How websites recognise antidetect browsers

Antidetect browsers are modified browsers that give every profile its own fake fingerprint, so one person can run dozens of accounts that look like different people. They are used for bonus abuse, fake reviews and ad fraud, and also for legitimate work such as agencies managing client accounts or QA teams. For a website owner the question is how to notice them.

Check your browser right now

Checking your browser…

Why faking a fingerprint is hard

A real browser is one consistent system. The same facts can be read in many places: HTTP headers, JavaScript, Web Workers, iframes, rendering results, the network. To look real, a fake profile has to change all of them in agreement, for every browser version, and keep up as browsers add new features. Every place it misses becomes a contradiction.

Signal 1: sources that disagree

The strongest evidence is two sources that contradict each other: a User-Agent header that differs from navigator.userAgent, Client Hints that name another platform than the User-Agent, a Web Worker that reports another language or core count than the page, an operating system that does not fit the GPU and the fonts. Real browsers practically never produce these.

Signal 2: replaced built-in functions

Many spoofing tools work by overriding browser functions with JavaScript. A native function and a script-made replacement behave slightly differently when inspected, and that difference can be measured. Better tools change the browser engine itself, which removes this trace, so it is one signal among several.

Signal 3: rendering noise

To avoid sharing one canvas or audio hash between profiles, many antidetect browsers add random noise. Drawing the same image twice and getting two different results exposes it. The catch: Brave and Safari also add noise for privacy, so a fair detector first checks which browser it is dealing with.

Signal 4: network and repetition

Profiles usually sit behind proxies, often residential ones. Useful signals here are a data center or known proxy network, proxy headers, a time zone that does not fit the IP, and many accounts or sign-ups that share a network, device traits or behavior over time.

What to do with the result

Detecting a spoofed browser is not the same as proving fraud. QA engineers, agencies and privacy-minded people use similar tools. A sensible policy treats a spoofing verdict as a risk factor: ask for extra verification, limit promo codes or free trials per real device, review high-value orders, rather than block outright.

Try it

The check on this page runs more than thirty of these consistency rules against your own browser and explains each finding. SpoofLens is preparing an API and a WordPress / WooCommerce plugin that give your site the same verdict for each visitor; you can join the waitlist on the home page.

Frequently asked questions

Can antidetect browsers pass every check?: Good ones pass many basic checks, and they keep improving. That is why detection relies on several independent signals and on behavior over time rather than on one test.
Do you publish ways to get around these checks?: No. SpoofLens explains how detection works so that site owners can protect themselves and users can understand what their browser reveals.
Will this flag privacy browsers?: It should not. SpoofLens recognises Brave, Firefox with resistFingerprinting and Tor Browser and shows their changes as privacy protection, without lowering the truth index.