Browser-Fingerprinting: The Secret Weapon Scrapers Are Using in 2024

Browser-Fingerprinting: The Secret Weapon Scrapers Are Using in 2024

Your scraper just got blocked. Again. You've rotated proxies, randomized user agents, even added delays between requests—but that dreaded "Access Denied" page keeps haunting you. What are you missing?

Here's the brutal truth that anti-bot vendors don't want you to know: most scrapers fail not because of what they do, but because of what they are. Every time your automated browser loads a page, it leaks hundreds of microscopic signals—WebGL fingerprints, canvas hashes, audio context signatures, font renderings—that form an unmistakable "bot fingerprint." Modern anti-bot systems like Akamai Bot Manager, DataDome, and Cloudflare Bot Management don't just check your IP; they perform deep browser fingerprinting analysis that can identify automation frameworks with terrifying accuracy.

But what if you could turn the tables? What if you had a battle-tested arsenal of countermeasures, curated by someone who's spent months reverse-engineering the very systems designed to stop you?

Enter browser-fingerprinting—the open-source intelligence repository that's become the underground bible for serious web scrapers. This isn't another toy script. It's a comprehensive analysis of bot protection systems with available countermeasures, showing exactly how to defeat anti-bot systems and get around browser fingerprinting scripts when scraping the web.

Ready to stop losing and start winning? Let's dive deep.

What is Browser-Fingerprinting?

Browser-fingerprinting is a meticulously curated GitHub repository created by Dariusz Niespodziany that serves as both an educational resource and a practical toolkit for web scraping professionals. Born from months of hands-on experimentation against websites protected by major anti-bot vendors, this repository strips away the mystery surrounding bot detection and replaces it with actionable, field-tested intelligence.

The repository's full description says it all: "Analysis of Bot Protection systems with available countermeasures 🚿. How to defeat anti-bot system 👻 and get around browser fingerprinting scripts 🕵️‍♂️ when scraping the web?"

What makes this repository genuinely indispensable in 2024 is its timing. Anti-bot technology has undergone explosive evolution. Simple IP filtering and CAPTCHA challenges have given way to sophisticated behavioral analysis, machine learning models, and multi-layered fingerprinting that examines everything from your TLS handshake to your GPU shader cache. The arms race between scrapers and protectors has never been more intense—or more technically fascinating.

Browser-fingerprinting stands apart because it doesn't offer snake oil. It openly acknowledges the limitations of current evasion techniques while documenting precisely what works, what fails, and what's still an open problem. The repository covers technical deep-dives into puppeteer-extra-plugin-stealth capabilities, evaluates commercial stealth browsers like MultiLogin and Kameleo with unflinching honesty, and maintains an exhaustive list of fingerprint test pages for validating your own setups.

Perhaps most valuably, it includes a curated taxonomy of anti-bot providers—from Akamai and Imperva to emerging players like Kasada and Travatar—along with practical guidance on identifying which specific protection is blocking you. The community tool Botty McBotface, referenced in the repository, can automatically fingerprint the fingerprinters, giving you critical intelligence before you even write a line of scraping code.

Key Features That Make This Repository Essential

Comprehensive Anti-Bot Vendor Intelligence

The repository maintains a non-exhaustive but highly practical list of 17 major anti-bot software providers, including enterprise solutions like Akamai Bot Manager, Cloudflare Bot Management, Imperva (formerly Distil Networks), and HUMAN (formerly PerimeterX and WhiteOps). Each entry links to official documentation, enabling rapid threat assessment.

Scenario-Based Solution Mapping

Rather than prescribing one-size-fits-all answers, browser-fingerprinting categorizes evasion strategies by use case: short-lived sessions without authentication, geographically restricted targets, long-lived authenticated sessions, JavaScript^{↗ Bright Coding Blog}-based detection, and advanced browser fingerprinting scenarios. This structured approach prevents the common mistake of over-engineering simple scrapes or under-preparing for sophisticated targets.

Brutally Honest Stealth Browser Evaluations

The repository includes a detailed comparison table of 9 stealth browsers—including GoLogin, MultiLogin, Kameleo, and Incogniton—rating their Puppeteer/Selenium support, evasion quality, SDK capabilities, and origin transparency. The 🤮 symbol for "evasion based on noise" versus ✔️ for "acceptable" and 👍 for "very nice" provides instant visual assessment. Critical warning: The repository explicitly flags that some contain malware and should be used with caution.

