Browser Detection Tests: Playwright Scores -140 on Signals, 100 on Behavior
Seven anti-detection browsers were installed and tested against detect-bot, a three-phase headless browser detection tool. Only one browser produced complete Phase 1-3 results. The split between fingerprint-based detection and behavioral analysis revealed a gap worth examining.
What was tested
The test runner installed all seven browsers successfully: Camoufox, CloakBrowser, Invisible-Playwright, Nodriver, Browser-Act, SeleniumBase, and Playwright (vanilla). The target was https://detect-bot.vercel.app/test-results, which runs Phase 1 (static fingerprint checks), Phase 2 (active JavaScript probes), and Phase 3 (behavioral fingerprinting via the FP-Agent framework).
Only Playwright produced usable results. Camoufox failed with a ModuleNotFoundError during the test extraction step. The remaining five browsers installed cleanly but the test runner does not execute their individual test paths -- it only exercises Playwright and Camoufox explicitly. This gap exists because anti-detection browsers each require browser-specific launch code, and the runner was written for the two that share a Python API.
Playwright vanilla: caught on signals, clean on behavior
Playwright's default Chromium launch produced a clear split between static and behavioral detection.
| Phase | Verdict | Score |
|---|---|---|
| Phase 1+2 (Fingerprint) | BOT | -140/100 |
| Phase 3 (Behavioral) | HUMAN | 100/100 |
Nine of 15 signals flagged the browser. The breakdown shows which categories were the hardest to spoof.
| Signal | Penalty | Detected Value |
|---|---|---|
| navigator.webdriver | -50 | true |
| window.chrome | -30 | Missing |
| User Agent | -30 | HeadlessChrome |
| navigator.plugins | -25 | 0 (empty) |
| WebGL Renderer | -25 | SwiftShader / Software GPU |
| Timezone vs Locale | -20 | UTC + en-* |
| Stack Trace (eval origin) | -20 | Eval'd code |
| Language Depth | -15 | 1 language (Chrome expects 2+) |
| Notification.permission | -15 | denied (fresh page expects default) |
| Window = Screen | -10 | Identical (no browser chrome) |
| Total | -240 in flagged signals | 9 of 15 signals flagged |
Six signals passed: performance.now() returned normal precision, hardwareConcurrency was 2 (plausible), deviceMemory was 4 GB, automationControlled was undefined, GPU vs UA Platform matched expectations for Linux software rendering, and the GPU deduplication hash did not trigger a collision.
Behavioral phase: why Playwright passes
Playwright's default page.click() generates synthetic mousemove events between the cursor's current position and the target element. The FP-Agent behavioral tracker recorded 3 mouse events with 0 teleports and 3 smooth paths. Scroll events: 1 scroll interaction with 0 scroll bursts. No keystrokes, no pastes, no change events.
The behavioral score: 100/100, verdict HUMAN.
This is the expected result from detect-bot's documentation. Playwright's click path generation mimics natural mouse movement well enough to pass Phase 3 at default settings. Using force: true or direct dispatchEvent would skip the mousemove events and flag as a teleport.
The untested gap
Five browsers installed but produced no results: CloakBrowser, Invisible-Playwright, Nodriver, Browser-Act, and SeleniumBase. The test runner installs them but does not execute browser-specific test code for each. Each anti-detection browser has its own launch API, and the runner only has test paths for Playwright (via playwright.async_api) and Camoufox (via camoufox.AsyncCamoufox).
This is a known gap in the automated pipeline. Adding test paths for each browser requires writing browser-specific launch code wrapped in subprocess calls. The install step confirms the packages are available; the execution gap is a test harness limitation, not a browser failure.
Takeaways
Playwright's default headless Chromium is caught immediately on fingerprint signals. The nine flagged signals span navigator properties, rendering characteristics, and environment markers. Any single flag is enough to classify the session, and Playwright triggers nine.
The behavioral phase is a different problem. Generating clicks with smooth paths is straightforward -- Playwright does it by default. The harder behavioral signals (typing cadence, scroll acceleration curves, viewport dwell patterns) are not triggered by simple button-click interactions. A real human session generates orders of magnitude more behavioral data than three button clicks and one scroll.
The Phase 1+2 gap between Playwright (-140) and what a patched anti-detection browser could score remains untested in this run. Camoufox, which patches navigator.webdriver, the WebGL renderer string, and plugin arrays, would be the first candidate for a Phase 1+2 pass. The ModuleNotFoundError in the test extraction step suggests the Camoufox package installed but the import path changed or the Python environment does not match the install target.