build never lacks it entirely for headed mode; the correct approach is redefining the getter.

Object.defineProperty(Navigator.prototype, 'webdriver', {
  get: () => undefined,
  configurable: true
});

Plugin and mimeType arrays

Headless Chrome ships empty navigator.plugins and navigator.mimeTypes by default. These need to be repopulated with objects matching the shape of a real Chrome install (PDF viewer plugin, Native Client, etc.), not just non-zero length — detection scripts check for internal consistency between plugin names and MIME type associations.

CDP and automation leaks

Chrome DevTools Protocol itself introduces detectable side effects, independent of any JS-level patching, because the protocol modifies runtime behavior at a level scripts can observe.

• Runtime.enable leak: calling Runtime.enable (used by Puppeteer/Playwright by default to receive console/exception events) triggers a detectable timing artifact in Error.captureStackTrace and exposes extra properties on thrown errors. Sites check for the presence of CDP-only binding artifacts injected into the page context.
• Console API object leaks: CDP's Runtime.consoleAPICalled path retains references that can be detected by checking whether console methods have been wrapped or whether their toString() output matches native code.
• Exposed function leaks: page.exposeFunction in Puppeteer/Playwright injects a named function on window that a fingerprinting script can iterate for and find.

Canvas fingerprinting

Rendering text or shapes to a <canvas> element and hashing the pixel output produces a value that varies by GPU, OS font rendering, and driver — stable per machine, distinct across machines.

const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.textBaseline = 'top';
ctx.font = '14px Arial';
ctx.fillText('fingerprint-probe-🔒', 2, 2);
const hash = hashCode(canvas.toDataURL());

Two evasion strategies exist, with different tradeoffs:

1. Deterministic noise injection

Hooking toDataURL / getImageData to add a small per-session, per-pixel noise value. Must be seeded consistently within a session (same page reload → same fingerprint) but vary across sessions/profiles.

const origGetImageData = CanvasRenderingContext2D.prototype.getImageData;
CanvasRenderingContext2D.prototype.getImageData = function(...args) {
  const imageData = origGetImageData.apply(this, args);
  for (let i = 0; i < imageData.data.length; i += 4) {
    const noise = (sessionSeed * (i % 97)) % 3 - 1;
    imageData.data[i] = clamp(imageData.data[i] + noise, 0, 255);
  }
  return imageData;
};

2. GPU/render-path normalization

Running headless Chrome with a consistent, real GPU renderer (via --use-gl=angle and a fixed ANGLE backend) so the canvas output matches a common, high-population fingerprint rather than a rare or software-rendered one. This avoids modification detection since no hooks are present, but requires infrastructure control over the rendering pipeline.

WebGL fingerprinting

WEBGL_debug_renderer_info exposes the actual GPU vendor/renderer strings (e.g. ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device...))), which immediately identifies software-rendered headless environments.

const getParameterProxyHandler = {
  apply(target, ctx, args) {
    const param = args[0];
    if (param === 37445) return 'Google Inc. (NVIDIA)'; // UNMASKED_VENDOR_WEBGL
    if (param === 37446) return 'ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 Direct3D11 vs_5_0 ps_5_0)';
    return Reflect.apply(target, ctx, args);
  }
};
WebGLRenderingContext.prototype.getParameter = new Proxy(
  WebGLRenderingContext.prototype.getParameter, getParameterProxyHandler
);

AudioContext fingerprinting

Rendering an OscillatorNode through a DynamicsCompressorNode and reading back the output buffer produces sub-sample floating-point variance tied to the audio stack's floating-point implementation — stable across page loads on the same machine, distinct across machines/OSes.

const origCopyFromChannel = AudioBuffer.prototype.copyFromChannel;
AudioBuffer.prototype.copyFromChannel = function(destination, channelNumber, startInChannel) {
  origCopyFromChannel.call(this, destination, channelNumber, startInChannel);
  for (let i = 0; i < destination.length; i++) {
    destination[i] += (Math.random() * 2 - 1) * 1e-7;
  }
};

The noise magnitude matters: too large a perturbation shifts the hash into an implausible cluster (detectable as an outlier vs. the known distribution of real hardware DSP noise); too small leaves the original fingerprint largely intact.

