Seatext library / BotRefund evidence
Browser Settings That Expose Automation: What You Need to Know
Settings like navigator.webdriver, missing plugins, inconsistent screen resolution, non-standard user agents, and CDP or init-script leaks expose automation. These signals are cross-checked against network, device, and behavior data to avoid false positives.
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Browser Settings That Expose Automation: What You Need to Know
The browser settings that most often reveal automation are navigator.webdriver, missing plugins and Asset Starvation remnants, inconsistent screen resolution and rendering contexts, non-standard user agents, and CDP Runtime.enable Leak, CDP Debugger Leak, CDP Stack Trace Trap, and Playwright Init Scripts leaks. Each is only one piece of evidence; BotRefund cross-checks them against independent network, device, and behavior signals before scoring a visit.
Decision Criteria: Which Settings to Fix First
| Setting / Signal | Detection Likelihood | Difficulty to Adjust | Safe for Legitimate Use? | Recommendation |
|---|---|---|---|---|
| navigator.webdriver (Automation Properties) | High | Low | Yes — disable via CDP or launch flags | Fix first; standard stealth practice |
| Missing plugins / Asset Starvation | Medium | Medium | Yes — load real plugin list | Populate realistic plugin array |
| Inconsistent screen resolution / rendering context | Medium | Low | Yes — set consistent viewport | Match common device profiles |
| Non-standard user agent | High | Low | Yes — use real UA string | Rotate from genuine browser list |
| CDP Runtime.enable / Debugger / Stack Trace leaks | High | High | Conditional — may break debugging | Disable CDP in production; use stealth plugins |
| Playwright Init Scripts | High | High | Conditional — requires patching | Use stealth patches; test thoroughly |
Conditional recommendation: If you run legitimate automation (testing, scraping), prioritize fixes that don't break your workflow. Disable CDP only in production; keep it for local debugging.
Understanding Browser Automation Detection
Websites and anti-bot services inspect the browser environment for telltale signs of programmatic control. No single setting proves a bot; instead, detectors collect dozens of independent signals and weigh them together. BotRefund runs 106 such checks, grouping them into categories like Evasion, Debugger, & Anti-Stealth Traps and FlareSolverr Specific Diagnostics. Each check adds one objective fact. The final verdict comes from an AI model that evaluates the complete pattern across browser, network, device, and behavior evidence.
navigator.webdriver and Automation Properties
The navigator.webdriver property is the classic flag. When a browser is driven by Selenium, Playwright, or Puppeteer, this property returns true. A normal user's browser returns false or undefined. BotRefund's Automation Properties check goes further: it looks for mismatches in built-in properties, permissions, and rendering contexts that automation tools patch but cannot fully hide. For example, a stealth plugin may delete navigator.webdriver but leave inconsistent navigator.permissions state. That mismatch becomes independent evidence.
Practical adjustment: launch the browser with --disable-blink-features=AutomationControlled (Chromium) or use a stealth plugin that redefines the property before any script runs. Test by opening DevTools console and typing navigator.webdriver — it must return false.
Missing Plugins and Asset Starvation
A fresh automation profile often has zero plugins. Real browsers usually show PDF viewers, Widevine DRM, or extension remnants. BotRefund's Asset Starvation check detects tool-specific shortcuts or missing assets that ordinary visitors never create. For instance, a headless Chrome instance may lack the internal chrome://components/ entries that a normal install populates.
Practical adjustment: use a persistent user-data directory with a real profile, or inject a realistic navigator.plugins array via CDP Page.addScriptToEvaluateOnNewDocument. Include common MIME types like application/pdf and application/x-google-chrome-pdf. Verify with navigator.plugins.length in console.
Screen Resolution and Rendering Context Inconsistencies
Automation scripts often set a fixed viewport (e.g., 1280×720) but forget to align screen.width, screen.height, devicePixelRatio, and window.outerWidth/outerHeight. A real device keeps these consistent. BotRefund cross-checks the rendering context: canvas fingerprint, WebGL renderer string, and CSS media queries must agree with the reported resolution.
Practical adjustment: choose a real device profile (e.g., MacBook Pro 14" 2023) and apply its full screen object. Use Emulation.setDeviceMetricsOverride with matching deviceScaleFactor and mobile flag. Then verify screen.width === window.outerWidth and window.devicePixelRatio matches.