Deep Technical Analysis of Evasion Gaps

For puppeteer-extra-plugin-stealth specifically, the repository provides a granular pass/fail/tie breakdown across 12+ detection vectors. This level of specificity is rare—most resources claim stealth plugins "just work," while this one documents exactly where they crumble: WebGL profiling, RTCPeerConnection behind proxies, Performance.now timing analysis, font fingerprinting, and behavioral detection.

Alternative Tool Ecosystem

When mainstream solutions fail, browser-fingerprinting points to emerging alternatives: nodriver (CDP-based Chrome control bypassing WebDriver leaks), rebrowser-patches (fixing Runtime.Enable CDP leaks), patchright (Playwright fork with similar patches), and camoufox (C++-level Firefox modifications). This forward-looking coverage ensures your toolkit stays current.

Fingerprint Test Page Compendium

With 25+ test pages ranging from basic (browserleaks.com) to extreme (creepjs by abrahamjuliot.github.io), the repository provides a complete validation suite. The annotation "Really creepy, the strongest of all" for creepjs isn't hyperbole—it's a warning that your evasion must pass the hardest tests to survive production.

Real-World Use Cases Where Browser-Fingerprinting Saves Your Project

E-Commerce Price Intelligence at Scale

Imagine monitoring competitor pricing across Amazon, Walmart, and Target. These platforms deploy aggressive bot detection—Amazon's systems are legendary for their sophistication. The repository's guidance on rotating IP pools for short-lived sessions combined with puppeteer-extra-plugin-stealth for JavaScript detection provides a proven foundation. For smaller retailers with custom protection, the "Scrapy script with tweaks" recommendation keeps costs minimal until scaling demands more.

Financial Services and Credit Card Processing

Payment processors like Adyen and Stripe implement what the repository identifies as "one of the most advanced cases" of browser fingerprinting. Here, sloppy evasion doesn't just get you blocked—it triggers fraud alerts that can damage legitimate business relationships. The repository's emphasis on natural-looking browser fingerprints covering the entire validation surface is critical. This means matching WebGL parameters, canvas fingerprints, audio context signatures, and ensuring consistency across Client Hints, navigator properties, and native extension presence.

Social Media^{↗ Bright Coding Blog} Automation and Long-Lived Sessions

Managing multiple advertising accounts or automating content distribution requires repeatable IP pools and stable browser fingerprints. The repository explicitly warns that profile misconfiguration in commercial tools like MultiLogin leads to "early property/behavior inconsistency detection." The solution? Meticulous fingerprint consistency across sessions, combined with region-specific proxies that match claimed geolocation—down to timezone, language, and even DNS resolution patterns.

Sneaker and Limited-Release Commerce

The repository references Business Insider reporting on sneaker bots attacking marketplace websites. These targets employ unique, specialized detection techniques that generic stealth tools can't touch. The recommendation for "specialized bot software that targets the unique detection surface" acknowledges that at this level, you're engaging in adversarial engineering—studying specific protection implementations and crafting bespoke countermeasures.

Geographic Content Access and Compliance Testing

When Cloudflare or similar systems block entire countries, the repository's region-specific IP pool strategy becomes essential. But raw IP rotation fails without matching fingerprint localization. The repository's technical insights on p0f OS detection from TCP structures reveal that mismatched OS claims between JavaScript and network-level signals trigger immediate flags. Proper implementation requires aligning every layer: IP geolocation, browser language, timezone, and even TLS fingerprint characteristics.

Step-by-Step Installation & Setup Guide

Prerequisites

Before implementing browser fingerprinting countermeasures, ensure you have:

• Node.js 16+ (for Puppeteer/Playwright-based solutions)
• Python^{↗ Bright Coding Blog} 3.8+ (for Scrapy-based approaches)
• Docker^{↗ Bright Coding Blog} (optional, for containerized fingerprint consistency)
• Access to quality proxy pools (residential or ISP-rotating)

