2 / 5 DDoS, WAF & Abuse Control

The Flag That Lied

Your bot defense blocks any session where the client reports the WebDriver automation flag as true. Detection collapses within a week while the abusive traffic continues. Why is this class of check fragile, and what holds up better?

A

Serious scrapers disable JavaScript entirely, so no script-based signal survives, and address blocklists paired with request-rate ceilings are the only reliable controls left

B

Any client-side flag can be patched by the automation stack, so durable detection uses signals costly to fake: TLS and HTTP/2 fingerprints matched against the claimed browser, plus behavioral scoring

C

The flag is defined only for one browser engine, so automation built on the other engines was never covered, and checking each engine's own automation property alongside it closes the remaining hole in coverage

D

The check evaluates only after the page finishes loading, so it has to move into a service worker that runs before the first request completes and reports its result with that request