Browser Fingerprinting in Web Scraping

A fingerprint script runs in the page, reads what the browser exposes, and sends a summary to the site's anti-bot service, which scores it together with the IP and the request headers. The definition and the privacy side are in what is a browser fingerprint; for scraping, these are the signals that give automation away:

No single signal decides. Most systems combine them into a score, and the strongest evidence is a contradiction: a signal that cannot be true together with another one.

Selenium drives the browser through ChromeDriver or geckodriver over the WebDriver protocol, and that leaves four kinds of evidence:

The "Selenium browser fingerprint" a site sees is the sum of these. Selenium's own job is testing, not hiding, so it doesn't try to remove them. How to run Selenium with a proxy is in Selenium with proxies, and scraping with it in Selenium web scraping.

Yes, for the same reasons, plus one of their own. Puppeteer and Playwright control the browser through the Chrome DevTools Protocol (Playwright also through its own protocol for Firefox and WebKit), and detection scripts can notice side effects of that connection in the page. They also inherit the headless tells: the HeadlessChrome user agent, software WebGL and default viewports. Patched builds such as Patchright, a Playwright fork, and CDP-free drivers such as nodriver exist because the stock libraries are visible to these checks (both repositories were updated in October 2026, checked on GitHub).

Playwright's Firefox is a patched build, not the Firefox users run, which some checks can tell apart. Firefox-based scraping browsers such as Camoufox change fingerprint values at the engine level instead of through injected JavaScript. Setup guides: Puppeteer with proxies, Playwright with proxies.

Stealth plugins patch the known tells with JavaScript injected before the page loads: they set navigator.webdriver to false, fill in plugins and languages, and fix the user agent. Two things wear them down:

• Detection moves, plugins don't always. The best-known one, puppeteer-extra-plugin-stealth, lives in a repository with no push since July 2024 (berstend/puppeteer-extra on GitHub), while Chrome ships a new major version about every two weeks.
• A patch can be a tell. A property overridden in JavaScript can behave differently from the native one, for example in how it looks when converted to a string or where it sits on the prototype. Scripts test for that.

So a stealth setup that passed last year can fail today without any change on your side. Test it again after every browser or library update.

A headless browser built on real Chrome sends Chrome's real TLS handshake, so its TLS fingerprint is fine; it is caught in the page, by the signals above. An HTTP library is the opposite: no page signals, but its handshake shows which library made it, whatever User-Agent it claims. Sites that check both catch each kind on its weak side. The TLS part is explained in TLS and TCP fingerprinting, and how headless mode works in what is a headless browser.

A clean residential IP helps with the IP's reputation and network type, nothing else. The browser behind it still shows its own fingerprint, and the two have to agree:

• Time zone, language and locale should match the proxy's country (and city, if you target one). Playwright's locale and timezone_id set both in one place.
• WebRTC can reveal the machine's real IP to the page if the browser isn't configured to send WebRTC through the proxy; test for leaks with the proxy on.
• One fingerprint per IP session. Keep a sticky IP for a browser profile; a profile that changes IP on every page, or an IP that serves ten different fingerprints, is unusual.

ProxyField gives you sticky sessions from 30 s to 36 h, or a new IP per request, with country, region and city targeting, so the IP can match the profile's locale. ProxyField's success rate is 99.6%, according to our service data; on sites that score fingerprints, the browser side decides as much as the IP.

What tends to work, from the network up:

1. IP: residential or mobile IPs in the country you claim, sticky per browser session (residential proxies).
2. Browser: a real, current Chrome or Firefox build, headful where you can, or Chrome's new headless mode; avoid outdated bundled builds.
3. Driver: a library or patch that removes the automation traces, kept up to date with the browser.
4. Profile: a persistent profile with cookies and history per identity, not a blank one per page.
5. Consistency: user agent, client hints, screen size, fonts, time zone and language that all describe the same device.
6. Behavior: realistic pacing, scrolling and waits; no request bursts.
7. Test: run the stack against a fingerprint test page, such as CreepJS, before you point it at a target.

Changing fingerprint values on purpose is a technique of its own, with its own limits: see fingerprint spoofing.

Some fingerprinting isn't about scrapers at all. Login pages and payment checkouts run fraud checks on device and browser signals to stop account takeover and card fraud. Automating those flows is not public data collection; ProxyField's acceptable use policy restricts financial services and doesn't allow access to data behind logins you are not entitled to. Before you scrape, check what the site allows: is web scraping legal.

Give the browser an IP that matches it. ProxyField residential proxies: 412M+ residential IPs, sticky sessions up to 36 h, country, region and city targeting, from $1.95/GB with no subscription. Start with the Easy Trial (1 GB); traffic never expires, and all purchases are final.