navigator.webdriver: what the automation flag means and how sites use it
navigator.webdriver is a property that every modern browser exposes to page scripts. It is true when automation software controls the browser and false in a browser a person opened. It is the cheapest bot check there is and also one of the easiest to get around, so it helps to know what it tells you and what it leaves open.
Check your browser right now
Checking your browser…
Where the flag comes from
The W3C WebDriver standard, the protocol behind Selenium, defines a "webdriver-active" flag and requires browsers to show it to pages as navigator.webdriver. Chrome, Firefox, Safari and Edge all do. The flag turns on when the browser starts under automation: through chromedriver, geckodriver or safaridriver for Selenium, and by default in browsers launched by Puppeteer and Playwright.
How to check your own browser
Open the developer console (F12, then the Console tab) and type navigator.webdriver. A browser you started yourself prints false. The check on this page reads the same value and shows it in the report together with other traces of automation.
True says a lot, false says little
A true value almost always means automation: a test, a monitor, a scraper or a bot. A developer can see it in a window opened by a test tool, but ordinary visitors never have it.
A false value proves much less. Automation tools have options that start the browser without the flag, and bot frameworks hide it as one of their first steps. The flag filters out honest tools and careless bots, and the rest have to be caught by other signals.
When someone hides the flag
A script inside the page can change what the property returns, and such a change tends to leave traces that a careful check looks for. A browser started without the flag keeps a clean property, but the bot still runs where it ran before: often in a data center, often with a software graphics renderer, and with behavior that is faster and more regular than a person's. When the bot sends some requests outside the browser through an HTTP library, the TLS handshake of those requests gives it away too.
How to use it on your site
Reading navigator.webdriver in your own page script is easy, but anything the browser sends back can be forged. Send the value to your server together with other signals and make the decision there. If your own tests or monitors visit the site, put them on an allowlist so the flag does not block them.
SpoofLens treats a true flag as a strong finding and gives the verdict "automation". Through the API and the WordPress / WooCommerce plugin you get that verdict with the reasons for each sign-up or order.
Frequently asked questions
- Why is navigator.webdriver true in my browser?
- The browser was started by an automation tool: a test framework, a scraper, an RPA robot or a cloud browser service. Close that window and open the browser the usual way, and the value goes back to false.
- Is checking navigator.webdriver enough to stop bots?
- No. It stops tools that announce themselves. Bots made to abuse a site hide it, so combine it with checks of consistency, the network and behavior.
- Does SpoofLens block visitors that have the flag?
- SpoofLens itself blocks nobody. The API returns the verdict, and the WordPress / WooCommerce plugin blocks automated browsers only if you enable that setting.