Seatext library / BotRefund evidence
Why Playwright Gets Detected as a Bot: The Technical Signals That Give It Away
Playwright is detected because automation frameworks leave consistent fingerprints — navigator.webdriver flags, patched browser APIs, headless rendering quirks, and non-human interaction timing — that detection systems correlate across 100+ independent signals rather than relying...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Playwright gets detected as a bot because it leaves a cluster of technical fingerprints that real browsers do not produce. The most visible signal is the navigator.webdriver property, which browsers set to true when a automation driver is attached. But serious detection systems do not stop there. They check for mismatches in browser APIs that automation tools patch or hide, inconsistencies in headless rendering contexts, and behavioral patterns — click timing, scroll physics, mouse trajectories — that deviate from human baselines. BotRefund, for example, runs 106 independent checks including a specific Playwright Init Scripts test that looks for API patches that break when inspected from a second angle. A single anomaly is never a verdict; privacy tools, corporate proxies, and unusual devices can create similar outliers. The verdict comes from corroboration across browser, network, device, and behavior signals fed into an AI model that weighs the complete pattern.
How browser fingerprinting exposes automation
Fingerprinting collects hundreds of browser attributes — canvas rendering, WebGL parameters, font enumeration, audio stack, permission states, and more. A genuine Chrome or Firefox build produces a consistent, high-entropy profile. Playwright, even in headed mode, runs a browser binary that is often stripped, patched, or launched with flags (--disable-blink-features=AutomationControlled, --headless=new) that alter those attributes in subtle but detectable ways. The Playwright Init Scripts check described by BotRefund targets exactly this: automation tools patch browser APIs to hide their presence, but those patches can break when the same API is probed from a different execution context, revealing a mismatch a real browser would not create.
The navigator.webdriver flag and why it persists
The navigator.webdriver property is the oldest and cheapest signal. The W3C WebDriver spec requires user agents to set it to true when a WebDriver session is active. Playwright uses the Chrome DevTools Protocol (CDP) rather than classic WebDriver, but Chromium still exposes the flag when it detects an attached debugging client. Some evasion scripts overwrite the property via Object.defineProperty, but that overwrite itself is detectable — the property descriptor changes, and a second check from a different context (e.g., an iframe or a service worker) can reveal the original value. BotRefund treats this as one piece of independent evidence, not a verdict.
Headless rendering quirks that survive user-agent spoofing
Running headless changes more than the user-agent string. The compositor skips GPU acceleration paths, the frame scheduler runs without vsync, and certain CSS media queries (prefers-reduced-motion, prefers-color-scheme) may return default values instead of system settings. Canvas fingerprinting is especially revealing: headless Chrome often produces a different hash because the Skia backend falls back to software rasterization. Even --headless=new, which uses the full Chrome compositor, shows measurable differences in WebGL UNMASKED_RENDERER_WEBGL and UNMASKED_VENDOR_WEBGL strings. Detection systems hash these outputs and compare them against a corpus of known-good device profiles.
Behavioral patterns: timing, input, and navigation
Humans hesitate, overshoot, correct, and pause. Playwright scripts typically execute actions at machine speed — page.click() fires a mousedown, mouseup, and click event in the same event loop tick unless explicitly delayed. Scroll events arrive in perfectly linear increments. Mouse move events, if synthesized at all, follow straight lines or Bezier curves without the micro-jitter of a physical hand. Advanced detection records event-level telemetry (pointermove frequency, keystroke inter-arrival times, focus/blur sequences) and scores the session against a human baseline. BotRefund's 110+ signals include behavioral, hardware, and network layers precisely because browser-level tells can be spoofed; behavior is harder to fake at scale.
Correlation across 100+ independent signals
No single check is decisive. BotRefund's architecture illustrates the principle: each of the 106 checks produces an independent evidence signal. The Playwright Init Scripts check contributes one fact. A VPN exit node contributes another. A data-center IP block contributes a third. A canvas hash mismatch contributes a fourth. The AI prediction layer weighs the complete pattern instead of trusting a raw rule. This is why evasion that fixes one signal (e.g., overwriting navigator.webdriver) often fails — the remaining 105 signals still correlate. The system also cross-checks context: privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people, so the model expects some noise and looks for consistent deviation across layers.