Core Evasion Stack Installation

Step 1: Install puppeteer-extra with stealth plugin

# Initialize your project
npm init -y

# Install core puppeteer with extra plugins
npm install puppeteer puppeteer-extra puppeteer-extra-plugin-stealth

# For additional evasion plugins
npm install puppeteer-extra-plugin-anonymize-ua puppeteer-extra-plugin-user-preferences

Step 2: Verify stealth plugin installation

# Create test script to validate basic stealth
node -e "
const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');
puppeteer.use(StealthPlugin());
console.log('Stealth plugin loaded successfully');
"

Step 3: Configure proxy integration

For IP rotation, integrate your proxy provider. BrightData, Oxylabs, or ScrapingBee (recommended in the repository) provide different authentication methods:

# Example: ScrapingBee proxy format
# No direct npm install needed; use HTTP proxy integration
# Format: http://API_KEY:API_SECRET@proxy.scrapingbee.com:8886

Step 4: Install fingerprint validation tools

# For TLS fingerprint analysis
npm install -g tls-fingerprint

# For testing your setup against known detection pages
# No installation needed; use browser automation directly

Advanced: Rebrowser-Patches for CDP Leak Prevention

When puppeteer-extra-plugin-stealth proves insufficient against Runtime.Enable detection:

# Clone rebrowser patches
git clone https://github.com/rebrowser/rebrowser-patches.git
cd rebrowser-patches

# Apply patches to your Puppeteer installation
npm install
node apply-patch.js --target=puppeteer

# Verify patch application
node verify-patch.js

Environment Configuration for Maximum Stealth

Critical: The repository emphasizes that viewport configuration must respect screen resolution constraints. Implement proper display handling:

# For headful mode with virtual display (Linux servers)
sudo apt-get install xvfb
export DISPLAY=:99
Xvfb :99 -screen 0 1920x1080x24 &

Docker container setup for fingerprint consistency:

FROM node:18-slim

# Install Chromium dependencies and fonts for consistent rendering
RUN apt-get update && apt-get install -y \
    chromium \
    fonts-liberation \
    fonts-noto-color-emoji \
    xvfb \
    && rm -rf /var/lib/apt/lists/*

# Pin specific Chromium version for fingerprint stability
ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium

WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .

CMD ["node", "scraper.js"]

REAL Code Examples from the Repository

The browser-fingerprinting repository doesn't contain traditional "copy-paste" code snippets, but its technical insights enable powerful implementations. Here are production-ready patterns derived directly from its documented findings.

Example 1: Basic Stealth-Enabled Puppeteer with Critical Evasion Checks

This implementation incorporates the repository's findings on viewport constraints and navigator property consistency:

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

// Initialize stealth with all evasions enabled
puppeteer.use(StealthPlugin());

async function createStealthBrowser() {
  // CRITICAL: Viewport must be LESS THAN screen resolution
  // The repository documents that viewport >= screen resolution 
  // "almost always fails" in headless mode
  const viewport = { width: 1366, height: 768 };
  
  const browser = await puppeteer.launch({
    headless: 'new', // Use new headless mode for better compatibility
    args: [
      // Disable software rendering to avoid SwiftShader fingerprint
      // Repository notes: --use-gl=swiftshader caps FPS but leaks
      '--disable-gpu',
      '--disable-software-rasterizer',
      // Window size must accommodate viewport plus Chrome UI
      `--window-size=${viewport.width + 20},${viewport.height + 120}`,
      // Disable automation flags that stealth plugin might miss
      '--disable-blink-features=AutomationControlled',
    ],
    // Ensure consistent user data dir for session persistence
    userDataDir: './user_data_' + Date.now(),
  });

  const page = await browser.newPage();
  
  // Set viewport BEFORE navigation to avoid resize events
  await page.setViewport(viewport);
  
  // Validate critical properties match claimed environment
  const validation = await page.evaluate(() => {
    return {
      webdriver: navigator.webdriver,
      plugins: navigator.plugins.length,
      languages: navigator.languages,
      platform: navigator.platform,
      hardwareConcurrency: navigator.hardwareConcurrency,
      // Check for stealth plugin's expected modifications
      chrome: typeof chrome !== 'undefined',
    };
  });
  
  console.log('Stealth validation:', validation);
  // Expected: webdriver false, plugins > 0, chrome object present
  
  return { browser, page };
}

// Usage with proxy and request interception
async function scrapeWithEvasion(url, proxyUrl) {
  const { browser, page } = await createStealthBrowser();
  
