How to Avoid Detection When Using Playwright: Step-by-Step Guide

Avoiding detection when using Playwright requires eliminating the small, consistent tells that automation tools leave behind, even when running in headful mode. Standard Playwright configurations expose automation-specific signals that bot detection systems flag reliably, so you will need to combine stealth plugins, fingerprint tweaks, human-like interaction patterns, and configuration adjustments to reduce your footprint. These steps work for most common use cases, but no method is 100% undetectable against advanced, targeted detection systems.

What Makes Playwright Detectable?

Bot detection systems look for mismatches between expected real browser behavior and the signals automation tools produce. One common check, the Playwright Init Scripts check, looks for mismatches in browser API behavior that real browsing sessions do not create. Automation tools often patch or hide browser APIs to hide automation, but those changes can break when the browser is checked from a different angle, creating a detectable anomaly.

Detection systems do not rely on a single signal to flag a bot. They cross-reference multiple data points—including browser properties, network context, device details, and interaction behavior—to build a full picture of a visit. A single anomaly is rarely enough to trigger a block, but consistent tells across multiple checks make automation easy to spot.

Prerequisites for Stealth Configuration

Before implementing these steps, make sure you have the following ready:

• Node.js 16 or later installed on your machine
• Playwright 1.20 or later installed in your project
• Basic familiarity with writing and running Playwright scripts
• Optional: The playwright-extra library for plugin support (recommended for easier stealth patching)

Step 1: Install and Configure Playwright Stealth Plugins

The fastest way to eliminate common automation tells is to use the playwright-stealth plugin, which patches dozens of known detection vectors automatically. First, install the required packages by running this command in your project directory:

npm install playwright playwright-extra playwright-stealth

Next, update your Playwright script to load the stealth plugin before launching the browser. This ensures all stealth patches apply automatically to every new page context you create. For most use cases, no additional configuration is needed after loading the plugin, as it handles patching for common tells like automation-controlled browser features and missing plugin data.

Step 2: Modify Browser Fingerprint Values

Fingerprinting checks compare your browser's reported properties against expected values for real user devices. Default Playwright values are consistent and easy to detect, so you will need to override them to match real browser behavior:

• Set a custom user agent that matches a common, up-to-date browser version (avoid outdated or headless-specific user agents)
• Override the viewport size to match a standard desktop or mobile resolution (do not use the default Playwright viewport dimensions)
• Spoof WebGL vendor and renderer values to match real GPU hardware (default Playwright WebGL values are a common detection tell)
• Set timezone and locale to match the region associated with your user agent

You can set these values manually in your Playwright launch configuration, or use a library like fingerprint-injector to automate patching for all common fingerprinting vectors.

Step 3: Add Human-Like Interaction Delays

Bots interact with pages at consistent, machine-like speeds, while humans have variable wait times between actions. Add random, non-repeating delays to all interactions to mimic human behavior:

• Add a 500ms to 3000ms random wait before navigating to a new page or loading new content
• Add a 200ms to 1500ms random delay between clicking an element and interacting with the next element
• Use variable typing speeds for form fields: 50ms to 200ms per character, with occasional longer pauses to mimic thinking or editing

Avoid fixed, repeating delay patterns (e.g., always waiting exactly 1 second between clicks), as these are also detectable by behavior analysis systems.

Step 4: Avoid Default Headless Mode Configurations

Headless mode (running Playwright without a visible browser window) has historically had more detectable tells than headful mode, though recent Playwright versions have reduced this gap. If your use case allows, run in headful mode first to test your setup, as it is easier to debug and less likely to trigger basic detection checks.

If you must use headless mode, add the --disable-blink-features=AutomationControlled flag to your browser launch arguments to hide the automation-controlled blink feature. Also avoid using the default headless user agent, which often includes "HeadlessChrome" in its string, a clear automation tell.

Step 5: Verify Your Setup Against Detection Checks

Never deploy a stealth-configured Playwright script to production without testing it first. Use public bot detection test pages or open-source detection test suites to check for remaining automation tells. Run your script 5 to 10 times against the test page, and confirm no detection flags are raised before using it on target sites.

If flags do appear, review the specific signal that was flagged (e.g., WebGL mismatch, API behavior anomaly) and adjust your configuration to address that specific tell. Repeat the verification step after each adjustment to confirm the issue is resolved.

Common Mistakes to Avoid

• Relying only on headful mode: Many detection systems check for API behavior mismatches regardless of whether the browser window is visible, so headful mode alone is not enough.
• Using fixed, repeating delays: Variable, random delays are required to mimic human interaction patterns; fixed delays are easy to detect.
• Forgetting to patch WebGL and canvas fingerprints: These are high-signal tells that many detection systems check before other signals.
• Using outdated user agents: Detection systems flag user agents that do not match current, widely used browser versions.
• Skipping verification: Even a fully configured script can have unpatched tells that only show up when tested against detection systems.

Limitations of Playwright Stealth

No stealth configuration is 100% effective against advanced, targeted detection systems that use custom checks or machine learning models trained to identify your specific automation pattern. Stealth plugins only patch known, public detection vectors, so custom or proprietary detection systems may still flag your script even with all patches applied.

If you are scraping sites with strong anti-bot measures (such as Cloudflare, Akamai, or custom enterprise detection systems), you may need to add additional layers like residential proxy rotation, session reuse, or custom behavior tweaks to avoid detection. Also, many sites’ terms of service prohibit automated access, so ensure your use case complies with applicable rules before deploying stealth configurations.

Frequently Asked Questions

Do stealth plugins work for all Playwright detection systems?

No. Stealth plugins only patch known, public detection vectors. Custom or advanced detection systems that use proprietary checks or machine learning models may still detect your script even with all plugins enabled.

Is headless mode always detectable?

No. Recent Playwright versions have reduced many of the historical tells of headless mode, but headful mode with stealth patches is still more reliable for avoiding detection against most systems.

What is the most common tell that detection systems catch?

The most common tell is mismatched browser API behavior, such as the Playwright Init Scripts check that looks for automation-specific patches to standard browser APIs that real browsing sessions do not produce.

Can I use Playwright stealth for web scraping without getting blocked?

It works for many low-to-medium security sites, but high-security sites with advanced anti-bot measures may still detect your script even with all stealth patches applied. You may need additional layers like proxy rotation for these sites.

Do I need to rotate IP addresses with stealth plugins?

For most low-to-medium security sites, no. But for sites that track IP reputation or block data center IP ranges, you will need to use residential proxies in addition to stealth patches to avoid detection.

How often do I need to update my stealth configuration?

Update your Playwright version and stealth plugins regularly, as new browser versions and new detection vectors are released frequently. Outdated plugins will not patch new detection checks.