Inspect the client behind the user agent
An HTTP client can send a Chrome user agent without running Chrome. Other clients reproduce a browser's TLS handshake. Browser automation goes further by driving Chromium itself, sometimes with scripts that hide or replace automation markers.
Heretic compares those declarations with the connection and browser tests. Replacing a user agent does not change a TCP packet already captured by the sensor. A modified browser can still avoid individual checks, so the response describes what was actually observed.
Declared automation
Every probe checks WebDriver declarations, explicit headless user agents, and recognized driver
globals. An exposed HeadlessChrome user agent is a conclusive
finding. A false WebDriver flag alone does not establish a human visitor.
Altered browser APIs
Native browser objects have specific behavior. A navigator getter rejects the wrong receiver type. A plugin collection supports both named and indexed lookups. WebGL 2 requires its core methods. Heretic checks for replacements and conflicts in these properties.
It also compares stable values across the page, frame, and worker. A timezone rewrite confined to the page can leave a different timezone in a worker. Each confirmed inconsistency receives its own finding ID. Extensions and application libraries can trigger these checks too.
Our canvas readback experiment shows why the input conditions matter when interpreting an altered pixel result.
Connection checks
The sensor captures TCP options, TLS handshake fields, HTTP/2 settings, and QUIC attempts.
It compares them with browser declarations and protocol constraints. A claimed Chromium
session with an incompatible HTTP/2 preface can produce http.h2-stack-contradicts-tls.
Conclusive findings determine the verdict. Conditional observations stay in the response for your policy to evaluate. The signal reference lists the checks and their tiers.
Require a completed check
An opened session that does not finish required measurements returns refused. If the collector is blocked before opening a session,
there is no assessment. Your backend must require a valid result before serving an action
that depends on verification.
An automated browser can complete every check without a conclusive contradiction. Apply your access policy to the findings you receive. That policy can reject a session, rate-limit it, request a phone challenge, or allow it.