  // Authenticate proxy if required
  if (proxyUrl) {
    await page.authenticate({
      username: process.env.PROXY_USER,
      password: process.env.PROXY_PASS,
    });
  }
  
  // Intercept and modify Client Hints to match User-Agent
  // Repository documents Client Hints as recently shipped in stealth
  await page.setExtraHTTPHeaders({
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    'sec-ch-ua-platform': '"Windows"',
    'sec-ch-ua-mobile': '?0',
  });
  
  try {
    await page.goto(url, { waitUntil: 'networkidle2' });
    // Your scraping logic here
    const content = await page.content();
    return content;
  } finally {
    await browser.close();
  }
}

module.exports = { createStealthBrowser, scrapeWithEvasion };

Why this matters: The repository's pass/fail analysis shows that viewport misconfiguration is a leading cause of stealth detection. This code enforces the critical constraint that viewport dimensions must never exceed claimed screen resolution.

Example 2: WebGL and Canvas Fingerprint Consistency Check

The repository identifies WebGL profiling and canvas fingerprinting as major detection vectors where puppeteer-extra-plugin-stealth fails. This implementation adds manual consistency checks:

async function validateWebGLConsistency(page) {
  // Extract WebGL parameters that anti-bot systems fingerprint
  const webglFingerprint = await page.evaluate(() => {
    const canvas = document.createElement('canvas');
    const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
    
    if (!gl) return { error: 'WebGL not supported' };
    
    const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
    
    return {
      // GPU vendor and renderer strings are heavily fingerprinted
      vendor: debugInfo ? gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) : 'unknown',
      renderer: debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : 'unknown',
      // These must be consistent with claimed OS and hardware
      vendorParam: gl.getParameter(gl.VENDOR),
      rendererParam: gl.getParameter(gl.RENDERER),
      // Shader precision formats vary by GPU
      shaderPrecision: gl.getShaderPrecisionFormat(gl.VERTEX_SHADER, gl.HIGH_FLOAT),
      // Max texture size indicates GPU class
      maxTextureSize: gl.getParameter(gl.MAX_TEXTURE_SIZE),
    };
  });
  
  // CRITICAL: Validate against claimed User-Agent
  // If UA claims Intel Mac, vendor should be Intel Inc., not NVIDIA
  const userAgent = await page.evaluate(() => navigator.userAgent);
  
  const inconsistencies = [];
  
  if (userAgent.includes('Mac') && webglFingerprint.vendor === 'NVIDIA Corporation') {
    inconsistencies.push('GPU vendor mismatch: Mac with NVIDIA is suspicious');
  }
  
  if (userAgent.includes('Windows') && webglFingerprint.vendor === 'Apple Inc.') {
    inconsistencies.push('GPU vendor mismatch: Windows with Apple GPU is impossible');
  }
  
  // Check for headless Chrome's typical SwiftShader signature
  if (webglFingerprint.renderer?.includes('SwiftShader')) {
    inconsistencies.push('SWIFTSHADER DETECTED: Immediate bot flag');
  }
  
  return {
    fingerprint: webglFingerprint,
    inconsistencies,
    isValid: inconsistencies.length === 0,
  };
}

// Apply noise-based evasion for canvas (limited effectiveness per repository)
async function applyCanvasNoise(page) {
  // The repository notes that "Audio and GL noise" in MultiLogin passes
  // but warns that "manipulation of original canvas... can be detected with custom JS"
  // This is a defensive measure, not a guaranteed bypass
  
  await page.evaluateOnNewDocument(() => {
    const originalToDataURL = HTMLCanvasElement.prototype.toDataURL;
    const originalGetImageData = CanvasRenderingContext2D.prototype.getImageData;
    
    // Add subtle noise that varies per session but is consistent within session
    const noiseSeed = Math.random();
    
    HTMLCanvasElement.prototype.toDataURL = function(...args) {
      // Apply noise only to fingerprinting-sized canvases
      if (this.width < 16 || this.height < 16) {
        return originalToDataURL.apply(this, args);
      }
      
      const ctx = this.getContext('2d');
      const imageData = ctx.getImageData(0, 0, this.width, this.height);
      
      // Imperceptible noise in least significant bits
      for (let i = 0; i < imageData.data.length; i += 4) {
        imageData.data[i] = (imageData.data[i] & 0xFE) | (Math.random() > 0.5 ? 1 : 0);
      }
      
      ctx.putImageData(imageData, 0, 0);
      return originalToDataURL.apply(this, args);
    };
  });
}

module.exports = { validateWebGLConsistency, applyCanvasNoise };

Critical insight from repository: The 🤮 rating for most commercial stealth browsers' evasion quality reflects that noise-based approaches are fundamentally detectable. The repository's honest assessment that this "can be detected with custom JS" means this code is a stopgap, not a solution.

