Collect signals that distinguish real browsers from automated clients:

• Browser API checks: Does the client have a working canvas, WebGL, audio context? Headless browsers often fail or return fingerprint-less results.

• Mouse and keyboard patterns: Real users have non-linear mouse movement, varying typing speed, pauses. Bots move in straight lines or not at all.

• Event timing: Real users take 0.5–3 seconds to click between form fields. A form filled in 50ms was not filled by a human.

• Device consistency: Does the reported User-Agent match the actual browser capabilities? Mismatches indicate spoofing.

• IP reputation: Is the IP in a known datacenter range or residential proxy pool? Legitimate users rarely come from AWS or DigitalOcean IP ranges.

Building fingerprinting from scratch is complex — bots adapt quickly. Commercial services like Cloudflare Bot Management, DataDome, PerimeterX (Human), and Arkose Labs specialize in this and continuously update their detection as bot operators respond. For high-value business flows, a commercial service is usually more effective than a DIY implementation.

Sophisticated bot operators use real browsers (Puppeteer/Playwright with stealth plugins), residential proxies, and mouse-movement simulation to bypass fingerprinting. No detection is perfect — the goal is to raise the cost of bot operation, not eliminate it entirely.