Anti-detect browsers spoof or isolate fingerprint layers so each profile looks like a distinct user. Anti-bot vendors score dozens of signals in ensemble models — fixing one leak while ignoring TLS or behavior still fails. This deep dive maps what engineers audit before blaming “bad proxies.”
Signal layers
| Layer | Signals | Common failure |
|---|---|---|
| Network | IP ASN, RTT, DNS resolver, WebRTC local IP | Datacenter IP + residential claim |
| TLS | JA3/JA4 cipher order, ALPN, extension list | Headless Chrome TLS ≠ claimed User-Agent OS |
| HTTP | Client Hints (Sec-CH-UA*), Accept-Language, order of headers | UA says Windows, hints say Linux |
| JavaScript | Canvas, WebGL vendor/renderer, fonts, audio, math | Random canvas per session — unstable hash |
| Automation | navigator.webdriver, CDP side effects, input timing | Instant form fill, zero mouse entropy |
| Behavior | Scroll curves, click variance, session depth | Login → scrape loop with no dwell time |
Canvas & WebGL
Canvas fingerprinting renders hidden text/shapes and hashes the pixel output. GPU drivers, font smoothing, and subpixel rendering affect the hash. Anti-detect tools either noise the output (must be stable per profile) or use consistent GPU presets.
WebGL exposes UNMASKED_VENDOR_WEBGL and renderer strings. Mismatch — e.g. Apple M1 UA with Intel GPU renderer — triggers instant bot scores. Audit with the same profile twice; hashes must match.
TLS & Client Hints
Cloudflare and large CDNs fingerprint the TLS handshake independently of JavaScript. Chromium version bumps change JA3. After browser updates, re-baseline pass rate on target sites.
User-Agent Client Hints replace naive UA parsing. Spoofed UA without matching Sec-CH-UA-Platform is a high-confidence automation flag.
WebRTC & DNS leaks
Even perfect Canvas fails if WebRTC exposes LAN IP or real ISP while proxy claims another country. Multilogin and peers offer WebRTC policies — set to proxy-only or disabled per target requirement. See proxy alignment guide.
Mobile vs desktop
Desktop anti-detect targets Chromium signals. Mobile apps use device attestation (SafetyNet, Play Integrity) — different stack entirely. For TikTok app use cloud phone, not canvas spoofing.
Audit workflow
- Launch profile twice — compare canvas/WebGL hashes (must match)
- Check WebRTC, timezone, language vs proxy geo
- Capture TLS fingerprint on target CDN (browserleaks-class tools)
- Run minimal Playwright attach — verify no webdriver leak
- Single manual session — if manual passes, automation timing is suspect
Related
FAQ
Most important signal?
Profile fails after Chrome update?
Disclosure: MLX-MMO affiliated with Multilogin. SAAS50 / MIN50.