What does “Headless Chrome” mean?

Headless Chrome is a version of the Chrome browser that runs without a graphical user interface (GUI). It is controlled via a command line or an API (like Puppeteer or Playwright).

Many sophisticated bot developers will “spoof” (fake) their User Agent to look like a standard version of Chrome to avoid being blocked.

If you see “Headless” in the string, it’s usually because the bot developer didn’t bother to hide it.

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0

You can challenge requests that include “HeadlessChrome” or “Headless” in their user agents

Using Headless Chrome

I asked one of my buddies to create a simple python script to learn more about Headless Chrome.

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from webdriver_manager.chrome import ChromeDriverManager
import time
# 1. Setup Chrome Options
chrome_options = Options()
chrome_options.add_argument("--headless=new")  # Runs Chrome in Headless mode
chrome_options.add_argument("--window-size=1920,1080")  # Sets a virtual window size
chrome_options.add_argument("--disable-gpu")  # Recommended for headless stability
# 2. Initialize the Driver
# This will automatically download the correct ChromeDriver version for you
service = Service(ChromeDriverManager().install())
driver = webdriver.Chrome(service=service, options=chrome_options)
try:
    print("Launching Headless Chrome  ...")
    driver.get("https:/example.com/admin.php/")
    # 3. Prove it's working (Since we can't see it)
    print(f"Successfully reached the site!")
    print(f"Page Title: {driver.title}")
    # Let's grab the text of the first H1 or H2 heading we find
    from selenium.webdriver.common.by import By
    heading = driver.find_element(By.TAG_NAME, "h1").text
    print(f"Main Heading on Page: {heading}")
    # 4. Take a 'Proof of Life' Screenshot
    # Even though we can't see the browser, it is still "rendering" the page in memory.
    driver.save_screenshot("headless_screenshot.png")
    print("Saved a screenshot to 'headless_screenshot.png' so you can see what the bot saw.")
finally:
    # 5. Always close the driver
    driver.quit()
    print("Browser closed.")

This was the user agent that it used.

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36

Since I have a rule to deal with this type of bot traffic

(http.user_agent contains "Headless")

All request using Headless Chrome were blocked by CloudFlare

Why didn’t Attackers or Scrapers Fake the User Agent?

Actually, most professional scrapers and attackers do change their User Agent.

The fact that you see “HeadlessChrome” in your logs usually means you are catching the “low-hanging fruit” or the poorly configured scripts.

if you use this Python script instead and monitor your logs, you will find that you have a different user agent now that won’t be targeted by a simple Cloudflare rule.

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from webdriver_manager.chrome import ChromeDriverManager
from selenium.webdriver.common.by import By
import time
# 1. Setup Chrome Options
chrome_options = Options()
chrome_options.add_argument("--headless=new") 
chrome_options.add_argument("--window-size=1920,1080")
chrome_options.add_argument("--disable-gpu")
# --- FAKE USER AGENT ADDITION ---
# This makes the browser identify as a standard Windows 10 user on Chrome 120
fake_ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
chrome_options.add_argument(f"user-agent={fake_ua}")
# --- STEALTH SETTINGS ---
# This helps hide the fact that the browser is being controlled by automation software
chrome_options.add_experimental_option("excludeSwitches", ["enable-automation"])
chrome_options.add_experimental_option('useAutomationExtension', False)
# --------------------------------
# 2. Initialize the Driver
service = Service(ChromeDriverManager().install())
driver = webdriver.Chrome(service=service, options=chrome_options)
try:
    print(f"Launching Headless Chrome with Fake UA...")
    # Using your example URL
    driver.get("https://example.com/") 
    print(f"Successfully reached the site!")
    print(f"Page Title: {driver.title}")
    # Confirming what the website sees
    actual_ua = driver.execute_script("return navigator.userAgent;")
    print(f"The website thinks I am: {actual_ua}")
    heading = driver.find_element(By.TAG_NAME, "h1").text
    print(f"Main Heading on Page: {heading}")
    driver.save_screenshot("headless_screenshot.png")
    print("Saved screenshot.")
finally:
    driver.quit()
    print("Browser closed.")