Font enumeration

Measuring text width/height across a list of candidate font names against fallback fonts reveals which fonts are installed — OS and locale-specific font sets are a strong signal. A Linux CI box running Chrome typically has a font set that no real Windows/macOS consumer machine would ever exhibit.

Screen and hardware consistency

Values that must agree with each other and with the claimed device class:

TLS/JA3 and header ordering

This layer sits below the JS runtime entirely and is the hardest to spoof from a standard HTTP client, because it depends on the TLS library's actual ClientHello construction, not anything an HTTP client's API exposes for configuration.

• JA3/JA3S fingerprint: hash of TLS version, cipher suite list, extensions, elliptic curves, and EC point formats in the ClientHello, in the exact order sent. Python's requests (via OpenSSL) produces a JA3 hash trivially distinguishable from real Chrome (via BoringSSL), regardless of User-Agent header spoofing.
• JA4: newer, extends fingerprinting to TLS 1.3 and adds HTTP/2 frame-level signals (SETTINGS frame parameters, pseudo-header order) on top of the TLS layer.
• HTTP/2 fingerprint: Chrome, Firefox, and generic HTTP libraries send SETTINGS frames with different parameter orderings and WINDOW_UPDATE values. This is checked independently of TLS.

Mitigation requires a client that replicates the exact TLS stack behavior of a real browser — curl-impersonate, tls-client (Go), or actually driving a real browser engine (Playwright/Puppeteer/CDP) rather than a bare HTTP client. There is no header-level fix; the ClientHello is constructed below the application layer.

Header ordering and casing

Real browsers send headers in a fixed, engine-specific order and with specific casing (e.g. Chrome's fetch always orders sec-ch-ua headers before accept). Many HTTP libraries alphabetize or reorder headers by default, and some normalize casing. Matching order requires either a browser-driven request or a library that permits raw header ordering control (not all do).

Behavioral signals

Once static fingerprints are consistent, higher-tier anti-bot products (DataDome, PerimeterX) score interaction patterns:

• Mouse movement curvature: real human movement has non-linear acceleration/deceleration (Fitts's-law-consistent curves); programmatic page.mouse.move() calls in a straight line or with uniform velocity are flagged.
• Event timing entropy: real keyboard/click timing has natural jitter in the 10s of milliseconds; scripted page.click() and page.type() calls fire at suspiciously uniform or suspiciously fast intervals.
• Scroll behavior: instant jumps to an element (common with scrollIntoView) versus gradual scroll with variable-speed wheel events.
• Focus/blur and visibility events: automated sessions frequently never fire visibilitychange or window blur events that a real multi-tab user session generates constantly.

Libraries like ghost-cursor generate Bezier-curve mouse paths with randomized intermediate waypoints to approximate this; injecting randomized delay distributions (log-normal, not uniform) between actions approximates human timing better than fixed sleep() calls.

Stealth framework comparison

Consistency checklist

Before deploying, cross-check that the following all agree with a single claimed device/browser/location combination:

• User-Agent string, navigator.platform, and Sec-CH-UA client hints all describe the same OS/browser/version
• TLS ClientHello (JA3/JA4) matches the claimed browser engine, not the underlying HTTP library
• WebGL vendor/renderer string matches a real GPU plausible for the claimed OS
• Timezone (Intl.DateTimeFormat), Accept-Language, and IP geolocation all agree
• Screen resolution and devicePixelRatio match a real, commonly-sold device
• Installed font set matches what the claimed OS would actually have installed
• CDP-specific side channels (Runtime.enable artifacts, exposed function names) are suppressed, not just navigator.webdriver
• Interaction timing uses non-uniform distributions, not fixed delays or perfectly linear mouse paths