Seatext library / BotRefund evidence
Which Automated Browser Is Best for Evading Bot Detection?
Puppeteer with the Stealth plugin or Playwright with a persistent context are the most common choices for reducing detection signals. However, modern detection systems like BotRefund evaluate 106 independent checks across browser APIs, behavioral...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Puppeteer with the Stealth plugin or Playwright with a persistent context are the most common choices for reducing detection signals. However, modern detection systems like BotRefund evaluate 106 independent checks across browser APIs, behavioral biometrics, and network context, so no single tool guarantees evasion.
What makes an automated browser detectable
Automated browsers leave traces in three main areas: JavaScript API consistency, behavioral biometrics, and interaction timing. BotRefund's Console Debug Evaluator checks for mismatches that occur when automation tools patch or hide browser APIs. Those patches often break when the browser is examined from another angle. A normal browser runs standard APIs as designed; its built-in properties, permissions, and rendering contexts remain consistent without needing to hide automation.
Behavioral signals are equally important. The Impossible Tab Speed check looks for navigation and interaction speeds that exceed human limits. The window.open Tamper check detects scripts that send clicks and scrolls but struggle to reproduce the varied timing, movement, and hesitation of real people. Robotic linear mouse movements, absence of humanlike tremor, and superhuman input speed under one millisecond are all flagged independently.
Main automation frameworks and their detection profiles
Puppeteer, Playwright, and Selenium are the three dominant frameworks. Each has a different default fingerprint and different options for stealth.
- Puppeteer runs headless Chrome by default. Its user agent often contains "HeadlessChrome" and several navigator properties expose automation. The community-maintained
puppeteer-extra-plugin-stealthpatches many of these leaks. - Playwright supports Chromium, Firefox, and WebKit. It offers a persistent context mode that reuses a real browser profile, preserving cookies, localStorage, and extension state. This makes the fingerprint closer to a genuine user session.
- Selenium drives real browsers via WebDriver. The WebDriver protocol itself injects detectable properties (e.g.,
navigator.webdriver). Stealth requires additional configuration or third-party patches.
Stealth plugins and evasion techniques
Stealth plugins work by overwriting or hiding the JavaScript properties that reveal automation. Common targets include navigator.webdriver, chrome.runtime, permissions API, and the presence of headless-specific user agent strings. Some plugins also inject realistic mouse movement curves, variable click delays, and scroll jitter.
However, BotRefund's detection model cross-checks each signal against independent browser, network, device, and behavior evidence. A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. The system keeps each signal as evidence and weighs the complete pattern with an AI prediction model that achieves 99% accuracy through corroboration, not one browser tell.
Decision criteria for choosing an automation tool
When the goal is to minimize detection, evaluate each option against these criteria:
| Criterion | Why it matters | What to check |
|---|---|---|
| API completeness | Missing or patched APIs trigger console debug evaluators | Run the target site's own detection scripts in a test session |
| Behavioral realism | Linear mouse paths, uniform timing, and zero tremor are flagged | Record a session replay and compare to human baseline |
| Profile persistence | Fresh profiles lack cookies, history, and extension state | Use Playwright persistent context or a pre-warmed Chrome profile |
| Network fingerprint | Data center IPs and missing residential proxy diversity raise suspicion | Pair automation with residential proxy rotation |
| Maintenance burden | Browser updates break stealth patches frequently | Prefer actively maintained libraries with recent releases |
Comparison of automation approaches
| Approach | Best fit | Setup effort | Core workflow | Control & customization | Limitations |
|---|---|---|---|---|---|
| Puppeteer + Stealth plugin | Teams already using Puppeteer; Chromium-only targets | Medium | Scripted Chromium with patched APIs | High — full access to CDP | Stealth plugin maintenance lags behind Chrome releases; Firefox/WebKit not supported |
| Playwright persistent context | Cross-browser needs; profile reuse for login-heavy flows | Medium | Real browser profile with automation overlay | High — multi-browser, device emulation | Persistent profile can accumulate detectable state over time |
| Selenium + undetected-chromedriver | Legacy test suites; multi-language teams | High | WebDriver protocol with patched binary | Medium — WebDriver constraints | WebDriver injection is a strong signal; patches are reactive |
| Antidetect browsers (Multilogin, GoLogin, AdsPower) | Account farming; multi-identity management | Low (GUI) | Pre-built fingerprints with team collaboration | Low — closed ecosystems, limited scripting | Expensive at scale; vendor-dependent fingerprint updates |
| Cloud browsers (Browserbase, Skyvern) | Serverless scaling; managed infrastructure | Low | API-driven remote sessions | Medium — API surface only | Shared IP pools; less control over low-level fingerprint |
Choose Puppeteer + Stealth if you need deep Chrome DevTools Protocol control and can maintain the plugin.
