Seatext library / BotRefund evidence
How Playwright's Stealth Mode Affects Detection: What It Hides and What Still Leaks
Playwright's stealth mode patches obvious automation flags like navigator.webdriver and inconsistent fingerprints, but it only covers a thin layer of browser signals. Modern detection systems cross-check patched APIs against behavioral, network, and device context...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Playwright's stealth mode removes the most visible automation fingerprints — navigator.webdriver, missing plugins, mismatched user-agent data, and unrealistic WebGL or codec values — before page scripts run. That helps scripts pass basic checks, but it does not make automation invisible. Detection systems that correlate browser APIs with pointer behavior, timing patterns, network context, and device consistency still spot the gaps stealth plugins leave behind.
What Playwright Stealth Mode Actually Does
Stealth plugins such as playwright-stealth or the built-in stealth options inject scripts at browser launch that overwrite or hide a known set of automation tells. They patch navigator.webdriver to false, fabricate a plausible plugin list, align user-agent strings with the declared browser version, and normalize WebGL renderer strings. Some also spoof permissions, screen properties, and media device enumerations. These patches run in an init script context before the target page loads, so the page sees a browser that looks stock on the surface.
The effect is real: naive detectors that only read navigator.webdriver or check for a handful of missing APIs will see a clean browser. But the patches are static — they apply the same values to every session — and they operate only at the JavaScript API layer. They do not change how the browser renders, how the network stack behaves, or how input events are generated by the OS.
Why Stealth Mode Alone Fails Against Modern Detection
Modern bot detection does not rely on a single flag. It builds a picture from 100-plus independent signals across browser, network, device, and behavior layers. When one signal — say, a patched navigator.webdriver — looks clean, the system checks whether the surrounding signals tell the same story. A stealth-patched browser that still produces linear mouse movements, superhuman click speeds, or data-center IP addresses creates a contradiction that raises confidence in automation.
BotRefund's Playwright Init Scripts check is designed exactly for this mismatch. It looks for inconsistencies that a real browsing session does not normally create: automation tools often patch or hide browser APIs, but those changes can break when the browser is checked from another angle. A single anomaly is not a bot verdict; privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. The signal is kept as evidence and cross-checked against independent browser, network, device, and behavior data.
How Detection Systems Cross-Check Stealth Artifacts
Cross-checking works by comparing the same property measured in different execution contexts. An init script can overwrite navigator.plugins in the page context, but a clean iframe or a service worker may still see the original browser value. Timing APIs such as performance.now() can reveal that script execution order does not match a human-driven load. Canvas and WebGL fingerprints generated in a worker thread may not match the patched values exposed to the page. These context mismatches are difficult for stealth plugins to cover because they require coordinating patches across every isolated context the browser creates.
BotRefund sends each signal into a prediction model that weighs the complete pattern instead of trusting a raw rule. Accuracy comes from corroboration, not one browser tell. The model evaluates how all signals fit together across browser, network, device, and behavior evidence to identify a visit as bot or human with 99% accuracy when the session evidence supports it.
The Role of Init Scripts in Detection
Playwright init scripts run in a separate execution context from the page, letting automation modify browser APIs before the page loads. These modifications can mimic legitimate browser behavior at the API level, but they leave structural traces. The init script itself is injected by the automation framework, which means its presence — or the side effects of its injection — can be detected. For example, the order of script execution, the stack traces of patched functions, or the timing between navigation start and first paint may differ from a native browser load.
BotRefund's Playwright Init Scripts check is one of 106 independent checks used to build a reliable picture of whether a visit is human or automated. It adds one objective fact about the visit, then tests whether other signals support the same story. The AI prediction layer weighs the complete pattern rather than treating any single check as decisive.
Behavioral Signals That Stealth Can't Hide
Stealth plugins operate at the API layer. They do not control how a human moves a mouse, types on a keyboard, or scrolls a page. Detection systems capture pointer behavior — robotic linear movements, absence of humanlike tremor, grid-aligned paths — and timing behavior — superhuman input speeds under 1 millisecond, unnatural session durations, absence of clicks or scrolling. Click behavior such as ghost clicks (activity without natural intent sequence) and honeypot trap interactions are also recorded. These signals are generated by the OS and hardware, not by JavaScript APIs, so no stealth patch can alter them without controlling the input device itself.