Example 3: Multi-Layered Detection with Fallback to Alternative Drivers

When puppeteer-extra-plugin-stealth fails against advanced protections, the repository recommends nodriver or camoufox. This implementation provides graceful degradation:

# Python implementation using nodriver successor pattern
# Based on repository's recommendation to skip Selenium/Chromedriver entirely

import asyncio
import nodriver as uc

async def scrape_with_nodriver(url, proxy=None):
    """
    nodriver drives Chrome over CDP directly, eliminating WebDriver leaks.
    Repository notes: 'the WebDriver-flavored leaks are gone'
    """
    
    # Configuration matches repository's emphasis on consistency
    config = uc.Config(
        headless=False,  # Headless detection is trivial; use virtual display
        browser_args=[
            '--disable-blink-features=AutomationControlled',
            # Force consistent language and timezone
            '--lang=en-US',
            # Disable notifications that reveal automation
            '--disable-notifications',
        ]
    )
    
    if proxy:
        config.browser_args.append(f'--proxy-server={proxy}')
    
    # Start browser with explicit user data dir for fingerprint stability
    browser = await uc.start(
        user_data_dir='./nodriver_profile',
        browser_args=config.browser_args,
    )
    
    try:
        tab = await browser.get(url)
        
        # Wait for dynamic content with human-like pattern
        await tab.sleep(2 + asyncio.random() * 3)  # 2-5 seconds
        
        # Execute JS to verify absence of webdriver flag
        is_clean = await tab.evaluate('''
            () => ({
                webdriver: navigator.webdriver,
                chrome: !!window.chrome,
                cdc: !!window.$cdc_adoQpoasnfa76pfcZLmcfl_,
                __webdriver_script_fn: !!window.__webdriver_script_fn,
            })
        ''')
        
        print(f'Leak check: {is_clean}')
        # Expected: webdriver false, chrome true, cdc false, __webdriver_script_fn false
        
        # Extract content
        content = await tab.get_content()
        return content
        
    finally:
        browser.stop()

# Fallback chain based on target sophistication
def scrape_with_fallback(url, protection_level='unknown'):
    """
    protection_level: 'basic', 'javascript', 'fingerprinting', 'advanced'
    """
    
    strategies = {
        'basic': lambda u: requests.get(u, headers={'User-Agent': 'Mozilla/5.0...'}),
        'javascript': lambda u: puppeteer_stealth(u),
        'fingerprinting': lambda u: scrape_with_nodriver(u),
        'advanced': lambda u: camoufox_cplusplus_evasion(u),  # Custom build required
    }
    
    # Start with assumed level, escalate on failure
    for level in ['basic', 'javascript', 'fingerprinting', 'advanced']:
        if protection_level != 'unknown' and level != protection_level:
            continue
            
        try:
            result = strategies[level](url)
            print(f'Success with {level} strategy')
            return result
        except Exception as e:
            print(f'{level} failed: {e}')
            continue
    
    raise Exception('All strategies exhausted')

if __name__ == '__main__':
    asyncio.run(scrape_with_nodriver('https://example.com'))

Repository-derived insight: The explicit warning that "some [stealth browsers] contain malwares" and the nodriver recommendation to "skip Selenium/Chromedriver and drive Chrome over CDP directly" shapes this architecture. The CDP transport layer is harder to fingerprint than WebDriver protocols.

Advanced Usage & Best Practices

The p0f OS Detection Problem

The repository documents a critical, often overlooked vector: p0f detects host OS from TCP structure. No Puppeteer API can fix this. Akamai Bot Manager specifically cross-references p0f results against JavaScript-claimed OS. Your options: don't spoof the host OS at all, or deploy OSfooler-ng at the kernel level. Most scrapers ignore this and wonder why they fail.

