Headless Browser Blocked by Cloudflare? What Works (2026)
By Steven Van ·
Browser Use compares stealth plugins, managed browsers, proxies and Web Bot Auth, with benchmark figures that it says favor its own browser.
Browser Use has published a guide to why Cloudflare, DataDome and Akamai block headless Playwright and Puppeteer, and which fixes work. Stock headless Chrome gets flagged because it announces automation: navigator.webdriver is true, and Playwright's default headless shell reports HeadlessChrome in its user agent. It also often runs from a cloud server IP and starts every run with no cookies. Browser Use covers the options in its article and notes that it sells one of the managed browsers it discusses.
Why headless gets blocked
On zones with Bot Management, Cloudflare scores requests from 1 (automated) to 99 (human), and sites block or challenge low scores. The article lists the signals involved:
- Automation tells in checked by Cloudflare JavaScript Detections and DataDome's JS tag.
- TLS and header fingerprint: a handshake or header order that doesn't match the claimed browser, which catches HTTP clients and copied user agents.
- IP reputation: scripts run from cloud servers or shared proxies, and Cloudflare managed lists flag open proxies, anonymizers and VPNs (Enterprise).
- Cookies and challenges: a fresh context per run drops cf_clearance and __cf_bm, so every run is judged as a new visitor.
- Behavior: instant actions and request bursts.
- Identity: anonymous automation is scored like any unknown client.
The options compared
- Stealth plugins (puppeteer-extra-plugin-stealth, playwright-stealth) are free and address JS tells, but don't change TLS or IP. DataDome names Puppeteer Extra Stealth as detected. The Puppeteer plugin's last release is 2.11.2 (March 1, 2023); playwright-stealth 2.0.3 shipped April 4, 2026.
- Managed stealth browsers (Browser Use Cloud, Browserbase Verified and others) cover fingerprint, residential IP and CAPTCHAs. They are paid, and Browser Use's docs say access to every site is not guaranteed. Browser Use lists its price as $0.02 per browser-hour plus $5/GB for proxy. Browserbase Verified is on its Scale plan.
- Residential proxies alone change the IP but not the JS, cookie or TLS signals. They are priced per GB.
- Verified, signed bots (Web Bot Auth) are recognized rather than disguised. This needs Cloudflare's approval, adherence to robots.txt and reasonable request rates, and the site still decides whether to allow, challenge or block. Browserbase offers it in beta.
- An official API, or asking the site owner, avoids the problem, though an API may not exist or may cost money. A Cloudflare customer can let a client through with a skip rule.
Benchmark figures
The article cites Stealth Bench V2 (September 25, 2026) on 100 sites. Browser Use says the sites were picked because its browser historically got through and stock Chrome with a US proxy did not, so the set favors Browser Use and the baselines are low by construction. Visits that got through:
- Headless Chrome, no proxy: 3%
- Headful Chrome with a US proxy: 14%
- Six other cloud browser providers: 73.5% to 82%
- Browser Use Cloud with the CAPTCHA solver off: 84%
- Browser Use Cloud: 90.5%
Each site got 2 visits, and a visit counts if a judge model saw the real site within 60 seconds. In a March 2026 run on 71 sites from a datacenter IP, headless Chromium got through 2% of the time and the same Chromium with a visible window 50%.
Keeping a Playwright script
The article shows how to keep an existing Playwright script: create a cloud browser through POST https://api.browser-use.com/api/v4/browsers, then replace launch() with connect_over_cdp() using the returned cdpUrl. Closing the CDP connection doesn't stop the cloud browser. To stop it, send PATCH https://api.browser-use.com/api/v4/browsers/{id} with {"action": "stop"}.
The article says to use this only where automation is allowed, to follow each site's terms and robots.txt, and to prefer an official API when one exists.