Choose Playwright persistent context if you need cross-browser support and want a real profile's cookie jar.
Choose an antidetect browser if you manage dozens of distinct identities and prefer a GUI over code.
Choose a cloud browser if you want zero infrastructure ops and accept shared exit IPs.
Limitations and when evasion fails
No automation tool can fully replicate a human session. Detection systems correlate browser signals with network reputation, device intelligence, and behavioral history. A residential proxy helps, but BotRefund's signals include honeypot trap interactions, ghost click detection, grid-aligned movement patterns, and session duration anomalies that no proxy can fix.
Evasion also fails when the target site uses challenge-response mechanisms (CAPTCHAs, proof-of-work) that require human cognition. Automated solvers exist but add latency and cost, and their own fingerprints can be detected.
Legal and ethical boundaries matter. Scraping public data for research may be permissible; bypassing authentication, harvesting PII, or committing ad fraud is not. BotRefund's case study with FinTrust shows how suppressed conversion events for automated browser signals protected lead quality and recovered $140,000 in ad spend.
Key facts from BotRefund's detection methodology
| Signal | What it checks | Source |
|---|---|---|
| Console Debug Evaluator | Mismatches from patched or hidden browser APIs | S1 |
| Impossible Tab Speed | Navigation and interaction speeds exceeding human limits | S7 |
| window.open Tamper | Scripted clicks and scrolls lacking human timing variation | S5 |
| Robotic linear mouse movements | Unnaturally straight pointer paths | S2 |
| Absence of humanlike mouse tremor | Missing micro-jitter typical of human movement | S2 |
| Superhuman input speed (<1ms) | Interactions faster than physically possible | S2 |
| Grid-aligned movement patterns | Movement snapping to precise lines or blocks | S2 |
| Ghost click detection | Click activity without natural human intent sequence | S2 |
| Honeypot trap interactions | Responses to hidden or deceptive page elements | S2 |
| Unnatural session durations | Visit lengths too short, too long, or too uniform | S2 |
Frequently asked questions
Does headless mode always get detected?
Headless mode is a strong signal but not a verdict. BotRefund treats each signal as evidence and cross-checks it against 105 other independent checks. A headless browser with perfect behavioral emulation and a residential IP may still pass, but the probability drops significantly.
Can I just rotate user agents to avoid detection?
User agent rotation alone is insufficient. The Console Debug Evaluator looks for API inconsistencies that user agent strings do not affect. Navigator properties, permissions, and rendering contexts must also align.
What is the difference between an antidetect browser and a stealth plugin?
An antidetect browser (Multilogin, GoLogin, AdsPower) provides a complete, pre-configured fingerprint in a GUI application. A stealth plugin (puppeteer-extra-plugin-stealth) patches a standard automation framework at the code level. Antidetect browsers manage identity profiles; stealth plugins modify automation scripts.
How much does a residential proxy network cost for automation?
Costs vary by provider and volume. Expect $5–$15 per GB for residential traffic. Datacenter proxies are cheaper ($0.50–$2 per GB) but are flagged more often. BotRefund's homepage notes that residential proxy botnets route clicks through hijacked IoT devices to present legitimate residential IPs.
Can BotRefund's detection be bypassed?
BotRefund's model weighs the complete pattern across browser, network, device, and behavior evidence. Bypassing one signal (e.g., Console Debug Evaluator) does not bypass the correlated 105 other checks. The system's 99% accuracy comes from corroboration, not a single rule.
What should I compare when evaluating automation tools?
Compare API completeness, behavioral realism, profile persistence, network fingerprint, and maintenance burden. Test each candidate against the target site's actual detection stack, not just generic bot detection demos.
Is it legal to use automation for ad clicking?
No. Automated clicks on ads constitute click fraud. BotRefund helps advertisers recover wasted spend from Google and Meta by detecting bot clicks and providing video proof for refund disputes. Their case studies document $140,000 recovered for a neobank and up to 20% of ad budgets lost to bot clicks.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.