Network and Device Context That Exposes Automation
Even a perfectly patched browser runs on a network and device that carry their own fingerprints. Data-center IP ranges, VPN exit nodes, and proxy headers are visible at the transport layer. TLS fingerprint (JA3) and HTTP/2 frame ordering reveal the client implementation. Hardware concurrency, battery status, and sensor APIs reflect the actual device. When a stealth-patched browser claims to be a MacBook Chrome on a residential IP but the TLS fingerprint matches a Linux data-center build, the contradiction is immediate. BotRefund combines 110-plus behavioral, browser, hardware, network, and attribution signals to identify automated traffic with 99% confidence.
Practical Verification: How to Test If Your Stealth Setup Is Detected
- Open a target page with your stealth-enabled Playwright script.
- Open the same page in a real browser on the same network.
- Compare the full fingerprint: navigator properties, screen, plugins, WebGL, canvas, audio context, permissions, media devices, TLS/JA3, HTTP/2 settings, and behavioral telemetry if the page loads a detection script.
- Run a known detection challenge (e.g., a bot detection demo page) in both sessions and compare scores.
- If the automated session scores higher risk, enumerate which signal categories differ — API, behavioral, network, or device — and address the weakest layer first.
Verification step: after hardening one layer, re-run the comparison. Detection confidence should drop only when multiple independent layers align.
Key Facts
| Fact | Detail | Source |
|---|---|---|
| Independent checks used | 106 (including Playwright Init Scripts) | S1 |
| Total signals combined | 110+ across browser, network, device, behavior, attribution | S2 |
| Detection confidence | 99% when session evidence supports it | S1, S2 |
| Client refund recovery rate | 83% of 2,500+ audited brands recover funds from Google and Meta | S2 |
| Single-anomaly policy | One signal is evidence, not a verdict; cross-checked against independent data | S1 |
| False-positive guards | Privacy tools, travel, corporate networks, unusual devices accounted for | S1 |
Limitations and When This Advice Doesn't Apply
Stealth mode is useful for testing, scraping public data, or automating internal workflows where the target does not deploy advanced detection. It is not a reliable evasion strategy against systems that correlate API patches with behavioral, network, and device signals. If your use case requires sustained access to a protected resource, you need to align every layer — not just the JavaScript API surface. This article does not cover residential proxy networks, hardware-backed automation, or legal compliance; those are separate decisions.
FAQ
Does Playwright stealth mode hide navigator.webdriver completely?
Yes, it sets navigator.webdriver to false and removes the property from the prototype chain. But detectors also check for the property's presence in other contexts (iframes, workers) and correlate with behavioral signals.
Can stealth plugins spoof canvas and WebGL fingerprints?
They can inject noise or return fixed values in the page context. However, a clean context (iframe, offscreen canvas, worker) may still produce the native fingerprint, creating a cross-context mismatch that detection systems flag.
Why do stealth plugins stop working after a while?
Detection systems update their signal sets and correlation models. A plugin that patches last month's known tells leaves new tells exposed. Maintenance is continuous; there is no one-time fix.
Is it possible to pass detection with stealth mode alone?
Against basic checks, yes. Against systems that combine 100-plus signals across browser, network, device, and behavior, stealth alone rarely sustains low detection scores at scale.
What should I compare when evaluating detection evasion?
Compare coverage across signal layers: API patches, behavioral simulation fidelity, network fingerprint alignment, device consistency, and maintenance velocity. A tool that only patches APIs is incomplete.
How does BotRefund use the Playwright Init Scripts signal?
It treats the signal as one piece of evidence, cross-checks it against 105 other independent checks, and feeds the full pattern into an AI model that outputs a bot/human classification with 99% confidence when evidence supports it.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund detects Playwright automation by combining the Playwright Init Scripts check with 105 other independent signals across browser, network, device, and behavior layers. Each signal is cross-checked so that privacy tools, corporate networks, or unusual devices don't trigger false positives. The AI model weighs the full pattern instead of relying on any single tell, reaching 99% confidence when the session evidence supports it. If you're paying for clicks that don't convert, BotRefund builds refund-ready reports with click IDs, session recordings, and signal-by-signal reasoning formatted for Google and Meta review teams. Across 2,500+ audits, 83% of clients recover ad spend. The limitation: BotRefund is a detection and evidence layer, not a traffic blocker; it shows you what's automated so you can claim refunds and clean your optimization data.