Non-Standard User Agents and CDP Leaks
A mismatched user agent is an immediate red flag. But modern detectors also watch for CDP Runtime.enable Leak, CDP Debugger Leak, and CDP Stack Trace Trap. These occur when the automation framework attaches a Chrome DevTools Protocol client and forgets to disable domains like Runtime, Debugger, or Console. The browser then exposes internal IDs, stack traces, or evaluation contexts that a human-driven session never shows.
Practical adjustment: if you use CDP for stealth (e.g., Page.addScriptToEvaluateOnNewDocument), explicitly disable Runtime.enable, Debugger.enable, and Console.enable after setup. In Playwright, launch with cdpPort: 0 to avoid opening a CDP endpoint. Test by checking window.chrome.runtime — it should be undefined in a normal page context.
Playwright Init Scripts and Debugger Traps
Playwright injects init scripts to override APIs before page load. BotRefund's Playwright Init Scripts check looks for the side effects of those patches: redefined getters, altered prototype chains, or timing differences in performance.timing. The CDP Stack Trace Trap catches cases where an error stack trace reveals internal script names like playwright:// or puppeteer://.
Practical adjustment: use community stealth patches (e.g., playwright-stealth) that randomize the injected script names and clean up prototype modifications. Run a self-check: throw an error in the page and inspect error.stack for automation fingerprints. If found, adjust the patch to sanitize stack frames.
Why These Settings Matter for Ad Protection
Ad platforms optimize toward conversion signals. When bots click ads and mimic conversions, the algorithm learns to buy more bot traffic. BotRefund data shows that even 30% bot contamination can poison a campaign's targeting, draining budget on fake engagement. Each browser signal — Automation Properties, Asset Starvation, CDP leaks, Init Scripts — helps build a session-level verdict. That verdict becomes a refund-ready report with click IDs, timestamps, and signal-by-signal reasoning that Google and Meta accept.
Practical Adjustments and Trade-offs
Fixing every signal perfectly is hard. Some stealth measures break legitimate features: disabling CDP prevents remote debugging; patching navigator.webdriver may conflict with certain testing frameworks. Prioritize based on the decision table above. For scraping, a persistent profile with real plugins and a matching device profile covers 80% of detection. For testing, keep CDP enabled locally but disable it in CI pipelines. Always validate with a detection test page (e.g., bot.sannysoft.com) before deploying.
Limitations and False Positives
Privacy tools (Brave, Tor, hardened Firefox), corporate proxies, VPNs, and unusual devices (kiosks, embedded browsers) can trigger the same signals. BotRefund treats each signal as evidence, not a verdict. A user on a corporate laptop with a non-standard UA and missing plugins is not a bot if their network reputation, mouse dynamics, and session flow are human. The AI model weighs the complete pattern. This cross-checking is why the system reaches 99% accuracy without blocking real users.
Key Facts
| Signal | Source | What It Checks | Cross-Checked Against |
|---|---|---|---|
| Automation Properties | S4 | navigator.webdriver, permissions, rendering context mismatches | Network, device, behavior |
| Playwright Init Scripts | S1 | Injected script side effects, prototype changes | Network, device, behavior |
| CDP Runtime.enable Leak | S5 | Exposed Runtime domain, internal evaluation contexts | Network, device, behavior |
| CDP Debugger Leak | S7 | Debugger domain attachment, breakpoint artifacts | Network, device, behavior |
| CDP Stack Trace Trap | S8 | Automation frame names in error stacks | Network, device, behavior |
| Asset Starvation | S6 | Missing plugins, tool-specific shortcuts | Network, device, behavior |
Frequently Asked Questions
- What is the single most revealing browser setting?
navigator.webdriveris the most direct flag, but modern detectors rely on combinations. Fixing it alone is not enough. - Can I just use a random user agent? No. The UA must match the screen resolution, platform, and rendering engine. Mismatches are easier to detect than a static UA.
- Do stealth plugins guarantee invisibility? No. They reduce signal surface but introduce new artifacts (patched prototypes, timing differences). Test continuously.
- Why does BotRefund keep signals as evidence instead of verdicts? Because privacy tools, corporate networks, and rare devices create false positives. Cross-checking across 110+ signals prevents blocking real humans.
- How do I know if my automation is detected? Run a session through a free bot audit. You'll get a signal-by-signal breakdown and see which checks fired.
- Is it legal to evade bot detection? For legitimate testing and authorized scraping, yes. For fraud, ad clicking, or unauthorized access, no. Check your jurisdiction and terms of service.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.