Battery API and Sensor Emulation

Modern anti-bot systems check for impossible sensor combinations. A desktop browser claiming to be mobile but lacking gyroscope data, or showing fully charged battery perpetually, triggers flags. For mobile emulation, inject realistic sensor patterns with gradual drift—not static values.

Timing Attack Mitigation

The repository's "Performance.now - desc. tbd (red pill)" note hints at timing-based automation detection. Real human interactions have variable latency distributions. Your automation should too: randomize click-to-action delays with log-normal distributions, not uniform random. Event sequences should include micro-pauses and correction patterns (like moving toward a button, overshooting, correcting).

TLS Fingerprint Alignment

With JA3/JA4 fingerprinting now standard, your HTTP client library's TLS handshake is a screaming signature. The repository references tls.peet.ws as the ja3er replacement. Ensure your scraping stack's TLS fingerprint matches your claimed browser version—or use a proxy that handles TLS termination with correct fingerprints.

Session Warming

Fresh browser profiles are suspicious. The repository's emphasis on "natural looking browser fingerprints" extends to behavioral history. Before target interaction, perform realistic browsing: search queries, scroll patterns, page dwell times. Commercial tools like MultiLogin partially automate this; custom solutions require building "warming" pipelines.

Comparison with Alternatives

Verdict: Browser-fingerprinting isn't a tool you run—it's intelligence you apply. It complements rather than replaces commercial solutions, helping you evaluate whether their cost is justified and identify when they're failing.

FAQ

What exactly does the browser-fingerprinting repository provide?

It's a curated intelligence resource analyzing bot protection systems and their countermeasures. Unlike libraries you install, it's knowledge you apply—vendor profiles, evasion technique evaluations, test resources, and honest assessments of what works versus what fails.

Is puppeteer-extra-plugin-stealth enough for modern anti-bot systems?

No. The repository explicitly documents 8+ detection vectors where stealth fails, including WebGL profiling, RTCPeerConnection proxy leaks, and core-estimator hardware concurrency detection. It's a starting point, not a complete solution.

How do I identify which anti-bot system is blocking me?

Use the community tool Botty McBotface referenced in the repository, available through extra.community. It employs multiple techniques to fingerprint the specific protection in use, saving hours of manual reverse engineering.

Are commercial stealth browsers like MultiLogin worth the cost?

The repository gives them mixed reviews: acceptable for basic automation, but marked with 🤮 for "evasion based on noise" and documented failures in native extension emulation, AudioContext override detection, and profile inconsistency risks. Evaluate against your specific target's sophistication.

What's the most underrated detection vector most scrapers miss?

p0f OS detection from TCP structure. No JavaScript evasion can fix this. If your containerized scraper claims to be Windows but the TCP handshake screams Linux, Akamai and similar systems flag you instantly. Fix at the OS level or don't spoof.

Can anti-bot systems be completely defeated?

The repository's non-technical section is explicit: "Anti-bot software is nonsense... sold to people without technical knowledge." It reduces cheap bot traffic but "does not make it entirely impossible." The arms race continues; sophistication wins.

What's the safest approach for a new scraping project?

Follow the repository's scenario table. Start minimal: Scrapy with tweaks and cheap datacenter proxies for small targets. Escalate to rotating IPs, then JavaScript rendering, then full fingerprint management only when actually required by your target's protection level.

Conclusion

The war between scrapers and anti-bot systems isn't ending—it's accelerating into ever-deeper technical territory. What separated successful scrapers from blocked ones in 2020 (rotating IPs, basic header spoofing) is now table stakes. The battleground has shifted to WebGL shader caches, audio context waveforms, TLS fingerprint micro-structures, and behavioral biometrics that most developers don't even know exist.

browser-fingerprinting is the field manual for this new battlefield. It won't write your scraper for you, but it will save you from the catastrophic mistakes that come from trusting oversimplified "stealth" solutions. Its honest documentation of failures—marked with stark ❌ symbols—is more valuable than any marketing claim of guaranteed invisibility.

Whether you're building your first crawler or maintaining infrastructure that processes millions of requests daily, this repository deserves a permanent place in your reference arsenal. The anti-bot vendors have their playbooks. Now you have yours.

Clone it. Study it. Apply it. And when you succeed where others fail—give it the ⭐ it deserves.

Have problems with scraping a specific website? The repository's author welcomes short emails at dniespodziany@gmail.com. The scraping community thrives on shared intelligence—contribute back when you can.