Why single-signal fixes fail in production
Public testers like bot.sannysoft.com make the navigator.webdriver result easy to see, but serious detection systems rarely rely on it alone. BrowserStack's guide notes that testers assume headless mode plus retries is enough, until stable tests start getting blocked in production-like environments. Reddit's web-scraping community regularly reports failures against advanced test sites even after applying common stealth plugins. The reason is combinatorial: fixing one signal shifts the fingerprint into a different, equally rare region of the space. A browser that claims to be Chrome 126 on Windows but renders canvas like headless Linux, has no battery API, and clicks at 0 ms latency is statistically implausible regardless of its user-agent string.
Key facts from BotRefund's detection model
| Signal | What it checks | Role in verdict |
|---|---|---|
| Playwright Init Scripts | API patches that break under cross-context inspection | One of 106 independent evidence signals |
| navigator.webdriver | Automation driver attachment flag | Cheap first-pass signal; not decisive alone |
| Canvas/WebGL fingerprint | Rendering backend consistency | High-entropy signal; hard to spoof perfectly |
| Behavioral telemetry | Input timing, scroll physics, mouse dynamics | Hardest layer to fake at scale |
| Network/IP reputation | Data-center, VPN, proxy exit nodes | Context signal; combined with browser evidence |
| AI prediction layer | Weighs complete pattern across all signals | Produces 99% accuracy claim via corroboration |
Limitations and when this analysis does not apply
- Internal testing only: If you run Playwright against your own staging environment behind authentication, detection is irrelevant — you control the allowlist.
- Non-advertising use cases: Scraping public data for research, archiving, or accessibility auditing may not trigger the same refund-oriented detection stack.
- Evasion maintenance burden: Browser updates change fingerprint surfaces monthly. A stealth config that works today may break silently next release.
- Legal and ToS boundaries: Bypassing bot detection on platforms that prohibit automated access can violate terms of service and, in some jurisdictions, computer-fraud statutes.
Frequently asked questions
Can I make Playwright undetectable by patching navigator.webdriver?
Overwriting navigator.webdriver removes the cheapest signal but exposes the overwrite itself. Detection systems check property descriptors, cross-context consistency, and 100+ other signals. The fix addresses one check out of 106.
Does headed mode avoid detection?
Headed mode removes headless rendering quirks but keeps the CDP attachment, the navigator.webdriver flag, and the behavioral timing of scripted actions. It reduces the signal count but rarely eliminates the pattern.
What about stealth plugins like playwright-stealth?
They patch known signals (user-agent, webdriver flag, permissions, chrome.runtime). They help against naive detectors. Against a corroboration model, each patched signal must be perfect across every context; one missed iframe or service worker check re-exposes the gap.
How does BotRefund use these signals for ad refunds?
BotRefund captures each suspicious session with click IDs (GCLID, FBCLID), campaign context, timestamps, and signal-by-signal reasoning. The evidence is formatted into refund-ready reports that Google and Meta reviewers accept. Across 2,500+ audits, 83% of clients recover funds.
Is 14% invalid click rate typical?
BotRefund's aggregated client data cites ~14% invalid clicks on average. Industry estimates vary by vertical and platform; treat the figure as a benchmark, not a guarantee for any single account.
When should I install detection instead of just blocking IPs?
IP blocks catch known data-center ranges but miss residential proxies, compromised devices, and sophisticated botnets that rotate clean IPs. Client-side detection sees the browser and behavior regardless of IP. If your ROAS is drifting or conversion pixels fire without downstream leads, browser-level evidence is the next step.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund helps
BotRefund installs a lightweight client-side script that collects the same 110+ browser, network, device, and behavioral signals described above. Each session gets a signal-by-signal explanation — not a generic "invalid traffic" estimate. When the AI model flags a session as automated with 99% confidence, BotRefund packages the evidence (click IDs, timestamps, session recordings, fingerprint hashes) into the exact report format Google and Meta reviewers expect. Across 2,500+ audits, 83% of clients recover wasted ad spend. The script also suppresses conversion pixels for flagged sessions in real time, preventing pixel poisoning that would otherwise retrain your bidding algorithms on bot behavior.
Limitation: BotRefund is a detection and evidence layer, not a WAF. It does not block traffic at the network edge. If you need edge blocking, pair it with a CDN/WAF that can act on BotRefund's API verdicts.