Browser
A browser is a client-side app that renders HTML, CSS and JavaScript — the surface real users interact with, and the one bots increasingly try to imitate.
Browser-Based Protection
Secure your web applications from automated attacks
What is a Browser?
A browser fetches documents over HTTP, renders them, and runs the scripts they contain. Chrome, Safari, Firefox and Edge are the ones with meaningful share — though Chrome, Edge and most of the rest are built on Chromium, so the number of distinct rendering engines is three rather than a dozen.
For bot detection the browser is the object under examination, and the interesting question is not which browser is claimed but whether the claim holds up.
What a browser reveals
Any page can observe a great deal about its client without asking permission: screen dimensions, time zone, language, which fonts resolve, how a canvas renders, which JavaScript APIs exist and exactly how they behave, how the TLS handshake was composed.
Two things follow from that. First, the combination is frequently unique, which is the basis of device fingerprinting and the reason browser vendors have been narrowing the surface for years. Second, and more usefully, the values have to agree with each other — and that is much harder to arrange than editing any one of them.
Automated browsers
Real browsers can be driven by software. Playwright, Puppeteer and Selenium control genuine Chrome or Firefox, so the rendering, the APIs and the TLS handshake are all authentic — which defeats any check that simply looks for a missing feature.
| Claimed client | The contradiction that gives it away |
|---|---|
| Safari on iPhone | A Chrome-only API present, or a V8-shaped error message |
| Desktop Chrome | A GPU string no desktop ships, or screen dimensions no device has |
| Headless Chrome, patched to hide it | Residual property differences, and behaviour with no pointer movement |
| Any browser via an automation framework | Remote-control surfaces, and timing that precedes human perception |
The useful signal in all four rows is internal inconsistency rather than a known-bad value. A value can be edited; a coherent set of values across the whole surface requires genuinely running the thing being claimed. That is why coherence checks age better than blocklists.
Privacy features are not bot signals
This is the mistake that costs real customers. Browsers that reduce their fingerprint — Brave, Tor Browser, Safari with its reduced user-agent, anything with hardened anti-tracking — look unusual by design. So do older devices, and so do browsers in regions a vendor never tested.
Treating "unusual" as "automated" rejects privacy-conscious users, which is both a commercial loss and, given who those users tend to be, a reputational one. A detection system should convict on contradiction, not on unfamiliarity.
The case that breaks the framing
An agentic browser — an AI assistant driving a real browser on someone's behalf — is automated by every test above, and there is a real customer who asked for the task. Judging the client gets this wrong in both directions, which is the argument for requiring evidence of a person at the steps where money moves rather than at the door.