· 2 min
How Websites Detect Antidetect Browsers
The six layers that sites check to find spoofed browsers: network, headers, JavaScript APIs, rendering, workers and frames, and native integrity.
A site does not need one perfect signal. It collects many small ones and looks for a contradiction. An antidetect browser must keep every layer consistent with every other layer. One mismatch is often enough.
How detectors read a browser
Native engine spoofing
1. Network layer
The first data arrives before any page loads. The server sees your IP, its ASN, and the TLS and HTTP handshake. A datacenter ASN, or a TLS fingerprint that does not match the claimed browser, is a strong signal. The IP also gives a location that the server compares with your timezone and language.
2. HTTP headers
The User-Agent string, the UA Client Hints (Sec-CH-UA-*), Accept-Language and the header order must agree. A Chrome version in the user agent and a different version in Client Hints is a common leak.
3. JavaScript APIs
Scripts read navigator, screen, Intl, permissions, media codecs, fonts and many more APIs. Each value must fit the device that the profile claims. A Windows user agent with macOS fonts, or 32 CPU cores on a profile that claims a cheap laptop, stands out.
4. Rendering
Canvas, WebGL, WebGPU and audio produce output that depends on the GPU, driver and OS. Sites hash this output. Random noise on each read is a signal too: a real device gives the same hash every time, so an unstable hash is suspicious.
5. Workers and frames
A page can open a Web Worker, a Service Worker or an iframe. Each one is a new JavaScript scope with its own navigator and its own APIs. If spoofing only patches the main page, the worker reports the real values. Sites compare the scopes and flag any difference.
6. Native integrity
A real browser API is native code. When a tool replaces a function with JavaScript, traces stay: toString() output, property descriptors, prototype chains and error stack traces change. We explain this in native vs JavaScript fingerprint spoofing.
What this means when you choose a tool
| Layer | What the browser must do |
|---|---|
| Network | Use a clean proxy whose location fits the profile |
| Headers | Keep UA and Client Hints in sync |
| JS APIs | Give values that fit one real device |
| Rendering | Give stable, plausible output |
| Workers and frames | Give the same values in every scope |
| Native integrity | Change values inside the engine, not in page scripts |
The last three layers are where engine-level spoofing wins. This is why the fingerprint engine has the largest weight (22%) in our methodology. Donut Browser, Camoufox and Kameleo score highest there; see /rankings.
Test your profile
Run your profile through our free fingerprint test. It checks all six layers and shows which ones disagree.