Playwright Bot Bypass

Playwright Bot Bypass

Reduce bot detection using rebrowser-playwright + real headed Chrome. Passes fingerprint checkers (bot.sannysoft.com, areyouheadless) and avoids triggering CAPTCHAs on Google. Not a guaranteed bypass for CDP/runtime-aware enterprise bot managers — see "Detection Coverage" for measured results.

Authorized use only. This is for QA, accessibility testing, and research on sites you own or are permitted to test. Respect each site's Terms of Service, robots.txt, and applicable law. Do not use it to bypass paywalls, abuse rate limits, or scrape against a site's stated wishes.

How Detection Is Defeated (and by which layer)

Evasion comes from three layers, not one — most of it is the real browser, not hand-written JS:

Why so little hand-written JS? Across v2.1/v2.2 the old fake-PluginArray, canvas-noise, hardcoded-hardwareConcurrency, permissions-override, webdriver delete, and navigator.languages getter were all removed — every one created a detectable inconsistency (own-property tells, worker mismatches, undefined webdriver, an Illegal invocation crash). v2.2 keeps exactly two active measures: strip Playwright's __pwInitScripts artifact, and enable rebrowser's Runtime-fix. Everything else is the genuine, self-consistent real browser. Less faking = more consistent = harder to detect.

Prerequisites

• Node.js 18+ with ESM support (.mjs files)
• Google Chrome installed (not just Chromium)
• Headed mode required (headless: false) — no display = no stealth

Verify Chrome is installed:

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version
# Linux
google-chrome --version

Quick Start

1. Install

npm init -y && npm install rebrowser-playwright

2. Create stealth-test.mjs

import os from 'node:os';
import path from 'node:path';

// Enable rebrowser's Runtime.enable fix BEFORE importing the library.
process.env.REBROWSER_PATCHES_RUNTIME_FIX_MODE ??= 'addBinding';
const { chromium } = await import('rebrowser-playwright');

const browser = await chromium.launch({
  headless: false,                                  // headed = real GPU/canvas
  channel: 'chrome',                                // real Chrome = real UA/WebGL/plugins
  args: ['--disable-blink-features=AutomationControlled']
});

// `locale` sets navigator.languages + Accept-Language natively & consistently.
const context = await browser.newContext({ locale: 'ko-KR' });

// The ONLY init script: strip Playwright's main-world signature. Touch NOTHING
// on navigator — the real browser's values are already genuine & consistent.
await context.addInitScript(() => {
  for (const k of Object.getOwnPropertyNames(window)) {
    if (/^__pw|pwInitScripts|playwright/i.test(k)) {
      try { delete window[k]; } catch {}
    }
  }
  if (!window.chrome) window.chrome = {};
});

const page = await context.newPage();

try {
  await page.goto('https://bot.sannysoft.com', { waitUntil: 'networkidle' });
  const out = path.join(os.tmpdir(), 'stealth-test.png');
  await page.screenshot({ path: out });
  console.log(`Screenshot saved: ${out}`);
} finally {
  await browser.close();
}

3. Run

node stealth-test.mjs

Using the Template (Recommended)

The scripts/stealth-template.mjs provides a reusable factory with all patches pre-applied:

import { createStealthBrowser, humanDelay, humanType, simulateMouseMovement } from './scripts/stealth-template.mjs';

const { browser, page } = await createStealthBrowser();

try {
  await page.goto('https://example.com');

  // Human-like mouse movement (avoids Cloudflare Turnstile)
  await simulateMouseMovement(page);

  // Human-like typing instead of instant fill
  await humanType(page, 'input[name="q"]', 'search query');
  await humanDelay(300, 800);
} finally {
  await browser.close();
}

Template Options

const { browser, context, page } = await createStealthBrowser({
  headless: false,             // Required for stealth (default)
  viewport: { width: 1280, height: 800 },  // Default
  locale: 'ko-KR',            // Browser locale (default)
  userAgent: null,             // Custom UA (optional; default = real Chrome UA)
  storageState: './session.json',  // Cookie persistence (optional)
  proxy: { server: 'http://proxy:8080' },  // Proxy (optional)
  noSandbox: false             // Opt-in --no-sandbox (Linux root/CI only; it's a bot signal)
});

// Save session for reuse
import { saveSession } from './scripts/stealth-template.mjs';
await saveSession(context, './session.json');

What the Template Actually Does

The template (v2.2) keeps the active surface to exactly two measures:

It touches nothing on navigator. Everything else is delegated to the real browser (channel:'chrome' + headed): genuine User-Agent, WebGL/GPU renderer, canvas fingerprint, PluginArray, self-consistent permission/hardware values, and (via the locale option) native worker-consistent navigator.languages + Accept-Language.

Removed across v2.1/v2.2 (each was net-negative — faked values inconsistently with the real environment): fake navigator.plugins, canvas getImageData noise, hardcoded hardwareConcurrency/deviceMemory, outerWidth/Height offset, the permissions override (crashed with Illegal invocation), the navigator.webdriver delete (made it undefined — a tell), and the navigator.languages getter (own-property + worker-mismatch tells).

Launch arg: --disable-blink-features=AutomationControlled. --no-sandbox is opt-in ({ noSandbox: true }) — it is both a security risk and an automation signal, so it is off by default.

Heavy SPAs (TikTok/IG/FB) may print non-fatal [rebrowser-patches] cannot get world warnings under addBinding mode — the page still loads. Switch to REBROWSER_PATCHES_RUNTIME_FIX_MODE=alwaysIsolated to silence them if needed.

Scripts

• scripts/stealth-template.mjs — Reusable stealth browser factory (all examples import this)
• scripts/bot-detection-test.mjs — Verify bypass at bot.sannysoft.com

Examples

• examples/stealth-google-search.mjs — Google search without CAPTCHA
• examples/ab-test.mjs — Side-by-side detected vs stealth comparison
• examples/stealth-twitter-scrape.mjs — Twitter/X profile scraping

Note: ab-test.mjs requires both rebrowser-playwright AND playwright:

npm install rebrowser-playwright playwright && npx playwright install chromium

All screenshots are saved to the OS temp directory (os.tmpdir()) — /tmp on macOS/Linux, %TEMP% on Windows.

Detection Coverage (measured 2026-06-10, macOS headed Chrome, v2.2)

Honest, tested results. v2.2's artifact-strip + Runtime-fix flipped every fingerprint/automation detector to pass:

Reliability: 9/9 repeat runs clean (the __pwInitScripts strip held across every navigation).